Configuring OIDC-Based SSO in Canvas for RapidIdentity

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

After you configure an OpenID Connect (OIDC) federation partner for Canvas in RapidIdentity, add RapidIdentity as an identity provider in Canvas to complete the integration.

Requirements
  • Canvas administrator credentials
  • The Client ID and Client Secret issued by RapidIdentity for the Canvas federation partner
  • Your RapidIdentity tenant URL
  1. In Canvas, navigate to Admin > Account Selection.
  2. From the navigation menu, select Authentication.
  3. From the Add an identity provider to this account pop-up menu, select OpenID Connect.
  4. Enter the Client ID and Client Secret issued by RapidIdentity.
  5. Configure the following endpoint URLs, prefixing each path with your RapidIdentity tenant URL (for example, https://RapidIdentityTenantURL/idp):
    FieldPath
    Discovery URL/idp/.well-known/openid-configuration
    Issuer Identifier URL/idp
    Authorize URL/idp/profile/oidc/auth
    UserInfo Endpoint/idp/profile/oidc/userinfo
    JWKS URI/idp/profile/oidc/jwks
  6. From the Token Endpoint Authentication Method pop-up menu, select client_secret_basic.
  7. Leave the End Session Endpoint and Scope fields blank.
  8. In the Login Attribute field, enter email.
  9. (Optional) Select the Just in Time Provisioning checkbox to create users automatically during their first IdP authentication.
  10. In the Federated Attributes section, configure the email attribute mapping:
    1. Canvas Attribute: email
    2. Provider Attribute: email
    3. Provisioning Only: Deselected
    4. Autoconfirm: Selected (unless you want users to receive a confirmation email verifying access to the email account)
    Note:

    You can add other federated attributes as needed. Each additional attribute requires an associated claim configured in RapidIdentity.

  11. Click Save.

RapidIdentity and Canvas are now integrated, allowing users to authenticate to Canvas with their RapidIdentity credentials.