ADFS SAML configuration (For Enterprise)

Set up Single Sign-On (SSO) for your organization using Microsoft’s Active Directory Federation Services (ADFS).

1. Log in to your ADFS server. If you need help deploying ADFS, check this guide.
2. Open the ADFS management console, and select Trust Relationships > Relying Party Trusts.
3. From the Actions menu, click Add Relying Party Trust. This will open a wizard that will guide you through the process.
4. In the Select Data Source step, select Enter data about the relying party manually.

5. In the Specify Display Name step, enter “Canva”.

6. In the Choose Profile step, select AD FS profile.

7. In the Configure Certificate step, leave the certificate settings at their default values.
8. In the Configure URL step, select Enable support for the SAML 2.0 WebSSO protocol, and enter Canva’s SAML service endpoint: https://www.canva.com/login/saml.

9. In the Configure Identifiers step, enter https://www.canva.com, and click Add.

10. In the next step, you can add optional multi-factor authentication.
11. In the Choose Issuance Authorization Rules step, select Permit all users to access this relying party. Click Next, and review your settings.
12. On the final screen, make sure the Open the Edit Claim Rules dialog for this relying party trust when the wizard closes is selected. Click Close.

After adding Canva to ADFS, the claim rule editor will open where you can create rules or assertion claims.

You’ll need two claims: one for Canva Attributes and one for NameID. Canva only receives the outgoing claim type attributes and values, so the list of attributes might look different.

1. Click Add Rule.

2. Create a rule to send LDAP attributes as Claims. Add outgoing claim types for Email, FirstName, and LastName (Note: Outgoing claim types are case-sensitive).

3. Create another rule to Transform an Incoming Claim. Open the required NameID claim rule, and change the Outgoing name ID format to Persistent Identifier. Click Finish to save.

1. Log in to your Canva account.
2. Go to your profile avatar, then select
   Settings.
3. From the side menu, select
   SSO and provisioning.
4. Under Domain verification, select Add domain and enter your team’s domain.
5. Click Submit domain. You will then be provided with a DNS token.
6. Create a TXT record of the DNS token using your domain host. Help from your IT team might be needed for this step.

Learn more about adding a TXT record in our Setting up Single Sign-on (SSO) article.

1. Log in to your Canva account.
2. Go to your profile avatar, then select
   Settings.
3. From the side menu, select
   SSO and provisioning.
4. Under Single sign-on (SSO), click Manage, then Edit IdP metadata.
5. In the SSO or login URL field, enter your SAML 2.0 Endpoint URL (also called the SAML 2.0/W-Federation URL).
6. In the Entity ID or Issuer URL field, enter your Identity Provider Issuer.
7. In the X.509 public certificate field, paste all the contents from your downloaded certificate (sample certificate).
8. Select Save and next.

There are two easy ways to test your setup:

1. Go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning tab.
3. Under Single sign-on (SSO), select Manage, then Test SSO.

1. Go to
   SSO and provisioning, then select Single sign-on (SSO), then Manage, then Configure SSO settings.
2. Set the SSO settings option to Optional for everyone.
3. Log out of your Canva account.
4. On the login page, select Continue with email, then Log in with SSO.

If you were redirected to your team’s account, you have successfully configured SSO!

Choose how you want people to log in to your SSO-managed teams.

1. From the homepage, go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Click Single sign-on (SSO), then Manage, then Configure SSO settings.
4. Choose your preferred SSO setting. Learn more about each option in Setting up login and signup controls.
5. Click Save Connection.