ADFS SAML configuration (For Education)

Set up Single Sign-On (SSO) for your school using Microsoft’s Active Directory Federation Services (ADFS).

1. Log in to your ADFS server. If you need help deploying ADFS, check this guide.
2. Open the ADFS management console, and select Trust Relationships > Relying Party Trusts.
3. From the Actions menu, click Add Relying Party Trust. This will open a wizard that will guide you through the process.
4. In the Select Data Source step, select Enter data about the relying party manually.

5. In the Specify Display Name step, enter "Canva".

6. In the Choose Profile step, select AD FS profile.

7. In the Configure Certificate step, leave the certificate settings at their default values.
8. In the Configure URL step, select Enable support for the SAML 2.0 WebSSO protocol, and enter Canva’s SAML service endpoint: "https://www.canva.com/login/saml".

9. In the Configure Identifiers step, enter "https://www.canva.com", and click Add.

10. In the next step, you can add optional multi-factor authentication.
11. In the Choose Issuance Authorization Rules step, select Permit all users to access this relying party. Click Next, and review your settings.
12. On the final screen, make sure the Open the Edit Claim Rules dialog for this relying party trust when the wizard closes is selected. Click Close.

After adding Canva to ADFS, the claim rule editor will open where you can create rules or assertion claims.

You’ll need two claims: one for Canva Attributes and one for NameID. Canva only receives the outgoing claim type attributes and values, so the list of attributes might look different.

1. Click Add Rule.

2. Create a rule to send LDAP attributes as Claims. Add outgoing claim types for Email, FirstName, and LastName (Note: Outgoing claim types are case-sensitive).

3. Create another rule to Transform an Incoming Claim. Open the required NameID claim rule, and change the Outgoing name ID format to Persistent Identifier. Click Finish to save.

This step will help us identify which users are Students and which are Teachers or Staff. There are two ways to do this.

Canva can assign student or teacher roles based on common email patterns. For example:

• Students on one email domain; Staff on another
• Students have a number at the beginning; Staff does not

If you'd like us to activate this on your account, complete the SSO setup process, then contact our Support team to activate domain-based role mapping.

If you don’t have an email pattern, Canva can parse to assign roles. Follow these steps:

1. Create a rule to send group membership as a claim. You'll need to send the word "staff" for any user who is an employee. Name this rule Temporary.
2. View the Rule Language in Step 1 and copy it.
3. Create a new rule and choose Send Claims Using a Custom Rule.
4. Click Next.
5. Name the rule Role, then paste the Rule Language you copied from Step 2.
6. Delete "http://schemas.microsoft.com/ws/2008/06/identity/claims/".
7. Delete your Temporary rule.

For districts with a multi-school setup, you’ll need to transfer your roster data to Canva to help us identify which school a user should be assigned to.

There are different ways to do this. Choose one of the options below that best fits your needs.

If you’re using Classlink, you can send us your roster data via RosterSync. Check OneRoster Provisioning to know how.

There are a few ways for this option.

If you have an attribute in your SAML app with the school name, school ID, or any other unique identifier related to the school, you can use that as your “TeamId” attribute to send information on what school each user belongs to.

Create a claim in your SAML app that sends that attribute, and name the Claim "TeamId".

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

You can also create a Group Claim in your SAML app, which sends the Group name as a claim value. For this to work, you must have a single group in your SAML app for each school. This group needs to contain all the users in the school (students and staff), and these school groups need to be the only groups sent as part of the claim.

Name the Claim "TeamId", and share a CSV with Canva that contains the name of each school and the corresponding “TeamId” value that will be sent via the claim.

1. Log in to your Canva account.
2. From the homepage, go to your profile avatar, then select
   Settings.
3. From the side menu, click
   SSO and provisioning.
4. Under Single sign-on (SSO), click Manage, then Edit IdP metadata.
5. In the SSO or login URL field, enter your SAML 2.0 Endpoint URL (also called the SAML 2.0/W-Federation URL).
6. In the Entity ID or Issuer URL field, enter your Identity Provider Issuer.
7. In the X.509 Public Certificate field, paste all the contents from your downloaded certificate (sample certificate).
8. Click Save and next.

There are two easy ways to test your setup:

1. Go to your profile avatar, then
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Under Single sign-on (SSO), select Manage, then Test SSO.

1. Go to
   SSO and provisioning
2. Select Single sign-on (SSO), then Manage, then Configure SSO settings.
3. Set the SSO settings option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, select Continue with email, then Log in with SSO.

Make sure to test using a student account and a teacher account. You’ve successfully configured SSO if:

• You logged in as a teacher and can see the People page.
• You logged in as a student and can’t see the People page.

Choose how you want people to log in. We recommend requiring SSO for everyone in your domain.

1. From the homepage, go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Select Single sign-on (SSO), then Manage, then Configure SSO settings.
4. Set the SSO settings to Required for everyone (domain capture).
5. Select Save connection.