RapidIdentity SAML Configuration

Set up Single Sign-On (SSO) for your organisation using RapidIdentity.

Use the following information from Canva to configure your identity provider.

• ACS URL/Reply URL: https://www.canva.com/login/saml
• Entity ID/Identifier: https://www.canva.com
• SAML attributes: NameID, Email, FirstName, LastName
• Metadata text
• Canva logo

Make sure your SAML assertion includes a signature as well by checking your settings.

We also recommend using the following settings.

• Include SAML2 Attribute Statement: True
• Sign SAML2 SSO Response: Never
• Sign SAML2 SSO Assertions: Conditional
• Encrypt SAML2 SSO Assertions: Never
• Encrypt SAML2 SSO Name Ids: Never
• Signature Algorithm: RSA SHA-256

For districts with a multi-school setup, you’ll need to transfer your roster data to Canva to help us identify which school a user should be assigned to.

There are different ways to do this. Choose one of the options below that best fits your needs.

If you’re using Classlink, you can send us your roster data via RosterSync. Check OneRoster Provisioning to know how.

There are a few ways for this option.

If you have an attribute in your SAML app with the school name, school ID, or any other unique identifier related to the school, you can use that as your “TeamId” attribute to send information on what school each user belongs to.

Create a claim in your SAML app that sends that attribute, and name the Claim "TeamId".

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

You can also create a new claim and use claim conditions to send “TeamId” attribute values based on groups or other user attributes.

You can do this by manually creating a set of conditions that tell your SAML app which attribute value to send for each user based on the group the user is in.

For example, if students at Harmony Elementary are in "Harmony Students" and staff are in "Harmony Staff", you could tell your SAML app to send "Harmony" as the “TeamId” for both groups using claim conditions.

Name the Claim "TeamId", and share a CSV with Canva that contains the name of each school and the corresponding “TeamId” value that will be sent via the claim.

You can also create a Group Claim in your SAML app, which sends the Group name as a claim value. For this to work, you must have a single group in your SAML app for each school. This group needs to contain all the users in the school (students and staff), and these school groups need to be the only groups sent as part of the claim.

Name the Claim "TeamId", and share a CSV with Canva that contains the name of each school and the corresponding “TeamId” value that will be sent via the claim.

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose Settings.
4. From the side menu, click the SSO and provisioning tab.
5. Click Single sign-on (SSO) > Manage > Edit IdP metadata.
6. Enter your identity provider’s details in the three fields:

• SSO or login URL:
• Entity ID or Issuer URL:
• X.509 Public Certificate:

6. Click Save and next.

There are two easy ways to test your SSO setup:

If you're still on the Set up SSO page, scroll to the Test your SSO connection section and click Test SSO. If you're starting from the Canva homepage instead:

1. On the homepage, select your account profile to open menu.
2. Choose Settings.
3. From the side menu, click the SSO and provisioning tab.
4. Under Single sign-on (SSO) > Manage > Test SSO.

This lets you quickly check if everything’s working without logging out.

1. Before logging out, go to the SSO and provisioning tab.
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Set the login option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, click Continue with email, then select Log in with SSO.

Make sure to test using a student account and a teacher account. You’ve successfully configured SSO if:

• You logged in as a teacher and can see the People page.
• You logged in as a student and can’t see the People page.

Choose how you want people to log in. We recommend requiring SSO for everyone in your domain.

1. From the homepage, select your account profile to open menu.
2. Choose Settings > SSO and provisioning.
3. Click Single sign-on (SSO) > Manage > Configure SSO settings.
4. Select Required for everyone (domain capture).
5. Click Save changes.