GSuite (Google) SAML configuration (For Education)

Set up Single Sign-On (SSO) for your school system using GSuite (Google).

1. From your Google Admin console, go to Apps > Web and mobile apps.
2. Click Add App, then Search for apps.
3. In the search field, type Canva. Select Canva Web (SAML) app.
4. On the Google Identity Provider details page, copy or note the SSO URL and Entity ID. You’ll need them in a later step. Make sure the Signed response box is checked.

5. On the same page, download the Certificate, then click Continue.
6. In the Service Provider Details window, leave most settings on the page as they are. More on this on the note below. Click Continue.
7. In the Attributes section, make sure the fields look like below, and click Finish.

Service Provider Details NameId: We recommend sending a Custom Attribute with a non-email unique identifier. If you don’t have one, you can use Primary email, but this could make it more challenging for Canva to automatically update email addresses when your users change email addresses, or if your institution changes its email domain.

To avoid issues, don’t use First Name or Last Name for NameId.

This step will help us identify which users are Students and which are Teachers or Staff. There are a few ways to do this.

Canva can assign student or teacher roles based on common email patterns. For example:

• Students on one email domain; Staff on another
• Students have a number at the beginning; Staff does not

If you'd like us to activate this on your account, complete the SSO setup process, then contact our Support team to activate domain-based role mapping.

If you populate Google Admin using data from another source, you can set that source to send the data to Google in the form you need.

In the source database (Active Directory or SIS), create a mapping that sends the word "staff" to Google as the value for “Cost Center” for Teachers or Staff. The value for Students can be blank or "student".

We recommend using the Cost Center user attribute on the Google Admin user profile as it is available in the SAML process but is usually unused by districts.

If you populate Google Admin manually, using bulk CSV import, or using an external scripting tool (or a scripting tool like GAM or Gopher), you can use the same processes to populate a role attribute.

In Google, populate the word "staff" as the value for "Cost Center" for Teachers and Staff. The value for Students can be blank or “student”.

We recommend using the Cost Center user attribute on the Google Admin user profile as it is available in the SAML process but is usually unused by districts.

For districts with a multi-school setup, you’ll need to transfer your roster data to Canva to help us identify which school a user should be assigned to. There are a few ways to do this.

If you’re using Classlink, you can send us your roster data via RosterSync. Check OneRoster Provisioning to know how.

There are a few ways for this option.

If you have an attribute in your SAML app with the school name, school ID, or any other unique identifier related to the school, you can use that as your “TeamId” attribute to send information on what school each user belongs to.

1. In the Canva app in Google workspace, go to SAML attribute mapping.
2. Select Add a new mapping.
3. Under Google directory attribute, select the attribute that contains the unique school identifier.
4. Enter TeamId as the app attribute.

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

You can also create a Group Claim in your SAML app, which sends the Group name as a claim value. For this to work, you must have a single group in your SAML app for each school. This group needs to contain all the users in the school (students and staff), and these school groups need to be the only groups sent as part of the claim.

1. In the Canva app in Google workspace, go to SAML attribute mapping.
2. Go to the Group membership section.
3. Under Google groups, enter the names of each school group. Each school should only have one group.
4. Enter TeamId as the app attribute.

Afterward, share a CSV file with Canva containing each school's name and the exact name of the Google group for each school.

You can use Organizational Units to assemble one Dynamic Group for each school in your organization. Dynamic Groups can be composed of multiple organizational units.

1. Create a dynamic group for each school. Go to Directory > Groups.
2. Select Create Dynamic Groups.
3. On the filter logic, select OR if the group will contain multiple organizational units.
4. Set up the filter using the details below. If students and teachers are in different organizational units, you’ll need two conditions as shown below.

5. Tick the checkbox for Exclude suspended users.
6. Click on Preview to confirm emails. then click Create Dynamic Group.
7. Enter the following details:
   • Group name - This will be the name passed to Canva
   • Group email - This should be the same as the Group name
8. Select Save.

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   Settings.
4. From the side menu, select the
   SSO and provisioning tab.
5. Under Single sign-on (SSO), click Manage > Edit IdP metadata.
6. Enter the following details from GSuite (Google).
   1. SSO or login URL: Paste your SSO URL.
   2. Entity ID or Issuer URL: Paste your Entity ID.
   3. X.509 Public Certificate: Paste all of the contents from your Certificate.
7. Click Save and next.

1. Sign in to your Admin console.
2. Go to Apps > Web and mobile apps.
3. Select the Canva app.
4. Go to Settings > User access.
5. To turn on Canva for everyone in your district, select On for everyone, then click Save.
6. To turn on Canva for an organizational unit, select the organizational unit, then select On.

Learn more about organizational units and group settings.

There are two easy ways to test your SSO setup:

If you're still on the Set up SSO page, scroll to the Test your SSO connection section and click Test SSO. If you're starting from the Canva homepage instead:

1. On the homepage, select your account profile to open menu.
2. Choose
    Settings.
3. From the side menu, click the
   SSO and provisioning tab.
4. Under Single sign-on (SSO) > Manage > Test SSO.

This lets you quickly check if everything’s working without logging out.

1. Before logging out, go to the
   SSO and provisioning tab.
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Set the login option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, click Continue with email, then select Log in with SSO.

Make sure to test using a student account and a teacher account. You’ve successfully configured SSO if:

• You logged in as a teacher and can see the People page.
• You logged in as a student and can’t see the People page.

Choose how you want people to log in. We recommend requiring SSO for everyone in your domain.

1. On the homepage, select your account profile to open menu.
2. Choose Settings.
3. Click Single sign-on (SSO) > Manage > Configure SSO settings.
4. Select Required for everyone (domain capture).
5. Click Save changes.