PingFederate SAML configuration

Before setting up Single Sign-On (SSO) for your team, please ensure that you have the following:

1. A PingFederate account.
2. A Canva account with verified domain and admin/owner access is available.
3. An available data store of users (for e.g. LDAP). Since the configuration of data stores can vary from company to company, we won’t go into details of setting those up.

Once you have the requirements above, you may start setting up SSO for your team.

1. If you haven't yet, create a Data store by going to System then Data store.
2. Select create new data store if your desired data source isn't present. The data source would keep a list of users and their attributes (name, email, etc.).

1. If you haven't yet, create a password credentials validator by going to System, then Password credentials validator, and then Create new instance. If you already have a password credentials validator, make sure it's compatible with your data source.
2. Ensure the password credential validator contract has surname/ family name, given name, username/ id/ UPN, and mail.

1. Create a new connection by selecting Applications, then SP connections, then Create connection.

2. Select Do not use a template.

3. Under Connection type tab, select Browser SSO and then from the drop-down menu, select SAML2.0.

4. Under Connection Options tab, select Browser SSO.

5. Under Import Metadata tab, select URL and then select Manage Partner Metadata URLs.

6. Select Add new URL.

7. Enter name and URL as https://www.canva.com/_saml/metadata.xml. Make sure to untick Validate metadata signature option.

8. Select Load metadata. Check if the values are correct, and then select Save.

9. Select the name you gave from the drop-down menu, select Load metadata, and then select Next.

10. Add general information and make sure the connection ID is as shown. Give a name to the application and change transaction logging as per your requirement.

1. In PingFederate, select Browser SSO and then select Configure Browser SSO.

2. Under SAML profiles tab, select both IDP-initiated SSO and SP-initiated SSO.

3. Under Assertion lifetime tab, change the value depending on your preference.

4. Under Assertion Creation, select Configure Assertion Creation.

5. Select Standard.

6. Map attributes as shown in the screenshot below.

7. Create a new Adapter instance or select any adapter instance you might already have. If you already have an existing adapter instance, make sure the attributes that Canva needs are available.
8. Extend the contract as shown. Note that the attributes are coming from the data store. Update this accordingly if you're using a different data source or if the attributes with the same name aren't present. Make sure the attributes we need are email, given name, and family name.

9. Select an ID as the unique key. Change the Logging options as per your requirement.

10. Configure the Adapter contract or select a contract if you already have one. The attributes we need are email, given name, and family name. Please map accordingly and then enter the filter value.

11. From the drop-down menu, select the newly created adapter or existing adapter.

12. Select Use only adapter contract values in SAML assertion.

13. Adjust the mapping as shown below. If you prefer to have issuance criteria, add them here.

14. Under Protocol settings, select Configure protocol settings.

15. Check if the login Endpoint URL is as shown.

16. Untick SOAP and Artifact.

17. Select Always sign assertion.

18. Under the Encryption tab, select None.

19. Check the values and then select Save.
20. Under the Credentials tab, select Configure credentials.

21. Create a new certificate or select an existing active one.

1. In PingFederate, go to Applications, then SP connections. You should see the newly created connection.
2. Select Export metadata.

3. Under certificates, select the certificate used previously. Make sure that the certificate used in the connection is the same one used to sign the exported metadata.
4. Select Export and save the file.

5. Open the exported file and take note of the Certificate value and SSO POST binding value.

6. Go to System, select Protocol settings, then Federation Info. Enter the POST binding URL from the exported metadata.

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   Settings.
4. From the side menu, click the
   SSO and provisioning.
5. Under Domain verification, enter your team’s domain.
6. Click Submit domain. You'll then be provided with a DNS token.
7. Create a TXT record of the DNS token using your domain host. Help from your IT team might be needed for this step.

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   Settings.
4. From the side menu, click the
   SSO and provisioning.
5. Under SAML, enter the following details from PingFederate.
6. In the SAML 2.0 Endpoint (HTTP) field, paste your Identity Provider Single Sign-on Service URL. You can get this from the metadata that was exported.
7. In the Identity Provider Issuer field, paste your Issuer ID. You can get this from the metadata that was exported.
8. In the Public Certificate field, paste all of the contents from your X.509 Certificate section on the downloaded metadata.

9. Click Save changes.

1. On the homepage, select your account profile to open menu.
2. Choose
   Settings.
3. From the side menu, click the
   SSO and provisioning.
4. Under Choose who must use SSO, select SSO optional for everyone.
5. Log out of your Canva account.
6. Log in again using SSO. On the login page, select Continue with email, then select the Continue with single sign-on (SSO) link.

If you were redirected to your team’s account, you've successfully configured SSO!

Choose how you want people to log in to your SSO-managed teams.

1. On the homepage, select your account profile to open menu.
2. Choose
   Settings.
3. From the side menu, click the
   SSO and provisioning.
4. Under Choose who must use SSO, select an option. Learn more about each option in Setting up login and signup controls.
5. Click Save changes.