Setting up SCIM provisioning in PingFederate
Configure SCIM (System for Cross-domain Identity Management) standard for your team or district using PingFederate.
Who can use this feature?
SCIM is only available to Canva Enterprise and Canva for Districts, and it isn’t available for new Canva Teams subscribers.
Limitations: For teams within an organization's structure (both single-team or multi-team), user provisioning and deprovisioning are supported. However, all other functionalities, such as provisioning users directly into specific teams or creating groups, aren’t currently supported.
Before setting up SCIM for your team, please ensure that you have the following:
- Admin access to PingFederate.
- A working SAML connection, already set up in PingFederate.
- Team admin/ owner access to a Canva brand.
Supported provisions
- Create users - Users in PingFederate assigned to the Canva App are added as team members of the organization in Canva.
- Update user attributes - Updates made to the user's profile through PingFederate will be pushed to Canva.
- Deactivate users - Deactivating the user through PingFederate will lock the user in Canva.
Step 1: Download and set up the SCIM connector add-on
- Download the SCIM connector add-on here. This connector is needed as PingFederate doesn't support SCIM 2.0 out of the box while Canva uses SCIM 2.0.
- Once the add-on is downloaded, unzip it and copy the jar to <PingFederate install location>/pingfederate/server/default/deploy/
- Enable SCIM by modifying <PingFederate install location>/pingfederate/bin/ run.properties file. Look for pf.provisioner.mode and change its value from OFF to STANDALONE or FAILOVER depending on your configuration.
- Restart PingFederate.
Step 2: Configure Connection type
- Under Applications, go to SP connections and select Outbound provisioning.
- If the SCIM connector has been installed correctly, you should see the SCIM connector in the drop-down menu. Select the SCIM connector.
Step 3: Configure Outbound provisioning
- Under Outbound provisioning, select Configure provisioning.
- Log in to the Canva brand that you have admin access to. The brand should already have a SAML connection (i.e. certificates, SAML endpoint, domain verification etc. is already configured).
- On the homepage, select your account profile to open menu.
- Choose Settings.
- From the side menu, click the SSO and provisioning tab.
- Enable SCIM and copy the access token.
- After copying the access token, go back to PingFederate and enter the values as shown. Note, the access token in the screenshot is what was copied from Canva previously. Select Next once done.
Step 4: Configure channel
- Configure the channel/ create the channel as per your setup/ configuration.
- Map the attributes as shown below. If you're not using LDAP, the mapping is basically as follows. Set the channel as Active once done.
Data store attribute | Canva attribute |
|---|---|
First name | givenName |
Family name/Surname/lastname | familyName |
UserID/UPN/some sort of ID | username |
Email address | workEmail |
Formatted name/Display name | displayName |
User ID/UPN/some sort of ID | externalId |
Congratulations! You've now successfully enabled SCIM provisioning.
If you’re having trouble configuring your PingFederate SCIM integration, contact our Support team for help.
For Canva Education, please reach out to your contact person at Canva Education.
For advanced users, please see our developer documentation on the SCIM endpoint for more information.
Was this helpful?
Helpful
Unhelpful