NON-ACADEMIC COURSE MIGRATION

If you're migrating a course that is non-academic (training, orientation, activity-type course), visit How to migrate a Non-Academic Course to help you better understand key considerations and potential impacts.


How to migrate a Credit Course - Canvas Migration

For questions about Canvas migration:

Visit our Canvas Migration FAQs .


For pedagogical or instructional design questions:

Contact ceehelp@sfu.ca.


For additional assistance or technical support:

Request a support ticket using Canvas - Request Help . (Select ' ' as the area of help) Related Services / Offerings (1) Canvas is SFU's institutionally supported learning management system.


How to migrate a Non-Academic Course - Canvas Migration

Teaching and Learning Learning Management


OVERVIEW

This article provides instructions on how to migrate your non-academic courses as part of the transition to Canvas Cloud . If you're looking for instructions to migrate a credit course, see How to migrate a Credit Course . What is a non-academic course? What should I do? For non-academic courses with a completion date For non-academic courses that are permanently running For other types of non-academic courses Before you migrate How to migrate Next steps for non-academic courses Exceptions for course continuity on Canvas On-Premise


WHAT IS A NON-ACADEMIC COURSE?

Non-academic courses in Canvas are instructional offerings that are not tied to a degree or certificate academic program. Typically, these are designed to facilitate: Training, programs or orientation as a course in Canvas Student club or extra-curricular activities as a course in Canvas Event or workshop as a course in Canvas And more...


WHAT SHOULD I DO?

Whether or not you should migrate your non-academic Canvas course depends on many factors, including the type and duration of the course. Determine which case your course best matches with and take the corresponding action. Below are three categorized types of non-academic courses: Non-academic courses with a completion date Non-academic courses that are permanently running Other types of non-academic courses


TIP

Try using our Non-Academic Course Migration Guide to see what you should do (approx. 1 - 2 min.).


FOR NON-ACADEMIC COURSES WITH A COMPLETION DATE

Example Courses SFU 101: Spring 2025 Job Search Success – Fall 2025 Leadership Foundation Program 2025-26 Training 2025WHIMIS Student Ambassador Program 2024-2025 SFU JDC West 2025 WHAT I SHOULD DO (click to expand) Case Action to take If the course ends before Dec 2025... Continue running the course until completion on Canvas On-Premise. If you plan to re-use content for a future iteration... Migrate and run future iterations in Canvas Cloud. If the course is running beyond Jan 2026 and existing student assignment submissions, quiz submissions or discussion replies are not critical to course delivery... Migrate and continue the course in Canvas Cloud. If the course is running beyond Jan 2026 and existing student assignments submissions, quiz submissions or discussion replies are critical to course delivery... Review if the course is an exception for course continuity on Canvas On-Premise . Note : Existing student work cannot be migrated to Canvas Cloud using the course migration tool .


FOR NON-ACADEMIC COURSES THAT ARE PERMANENTLY RUNNING

Example Courses MMC: 3D Printing Learning Pathways VPFA Employees Returning from Study Abroad 101 Community Engagement Volunteer Training 4D Labs Safety Training SEE Co-op SkillBuilder WHAT I SHOULD DO (click to expand) Case Action to take If the course is still running or content is still needed... Migrate and continue the course in Canvas Cloud. If the course is no longer running or content is no longer needed... Leave as-is.


COURSES USED FOR CONTENT STORAGE, RESEARCH DATA, RECORD KEEPING OR SHARED RESOURCES

Examples Courses Writing Resources Interview Tip Job Descriptions at SFU Teaching Resources and Policy High School Outreach Portfolio FAS Graduate Program Coordinator Manual WHAT I SHOULD DO (click to expand) Case Action to take If the audience is primarily staff or faculty... Switch to a more befitting service, such as SharePoint or


AEM

. See Choosing a Document and Content Management Tool at SFU . If the audience is primarily students, or it requires features in Canvas... Migrate and continue the course in Canvas Cloud.


COURSES USED FOR RESEARCH GROUPS, WORKING OR INTEREST GROUPS, DISCUSSION FORUMS, COMMUNITIES OR COMMITTEES

Example Courses Experiential Learning Community of Practice NVivo User Community Indigenous Knowledge Holders In-No-Particular-Order: Discussions on Interdisciplinarity CREATE HyTEM Program Committee Elders and Community Members WHAT I SHOULD DO (click to expand) Case Action to take If only staff or faculty are involved... Switch to a more befitting service, such as Microsoft Teams . See Choosing a Document and Content Management Tool at SFU . If students or non-SFU individuals are involved, or it requires features in Canvas... Migrate and continue the course in Canvas Cloud.


NOTE

: Provided above are some general guidelines. Instructors are the experts on what courses and course content they wish to maintain. If your course content is still needed and requires Canvas features, migrate the course to Canvas Cloud.


BEFORE YOU MIGRATE

When selecting a course to migrate using the course migration tool ( migrate.its.sfu.ca ), the following items will or won't automatically transfer to Canvas Cloud. Can Migrate Unable to Migrate Course Content Announcements Assignments, files, modules and pages Discussion topics Question banks and quizzes Rubrics Syllabus body Most course settings and LTIs Calendar events Student work Assignment submissions Quiz submissions and results Discussion replies (discussion topics will migrate, but replies do not) Grades Enrolment-related data Course users and roles Collaborations and sections Conferences Groups and group sets Other Feature option settings LTI configurations, secrets and keys (including H5P key) Location details on calendar events Referenced media or links (content that is referenced from another course) Custom HTML or Javascript may break Embeded SVG images


REMINDER ABOUT PROFILE DATA

Profile data cannot be migrated automatically. If you wish to keep any profile data, you will need to manually re-add the profile data on Canvas Cloud. This includes: ePortfolio, biography, inbox messages, profile files, profile photo, profile customizations and settings.


HOW TO MIGRATE

As long as the course instructional content won't be changing (i.e., no newly created modules, assignments, pages, quizzes, etc.), you're free to migrate at any time. We recommend migrating your course early to ensure that you have sufficient time to complete 'next steps' before the launch in January 2026. IT Services has a course migration tool to support course migration, along with guides to support its use:


STEP 1.

Visit the course migration tool at migrate.its.sfu.ca or select the button. You may be asked to sign in with your SFU Computing ID .


STEP 2.

Select the Canvas course you wish to migrate to Canvas Cloud on the drop-down menu. If you don't see your course, try Refresh List .


STEP 3.

Select Submit Query .


STEP 4.

Select Confirm .


STEP 5.

The tool will begin migrating your course behind the scenes. Migrating large courses may be delayed during peak times. You can choose to leave the page and return to the course migration tool at migrate.its.sfu.ca . Once the progress is complete, a web link will be displayed that directs you to the migrated course on Canvas Cloud. You can also find the migrated course under Courses > All Courses in Canvas Cloud.


NOTES

The course migration tool will remain available for the foreseeable future (until Canvas On-Premise has been completely deprecated). The course migration tool is accessible to any SFU user. However, courses will only appear in the tool if the user has an 'instructor' role to those courses. Recently created courses (or courses you've recently been given instructor role) may not appear immediately. Try selecting 'Refresh List' after a few minutes. When a course is migrated from Canvas On-Premise, it will remain as-is and continues to be accessible to you. 'Course migration' simply copies your course from Canvas On-Premise to Canvas Cloud using the built-in 'export' feature on Canvas. It is possible for a course can be migrated multiple times and by multiple people if a course has more than one instructor. 'Course migration' simply creates a copy and assigns the user who initiated the migration access to the copied course. This process bar should not take more than a few minutes to complete for smaller courses (less than 50 MB). Larger courses (over 500 MB) can possibly take 30 minutes or more during peak periods. For technical support, request a support ticket using Canvas - Request Help . (Select ' ' as the area of help)


After you have migrated your course:

Review the course for any issues and make necessary adjustments. In rare cases, links to media files or third-party tools (LTIs) may not transfer correctly and may need to be manually updated. Some modules or pages may not retain its 'published/unpublished' state. Copy or import the content from your migrated course to a new course shell. This allows you to adjust terms, dates and more on assignments and announcements. You can create a new course shell using the Start a New Course tool. Alternatively, you can simply rename and re-purpose the migrated course shell. Explore New Quizzes. You have the option to convert your quizzes from Classic Quizzes to New Quizzes . Please note that once a Classic Quiz converted to a New Quiz, it cannot be reverted. Re-add users (students, instructors, designers) to your course. Enrolment-related data (i.e., roles, groups, etc.) are not transferred when migrating a course. For instructions on re-adding your students, visit How to migrate Users to another course . If you encounter an error, "We were unable to find matches below", simply select 'Next' to skip the user(s). Do not select any check boxes (refrain from creating them as new users). See How to migrate Users to another course for details on this error. Configuring your course in such a way that students can continue progressing through the course without past student work (i.e., quiz submissions, assignments, discussion replies, etc.) since student work can't be migrated (if applicable to your course). For example, you may want to remove module restrictions/prerequisites tied to assignments or quizzes if asking students to redo them is not an option. Notify your students in January 2026 on any important changes to the course (if applicable to your course). If needed for your course, canvas-old.sfu.ca is available starting January 2026 to


After you have migrated your course:

want to remove module restrictions/prerequisites tied to assignments or quizzes if asking students to redo them is not an option. Notify your students in January 2026 on any important changes to the course (if applicable to your course). If needed for your course, canvas-old.sfu.ca is available starting January 2026 to access past course content. Learn more about feature differences between Canvas On-Premise and Canvas Cloud .


COURSES USING MAILLISTS FOR AUTOMATIC ENROLMENTS (MAILLIST INTEGRATION)

As of April 30, 2025, SFU Maillist has been transitioned to SFU Groups . If you are migrating a course that has automatic enrolments via maillists and would like to continue using this feature, you will need to request an SFU Groups security group as a replacement for the maillist. Once you have a security group, request a support ticket using Canvas - Request Help for us to connect that security group to your course on Canvas Cloud. Note: Grouper integration with Canvas Cloud will be available late Fall 2025. We suggest you prepare a security group ahead of time.


EXCEPTIONS FOR COURSE CONTINUITY ON CANVAS ON-PREMISE

Due to technical limitations with Canvas, student work tied to a course cannot be transferred to Canvas Cloud using the course migration tool. These components include: Assignment submissions Quiz submissions and results Discussion replies If existing student work is critical to the delivery of your non-academic course and cannot be moved over manually, it may be more appropriate to continue running the course on Canvas On-Premise until its conclusion. We advise against this approach as it may cause unnecessary disruption for students who would need to navigate between two separate Canvas platforms. Examples where this option may be considered can be a course with: A large number of students have already submitted assignments or quizzes which are linked with unlocking modules and altering this is not an option. A large number of students have already submitted assignments or quizzes which continually need to be used throughout the course delivery A large number of posted discussions and replies that are critical to continuing the course delivery and manually copying these over to a new course shell is not feasible.


THIS APPLIES TO MY COURSE. WHAT SHOULD I KNOW?

If you choose to continue delivering the non-academic course on Canvas On-Premise, you should know the following: Platform Transition Impacts Starting January 2026, the web link, canvas.sfu.ca, will redirect to Canvas Cloud. To access Canvas On-Premise, users must use the updated web link: canvas-old.sfu.ca. Service Reduction In 2026, Canvas On-Premise will be scaled back and run at a lower capacity as most usage will have moved to Canvas Cloud. Due to software licensing changes, there will also be recurring service outages in order to apply updates and security fixes. Student Communication Required You’ll need to proactively inform students of your decision to remain on Canvas On-Premise, only particular to your course. You will also need to inform students of the updated web link. Clear communication will help minimize confusion and ensure continued access to course materials. Course End Date Courses that choose to continue on Canvas On-Premise must be concluded before the end of December 2026. After this date, access to this platform should only be for temporary archival purposes.


For questions about Canvas migration:

Visit our Canvas Migration FAQs .


For pedagogical or instructional design questions:

Contact ceehelp@sfu.ca.


For additional assistance or technical support:

Request a support ticket using Canvas - Request Help . (Select ' ' as the area of help)


Simon Says Chatbot - How to Guides

Administrative and Business Find the red [...]> icon on the bottom right-hand corner of the screen and click it to start "Simon Says”. Select one of the support topics listed or manually type your question directly into the chat window. For best results, keep your questions clear and concise. Phrasing it a short sentence or prompt will give you the best results. Review the response provided by the chatbot. If you need further clarification or different information, you can ask follow-up questions. If Simon Says does not understand your question, it may ask for clarification. If it cannot find an answer, it will provide options from the Knowledge Base articles. The bot may prompt you to complete a form or submit a ticket if your question requires further IT support. Forms and tickets can be submitted directly through the bot. If the bot cannot provide a satisfactory answer, consider rephrasing or simplifying your question. If that does not work, your inquiry may require further support from Service Desk. You can close the chat window at any time or type “End” to finish the conversation. To help us improve the chatbot in the future, please rate your conversation when the bot asks, “Did I answer your question okay?". Your feedback is greatly appreciated in helping us making the bot the best it can be! Asking the Chatbot Questions Effectively Use clear and simple language so the bot can narrow down your question accurately. Provide context to your question if needed. The bot may ask you to select an option from a list of choices or to clarify your question further by typing more information. Remember that the chatbot is constantly learning as the Knowledge Base is updated. Topic Instead of Typing... Try Asking... Password or Login “I tried logging on three


Simon Says Chatbot - How to Guides

bot may ask you to select an option from a list of choices or to clarify your question further by typing more information. Remember that the chatbot is constantly learning as the Knowledge Base is updated. Topic Instead of Typing... Try Asking... Password or Login “I tried logging on three times and it’s not working. How do I resolve this?” “How can I reset my password?” or “I need help logging in” Groups or Grouper “I don’t have access to the email list I created in 2023, where is it?” “How can I access my old SFU maillists?” Lecture Recording “I’m in Burnaby and can’t figure out if lecture recording is possible here” “I need help with lecture recording in my classroom”


Simon Says Chatbot - How to Guides

Questions about Simon Says? Feel free to submit them here:

Chatbot - Ask Question


How to migrate users to another course - Canvas Migration

Teaching and Learning Learning Management


OVERVIEW

This article describes how to migrate users to another course as part of the transition to Canvas Cloud . How to migrate users


NOTE

: These instructions is intended to be used with non-academic courses and will only migrate users with a 'student' role . We recommend adding users with 'teacher' or other roles manually. Credit course should have its students automatically added.


STEP 1

. Visit Grades section on the Canvas course you wish to migrate users from. If you're on a different Gradebook View, select Individual Gradebook on the top-left corner, then select Traditional Gradebook .


STEP 2.

Select Export > Export Entire Gradebook


STEP 3

. Open the downloaded spreadsheet file. Select and copy the list of SIS Login IDs .


STEP 4

. Visit People section on the Canvas Cloud course you wish to add users to. Then, select +People button.


STEP 5.

Change the Add user(s) by to Login ID and paste the list of SIS Login IDs you previously copied. Then, select Next .


NOTE

: If you encounter an error, "We were unable to find matches below", simply select 'Next'. Do not select any check boxes (refrain from creating them as new users) . Creating them as new users will cause log in issues for these SFU accounts. SFU accounts that aren't active at SFU will cause this error, such as an alumni. As a work around, ask the individual to log into canvas-new.sfu.ca . Alternatively, you may contact technical support to address the issue directly on a specific user. A permanent solution is currently being investigated.


STEP 6.

Select Add Users .


STEP 7

. Congratulations! You've added users from another course. They will be able to access the course and accept the invitation as a student.


For additional assistance or technical support:

Request a support ticket using Canvas - Request Help . (Select ' ' as the area of help) Related Services / Offerings (1) Canvas is SFU's institutionally supported learning management system.


Changes to credit course shell creation - Canvas Migration

Teaching and Learning Learning Management Canvas


OVERVIEW

This article describes the changes to credit course shell creation on Canvas Cloud as part of the transition to Canvas Cloud .


BY REQUEST

Instructors would've needed to request the course shell themselves using the Start a New Course tool. Once requested, it will be created and available to the instructor. For some departments, staff would've requested these courses on behalf of instructors to assist with the course setup or on-boarding. In some cases, instructors cannot request their course shell because it was already requested/claimed by another individual. The instructor would've needed to contact IT Services to reclaim it.


CROSS-LISTING

Instructors can choose to cross-list their courses using the Start a New Course tool if their courses haven't already been requested/claimed. Alternatively, instructors can contact IT Services to cross-list their course.


AUTOMATIC

Credit course shells no longer need to be requested. Credit course shells will automatically appear on the Canvas Dashboard for instructors one semester prior to the start of class. For example, if an instructor is assigned to teach a course in Spring 2026, their course shell will be automatically be created and assigned to them at the beginning of September 2025.


BY REQUEST

The Start a New Course tool remains available along with all of its features. For departments who requested courses on behalf of instructors, they may continue to request course shells ahead of time to assist instructors. As before, course shells can be requested two semesters prior to the start of class.


CROSS-LISTING

The process for cross-listing remains mostly unchanged. Instructors can continue to cross-list their courses using the Start a New Course tool if their courses haven't already been requested/claimed. Because of the automatic course creation, we recommend creating cross-listings with the Start a New Course tool before one semester prior to the start of class if possible. If their course shells have already been created by the automatic course shell process, instructors can contact IT Services to cross-list their course.


STUDENT ENROLMENT

For Spring 2026 credit course shells: students will be automatically added at the start of class (January 2026). For Summer 2026 and future credit course shells: students will be automatically added within 24 hours of creation.


BEHIND THE SCENES

Canvas Cloud automatically creates and assigns course shells to instructors based on goSFU as long as an instructor has been assigned to teach a course by departmental staff. This happens to courses one semester prior to the start of the course. The system runs this creation process for Canvas Cloud once a day.


WHEN NO INSTRUCTOR IS ASSIGNED

If no specific instructor (or a placeholder) has been assigned to a course on goSFU, the automatic course creation will not happen to those courses until one is assigned.


WHEN THE INSTRUCTOR CHANGES

Assuming that course shell has already been automatically created and a new instructor is assigned in goSFU, when the system find that the user with the instructor role on the course shell is different from the assigned instructor on goSFU, the system will automatically add the new instructor. Any existing users with the instructor role in that course shell will not be removed when the instructor is assigned.


WHEN THE COURSE SHELL ALREADY EXISTS

If a course shell has already been requested (and created) via the Start a New Course tool, when the Automatic Course Shell Creation starts at the beginning of the semester, the system will look at goSFU data and check if the assigned instructor has already been added to the course shell. If the instructor is not in the course shell, the system will automatically add the instructor to the existing course shell and will appear on their dashboard. Any existing users with the instructor role in that course shell will not be removed when the instructor is assigned.


For questions about Canvas migration:

Visit our Canvas Migration FAQs .


For pedagogical or instructional design questions:

Contact ceehelp@sfu.ca.


For additional assistance or technical support:

Request a support ticket using Canvas - Request Help . (Select ' Migration ' as the area of help) Related Services / Offerings (1) Canvas Canvas is SFU's institutionally supported learning management system.


Storage in Canvas Cloud - Canvas Migration


OVERVIEW

This article describes storage limits and how storage is used in Canvas Cloud as part of the transition to Canvas Cloud . Changes to Storage Quota Storage use in Canvas Cloud Requests for Additional Storage


CHANGES TO STORAGE QUOTA

As part of the transition to Canvas Cloud, storage quotas have been reduced to align with Instructure’s recommended limits to promote more efficient resource usage. This change helps manage the cloud storage allocation compared to the previous on-premise setup, encourages the use of external platforms for large media files and improves overall system performance. We've ensured that nearly all courses fit within the new quotas, with support available for any exceptions.


CANVAS CLOUD

Course Storage Quota


0.5 GB

Personal Storage Quota


0.05 GB

Group Storage Quota


0.05 GB

Learn more about feature differences between Canvas On-Premise and Canvas Cloud .


COURSE STORAGE

The default storage limit for courses on Canvas Cloud is


. The following items in Canvas contribute towards this quota:

Files attached to announcements and pages. Files uploaded directly into "Files" on courses. File submissions to graded assignments in courses. Files attached to graded discussions topics and its replies in courses.


GROUP STORAGE

The default storage limit for groups on Canvas Cloud is


. The following items in Canvas contribute towards this quota:

Any content created on the Canvas group. Files uploaded onto the Canvas group.


PERSONAL STORAGE

The default storage limit for users on Canvas Cloud is


. The following items in Canvas contribute towards this quota:

Files uploaded directly into "Files" on your profile. Files uploaded directly into your ePortfolio. File submissions to ungraded assignments in courses. Files attached to ungraded discussions topics and its replies in courses. Files attached to sent messages in conversations (Inbox). Received messages with attached files will not contribute towards your own quota.


NO STORAGE INVOLVED

The following items in Canvas does not contribute towards any quota: Uploads using the Upload/Record Media tool in Canvas. The tool is accessible on the text editor when editing pages, assignment, discussions and more. Zoom Recordings that are saved and listed in the Zoom > Cloud Recordings on courses. These are tied to instructors' SFU Zoom account which they can manage at https://sfu.zoom.us/recording/ . Note : Cloud recordings will be deleted automatically after they have been stored for 365 day(s).


REQUESTS FOR ADDITIONAL STORAGE

We want to ensure that instructors have the resources they need to deliver their courses while also maintaining efficient use of the Canvas Cloud environment. For instructors, if your course requires more storage than the default quota, you can request an increase by submitting a support ticket using Canvas - Request Help . Requests will be reviewed on a case-by-case basis, taking into account the specific needs and nature of your course content.


Approved AI tools at SFU

Information Security Security Consulting and Education


Approved AI tools at SFU

OVERVIEW

The SFU Privacy Management Program has established a process to assess the risks of Personal or Confidential information being improperly disclosed and used when working with software applications that incorporate AI tools. Assessed AI Applications Concerns and considerations when using AI applications that do not have an SFU PIA Subject-specific contacts Definitions Assessed AI Applications The table below lists the AI applications that have been assessed and found safe to use provided that users comply with the specific privacy, information security, and intellectual property guidance provided by SFU. Application Type SFU Authorized Uses Who can use it Copilot Chat https://www.sfu.ca/copilot General purpose AI assistant Productivity assistant for work, study, and research at SFU, learning and teaching tool, no personal information should be entered into the AI Assistant without the consent of the person to whom such information pertains. SFU wide Microsoft 365 Copilot https://www.sfu.ca/m365copilot Personal AI Assistant, Advanced faculty/staff productivity assistant, and pedagogical enhancement (not for student assessment)


Approved AI tools at SFU

SFU

faculty and staff – Available upon request Chat GPT AI Assistant, AI Text Generator (LLLM) Pedagogical purposes in SFU courses SFU wide Ednius AI text generator (LLM) Pilot AI grading program Unit Specific – Beedie School of Business Run Diffusion AI art generator Creative/media course use only; not for ID photos or official branding Unit Specific – School of Interactive Arts and Technology (SIAT)


Approved AI tools at SFU

:

If you are using an AI-enabled tool that is not included in the above table to process personal information, there is a possibility that a privacy breach may have occurred. In such cases, contact privacy@sfu.ca . To request a Privacy Impact Assessment (PIA) for an AI-enabled tool, please see the overview and forms here: Privacy Impact Assessments Concerns and considerations when using AI applications that do not have an SFU PIA When using an AI application that does not have an SFU PIA as indicated in the above table, always keep in mind these six considerations: Unauthorized data collection BC’s Freedom of Information and Protection of Privacy Act (FIPPA) strictly prohibits unauthorized collection, use and disclosure of Personal information. The scope of “Personal information” is fairly broad, and includes information such as name, image, marital or family status, unique identifying numbers, demographic information (gender, race, ethnicity, religion), educational history, employment history and job performance, personal contact information, financial history, medical history, disability status, an individual's recorded personal views or opinions, and anyone else's recorded views and opinions about an individual. The ease of accidentally using or disclosing personal data is a significant concern, especially if the data is used for purposes beyond what the user initially agreed to at the original point of collection, such as unwanted targeted advertising or profile generation. Surveillance and tracking AI applications can be used for monitoring individuals online and in the physical world, raising significant concerns about mass surveillance and loss of privacy. Data that you enter into GenAI-enabled software applications can be used to deliver highly targeted advertisements, influence decision-making (e.g., what content you see), or even predict future behaviour. In some cases, this tracking extends beyond the application itself, following users across websites and devices using tracking pixels, cookies, and device fingerprints.


Approved AI tools at SFU

:

that you enter into GenAI-enabled software applications can be used to deliver highly targeted advertisements, influence decision-making (e.g., what content you see), or even predict future behaviour. In some cases, this tracking extends beyond the application itself, following users across websites and devices using tracking pixels, cookies, and device fingerprints. Data breaches and leaks AI systems often store and analyze large datasets. Therefore, they are attractive targets for hackers and cybercriminals. If an AI system containing medical, educational, or financial information is breached, Personal or Confidential information could be exposed. This threatens individual privacy and can lead to identity theft and financial fraud. Report such breaches to Information Security Services via SFU ServiceHub and the Privacy Management Program . Automated decision-making and loss of human oversight AI can improve efficiency and decision-making, but excessive reliance on AI without human oversight can have serious consequences. AI can potentially be used to support business activities such as hiring employees, or assessing student university admissions, by making decisions based on data patterns. However, these decisions may lack transparency, making it difficult for individuals to understand the outcome or question the results of the analyses, or to recognize any biases that may have influenced the decision. This leads to unfair or discriminatory outcomes, particularly if AI is trained on biased data. If you are going to use AI to make a decision, you need to be prepared to defend the decision and the decision-making process. Threats to Information Security Ensure the use of generative AI complies with other SFU Policies such as Information Systems Policy GP24: Acceptable Use and Security of Digital Information and Electronic Systems , including the Information Security Standards . To keep SFU’s electronic information secure, anyone doing university work on non-SFU systems must follow the Privacy and Information Security Standards


Approved AI tools at SFU

:

AI complies with other SFU Policies such as Information Systems Policy GP24: Acceptable Use and Security of Digital Information and Electronic Systems , including the Information Security Standards . To keep SFU’s electronic information secure, anyone doing university work on non-SFU systems must follow the Privacy and Information Security Standards and Procedures. Generative AI could be used in harmful ways, and there is a real risk of more cyber and fraud attacks — like deepfakes used by attackers to trick or target people. Copyright infringement GenAI applications may use content provided to them as training data to further refine their performance. You should be aware that uploading or pasting parts, or all, of a document into this type of GenAI application may violate copyright. Also remember that even if you or SFU owns the copyright to a document, always check that it does not contain Personal or Confidential information as outlined above. Additionally, many third party copyrighted works are made available to SFU users under license. In many cases these licenses prohibit the use of the content with GenAI applications, so always check the license terms for this content before using them with GenAI applications. Subject-specific contacts Privacy Queries can be sent to privacy@sfu.ca . Information Security Queries can be sent to information-security@sfu.ca . Risk Queries can be sent to risk_srs@sfu.ca . Copyright Queries can be sent to copy@sfu.ca . Definitions Personal Information : recorded data about an identifiable individual other than business contact information. Examples include name, image, marital or family status, unique identifying numbers, demographic information (gender, race, ethnicity, religion), educational history, employment history and job performance, personal contact information, financial history, medical history, disability status, an individual's recorded personal views or opinions, and anyone else's recorded views and opinions about an individual. Confidential information : includes trade


Approved AI tools at SFU

:

or family status, unique identifying numbers, demographic information (gender, race, ethnicity, religion), educational history, employment history and job performance, personal contact information, financial history, medical history, disability status, an individual's recorded personal views or opinions, and anyone else's recorded views and opinions about an individual. Confidential information : includes trade secrets and proprietary data. Related Articles (2) Microsoft 365 Copilot Learn more about Microsoft 365 Copilot (a personalized productivity AI assistant) at SFU. Privacy and Security Guidance for using Microsoft 365 Copilot Learn about privacy and security guidance for using Copilot at SFU.


FAQs - Portfolio and Project Management

Overview The IT Services Digital Transformation Office (DTO) provides support services to all projects that follow the Information Systems Stewardship Model. The Information Systems Stewardship Model ensures that the IT Services projects and initiatives are in alignment with the University's strategic goals. The goal of the IT Services DTO is to build an effective, flexible project management framework that can be applied to any project with effective repeatable processes.  Below are the FAQs on Portfolio and Project Management. Details I have a Project that will need IT Funding and/or Resources, where do I start? After completing an initial assessment and determined your project will take: 20 days (144 hours) or more of effort; or $10,000 or more of project funding. The first step is to add your project to the ITS Projects Roadmap. How do I add my project to the ITS Projects Roadmap? All projects in the Roadmap will be presented to the Stewardship Committees for review on timing and strategic alignment while it is being documented into a Project Charter. In order to add your project to the roadmap, you must complete the following:  Submit a Project Proposal using the Project Proposal Template to its-pmo@sfu.ca   Add your project to the ITS Projects Roadmap spreadsheet in the "Data" tab and fill in all applicable columns Who updates the entry on the ITS Project Roadmap once it's been added? Once you've filled out the ITS Projects Roadmap, you will be responsible for your entry until it's time to submit a Project Charter. Once the Project Charter has been submitted to the DTO for your project, the DTO will be responsible for your entry on the ITS Projects Roadmap spreadsheet. Then, once the project has been assigned a Project Manager, the Project Manager will be responsible for


FAQs - Portfolio and Project Management

time to submit a Project Charter. Once the Project Charter has been submitted to the DTO for your project, the DTO will be responsible for your entry on the ITS Projects Roadmap spreadsheet. Then, once the project has been assigned a Project Manager, the Project Manager will be responsible for the entry on the ITS Projects Roadmap. How do I submit a Project Charter? All completed Project Charter, and Project Plan documents are to be sent to the Analyst, DTO to be reviewed and scheduled for presentation at the Project Review Committee meeting. If you have any questions about filling out any of the documents or need assistance, please email its-pmo@sfu.ca  The information contained within the Project Charter assists the Project Review Committee with making an informed decision to approve the project request and determine if the project should be presented to one of the four stewardship committees for further approval: ASSC - Administrative Systems Steering Commte; ESSC - Educational Systems Steering Committee; RSSC - Research Systems Steering Committee; One IS - One Information Systems Steering Committee.


FAQs - Portfolio and Project Management

Project Charter Template:

https://sharepoint.sfu.ca/sites/its/pmo/templates What about a Project Plan? All projects require planning. Smaller projects, with less resource requirements, limited impacts and shorter timeline can have their plan approved within the Project Charter template. A Project Plan document is required when: Overall one-time project funding is $75,000 or more. The purpose of the Project Plan document is used to plan out the activities required to successfully execute the project in greater details. It's audience is the project manager and project team, however the stewardship committees will want to review project plans before granting projects approval to execute.


FAQs - Portfolio and Project Management

Project Plan Template:

https://sharepoint.sfu.ca/sites/its/pmo/templates Overview The IT Services Digital Transformation Office (DTO) provides support services to all projects that follow the Information Systems Stewardship Model. The Information Systems Stewardship Model ensures that the IT Services projects and initiatives are in alignment with the University's strategic goals. The goal of the IT Services DTO is to build an effective, flexible project management framework that can be applied to any project with effective repeatable processes.  Below are the FAQs on Portfolio and Project Management.


How to review, approve or reject knowledge articles as an ITS Service Owner

This article will review:

How to Review Submitted Articles Approving or Rejecting Articles Details To review a knowledge article, it first needs to be submitted to the IT Services knowledge base. For an overview on drafting and submitting knowledge articles a creator refer to this documentation .


Note:

To review knowledge articles you will need the Service Owner role in TeamDynamix. How to Review Submitted Articles As a service owner, your account in TeamDynamix will have the ability to review and approve any submitted knowledge articles within the IT Services knowledge. This provides you with an opportunity to check the content of an article and send feedback to the creator before it is published. To start, sign in to the IT Services knowledge base .


Then either:

Navigate to the Articles Pending Review tab Or, have the author of an article send you a direct link (via email, instant message...etc.) to their submitted draft Approving Articles The next step is to either approve or reject the article. If you reject the article, ensure you notify the author using the Notify check-box and leave a comment. This will send an email to the author and provide them with an opportunity to make edits for re-submission. If you approve the article, ensure you notify the author using the Notify check-box to let them know that the article is ready to be published. They will then send a request to the knowledge manager for the IT Services knowledge base to have it published. After the article is approved, it's status will also be updated for confirmation.


TeamDynamix Training Session - Service Owners (SO) & Service Offering Managers (SOM)

Administrative and Business Business Capability and Process Automation Enterprise Service Management For Service Managers Overview This is a recorded training session for Service Owners (SO) and Service Offering Managers (SOM) on May 11, 2022. Note: Service Offering Manager (SOM) is an ITSM Term for Product Owner


Service Owners (SO) and Service Offering Manager (SOM) Training Session:

Training video for: Service Owner & Service Offering Manager The goals of this training is to get Service Owner and Service Offering Manager familiar with: What a service is. What service ownership is. What a service offering is. What a service offering manager is. How these work in TeamDynamix. If you've any questions, please visit the Enterprise Service Management (ESM) service page and raise tickets to the support team. ESM webpage is Service - Enterprise Service Management (teamdynamix.com) .


Additional links for your reference:

ServiceHub | TeamDynamix Sandbox, Service Catalog ServiceHub | TeamDynamix Production, Service Catalog Enterprise Service Management (ESM) | TeamDynamix Service Page MS Teams - One I.S - TeamDynamix Channel Related Articles (1) How to review, approve or reject knowledge articles as an ITS Service Owner This article outlines how IT Service Owners can approve or reject articles submitted to the IT Services knowledge base.


TeamDynamix Employee Collection Notice and Data Guidelines

Administrative and Business Business Capability and Process Automation Enterprise Service Management ESM Vision and Operations Employee Collection Notice for SFU Staff using TeamDynamix (ServiceHub) Employees using TeamDynamix (TDX) to respond to tickets will have their personal information collected by SFU through the TDX platform, under the authority of the University Act (RSBC 1996, c.468) and the Freedom of Information and Protection of Privacy Act (RSBC 1996, c.165). The collected personal information includes an access and use log and your communications with end-users. The information will be used to manage support requests from clients, administer workflows, to evaluate and manage employee and departmental performance, and to monitor and improve services. If you have any questions about the collection, use and disclosure of this information please contact tdx@sfu.ca. For more information about SFU policies & guidelines for personal information, visit the Archive and Records Management website . Guidelines for Data within TeamDynamix (ServiceHub) IT Services outlines guidance for data management within IT systems. For more information about IT specific data guidelines, visit the Information Systems website . IT Services staff (and associated departments) managing ticket information within TeamDynamix are expected to: Only handle or store the minimum amount of data required to complete a task (the principle of “data minimization” ). Do not handle or store any data that is not required, in particular very sensitive data. Internal Data or Regulated Data may only be shared with other SFU Employees when their role at SFU requires them to have access to perform their duties (the principle of “least privilege” ). Keep data on just one Information System (TeamDynamix) and do not copy, extract, or download data to other Information Systems. In the case of a violation of this control, then either one of the following must be done: Submit a plan to


their duties (the principle of “least privilege” ). Keep data on just one Information System (TeamDynamix) and do not copy, extract, or download data to other Information Systems. In the case of a violation of this control, then either one of the following must be done: Submit a plan to eliminate the redundancy to the Data Governance Council, or Submit a request for approval in writing to the Data Governance Council. Enterprise and Local Information Systems staff are available to consult with departments and users to advise them of the risks and help determine which Information Systems will be best able to meet their requirements and support their business processes.


Zoom Features

Overview Knowledge articles related to video conferencing - Zoom, which provides faculty, staff, and students with the ability to hold or attend live meetings, lectures, and presentations with colleagues from remote locations. Details


Zoom Features

FEATURES

Video and/or audio meetings by computer or phone Screen sharing with annotation Virtual whiteboard and other collaboration tools Integration with popular calendar applications such as Outlook


Zoom Features

ZOOM ACCOUNT DIFFERENCES AT SFU

At SFU your Zoom account will have different features unlocked depending on your role. These features are meant to promote the safety and security of all Zoom meetings being held at the University. Please see our Zoom Privacy & Security page for more information.


Zoom Features

X

Allow removed participants to rejoin ✓


Zoom Features

X

File transfer, Livestreaming


Zoom Features

FEATURE DIFFERENCES BETWEEN ZOOM MEETING AND ZOOM WEBINAR

What's Zoom Meeting and Zoom Webinar? Zoom Meeting Zoom Webinar Video sharing All participants Host and panelists View only participants x √


Zoom Features

Q&A

x √ Waiting room √ x Breakout room √ x Participant list Visible to all participants Visible to host and panelists Overview Knowledge articles related to video conferencing - Zoom, which provides faculty, staff, and students with the ability to hold or attend live meetings, lectures, and presentations with colleagues from remote locations. Overview Knowledge articles related to video conferencing - Zoom, which provides faculty, staff, and students with the ability to hold or attend live meetings, lectures, and presentations with colleagues from remote locations. Overview Knowledge articles related to video conferencing - Zoom, which provides faculty, staff, and students with the ability to hold or attend live meetings, lectures, and presentations with colleagues from remote locations.


Zoom Meeting vs Webinar

Overview This article explains the differences between Zoom meeting and Zoom webinar. Details Major differences Meeting: Every participant can chat via audio and video. Webinar: Attendees, except the host and panellists, are view-only, but can be un-muted if the host gives permission.


Zoom Meeting vs Webinar

ZOOM MEETING

Available to All students, faculty, and staff for collaborative meetings ≤ 300 participants Recommended for When all participants (≤ 300) are encouraged to chat via audio and video, and share their screens, for example: Brainstorming meetings Tutorials, where group discussions is encouraged Student project team meetings


Zoom Meeting vs Webinar

ZOOM WEBINAR

Limited to Faculty, and staff upon request for large classes or events with up to 1000 participants Recommended for Events or classes with more than 300 participants, where the host and panellists prefer more control over the audience. It allows view-only attendees to minimize interruptions. Attendees can interact via Q&A, chat and polling. Classes or events < 1000 participants Large virtual activities with view-only attendees Events involving panellists Exceeding the participant capacity? Large Zoom Meeting (up to 500 participants), or large Zoom Webinar (up to 1000 participants) can be enabled upon request .


Zoom Meeting vs Webinar

FEATURE COMPARISON

Table comparing the features of Zoom Meetings against Zoom Webinars. Zoom Meeting Zoom Webinar Available to Faculty, Staff & Students Faculty & Staff (Request needed) Audience Capacity < 300 < 1000 Screen-sharing ✓ ✓ Chat Message ✓ ✓ Online Teaching ✓ ✓ Video Recording ✓ ✓ Host & Co-Host option ✓ ✓ Polling ✓ ✓ Downloading videos ✓ ✓


Zoom Privacy and Security Policies

PRIVACY AND SECURITY WITH ZOOM

SFU is prioritizing the security and privacy of all faculty, staff and students while configuring Zoom's system-wide settings, which will be more restrictive to start. As conversations progress and SFU continues adjusting to adopt recommended practices to balance risk mitigation with meeting community needs, changes may occur to the availability of features and functions. Updates will be published on this page as new details are confirmed.


Zoom Privacy and Security Policies

GENERAL CONSIDERATIONS

With the recent transition to work-from-home environments for many SFU faculty, staff, and students, please be mindful of the type of content being shared, which is now more likely to include personal environments. Participants have the option of either turning off their camera or using a virtual background to hide their personal environment. Anyone recording sessions in SFU Zoom is required to meet our privacy obligations under the Freedom of Information and Protection of Privacy Act (FIPPA). We advise against recording sessions using third-party applications or non-SFU Zoom accounts without attendees’ knowledge and/or consent. All recorded content may be subject to a formal access to information request made under FIPPA. For added security, you can configure your meetings to allow only users with Zoom accounts to join your meetings. Check out the instructions .


Zoom Privacy and Security Policies

PROVIDING CONSENT TO TERMS OF USE

Your participation in a Zoom meeting will result in the disclosure of personal information to Zoom Video Communications. You may consent to this disclosure in one of two ways: If you are an SFU student, staff or faculty member, by signing into your SFU Zoom account , you have provided consent as part of the sign-in process. If you are a meeting/webinar participant without an SFU Zoom account, you can consent by filling out this form: https://www.surveymonkey.ca/r/zoomprivacy


Zoom Privacy and Security Policies

Notable requirements for compliance with FIPPA include:

Securing stored recordings. Avoid storing records on non-SFU systems (e.g., Google Drive or Dropbox). Consider filing recordings with other related departmental records; do not leave recordings on personal devices. On January 12th, 2021, SFU Zoom offers optional cloud recording for hosts of all Zoom meetings. All Cloud recordings are stored in SFU Zoom’s new online Canadian data centre. Passcode protection is enforced for all shared cloud recordings. Cloud recordings stored in the Zoom cloud will be deleted 365 days after the meeting date or can be deleted by the host. Local and cloud recording allows the host to record their Zoom meeting's video, audio, transcribed text, and chat transcripts. A properly formatted collection notice that clearly defines the business purpose for the collection of personal information, the legal authority for the collection, and the contact information of an SFU officer or employee who can answer questions regarding collection. Zoom does not have any built-in capability of delivering such a collection notice. Controlled access. Access to recordings can only be granted to university employees when it is necessary for the performance of their work duties. Sharing of the recordings in the absence of a legitimate business need is not authorized. Consistent use. Participants’ personal information can only be used for the purpose for which it was obtained and compiled or for a use consistent with that purpose. Secondary uses of the recordings are not authorized. Minimum retention. Recordings containing personal information must be retained for a minimum of one year if they are used to make decisions that directly affect participants. Examples include academic advising sessions, job interviews and exam invigilations. Authorized disposal. The University will dispose of recordings only with an approved Records Retention Schedule and Disposal Authority. Departments may or may not have applicable RRSDAs already in place. Visit


Zoom Privacy and Security Policies

Notable requirements for compliance with FIPPA include:

they are used to make decisions that directly affect participants. Examples include academic advising sessions, job interviews and exam invigilations. Authorized disposal. The University will dispose of recordings only with an approved Records Retention Schedule and Disposal Authority. Departments may or may not have applicable RRSDAs already in place. Visit the Directory of University Records for more information at https://www.sfu.ca/archives2/dur/dur.html . A business rationale for the need to record content. Staff meetings, academic advising sessions, job interviews, etc. have not been typically recorded at the University in the past. We strongly advise against recording Zoom sessions for the purposes of administrate convenience or as a means of compiling meeting minutes and notes.


Zoom Privacy and Security Policies

COLLECTION

Depending on how you run your lectures and the steps students take to anonymize their identities, it is possible that a student's personal information (e.g., name, image, voice, personal views and opinions, course work) may be captured in a recording. Use a collection notice so that your students are aware of the purpose for the collection of their personal information, the legal authority for the collection, and to whom they can direct questions about the collection. The following is a recommended template: ...More →


Zoom Privacy and Security Policies

1. CAN I RECORD A LECTURE THAT I AM DELIVERING?

See Privacy and Copyright Guidelines for Instructors for Recording Zoom Lectures for measures to take when recording lectures.


Zoom Privacy and Security Policies

2. CAN I RECORD A STAFF MEETING?

Staff should not record meetings, especially if individual third parties will be discussed (e.g. job candidates, students, members of the public, etc.). If you must record a meeting then you should refrain from disclosing personal details about yourself or third parties. If you need to discuss specific third parties, anonymize the individuals by using pseudonyms (e.g. Applicant 1, Applicant 2, Applicant 3).


Zoom Privacy and Security Policies

3. CAN I RECORD A MEETING WITH A STUDENT OR OTHER PRIVATE INDIVIDUAL?

When meeting virtually with students or other private individuals using Zoom, you need to inform the individual about how they can anonymize their identity. In addition, we strongly recommend that counsellors, doctors, advisors, and others who are discussing sensitive personal information (e.g., medical history, academic history, disability accommodations, financial history) do not use Zoom's recording feature. Meeting hosts are responsible for notifying participants if they are recording a meeting. Meeting participants will generally hear a notice or see an on-screen notification when recording is in progress


Zoom Privacy and Security Policies

4. HOW DO I ANONYMIZE MY IDENTITY WHEN ATTENDING A ZOOM SESSION?

If you have been invited to a Zoom meeting as an attendee, you can join the Zoom meeting via the web application without signing into a Zoom account. The Zoom web application allows you to use a pseudonym (e.g. first name only or a nickname). If you prefer to use your SFU Zoom account to participate in sessions, you can change your display name before joining the session. Please note that you will have to make this change every time you sign into SFU Zoom , as your display name will revert to your first and last name with every login. You can anonymize yourself further by not using the audio and video conferencing features, and by not revealing any personal information about yourself or third parties during online discussions.


Zoom Privacy and Security Policies

5. CAN I CHANGE MY DISPLAY NAME?

You can change your display name before joining the session or change a preferred name in your profile.


Zoom Technical Requirements

Overview This article is related to the technical requirements for Zoom. Details


Zoom Technical Requirements

Recommended bandwidth over WIFI:

2.6 Mbps/1.8 Mbps (up/down) For gallery view receiving: 4.0 Mbps (49 viewers)


Zoom Technical Requirements

DESKTOP REQUIREMENTS

Zoom can be used on a variety of desktop operating systems and browsers. These include: Delivery method: Zoom desktop application or via browser (with limited functionality)


Zoom Technical Requirements

Compatible with the following operating systems:

Windows 7,8, 10, Ubuntu 12.04 or higher, Red Hat Enterprise Linux 6.4 or higher, MacOS X with MacOS 10.7 or later


Zoom Technical Requirements

Compatible with the following browsers:

Windows: IE 11+, Edge 12+, Firefox 27+, Chrome 30+ Mac: Safari 7+, FIrefox 27+, Chrome 30+ Linux: Firefox 27+, Chrome 30+ Processor and RAM recommended: Dual-core 2 Ghz or higher / 4 GB RAM


Zoom Technical Requirements

MOBILE REQUIREMENTS

Zoom is available to use on iOS and Android devices. All SFU users need to sign in with SFU Single Sign-On (SSO). iOS 8.0 or later, iPadOS 13 or later, and Android 5.0X or later. Any 1Ghz single core processor or better


Zoom Technical Requirements

MICROSOFT OUTLOOK PLUGIN AND ADD-IN

The Outlook plugin is only supported on macOS 10.14. and above. Here is the link to download. Microsoft has announced this is no longer available after 2021. The Outlook Add-in is prohibited due to security reasons.


Information about mySchedule

Overview mySchedule is embedded in goSFU to help you plan and enroll in your optimal schedule. It allows you to graphically view your schedule options, find desired course combinations, and create the course schedule that works best for you. Details For more information, please visit mySchedule - Enrollment. Overview mySchedule is embedded in goSFU to help you plan and enroll in your optimal schedule. It allows you to graphically view your schedule options, find desired course combinations, and create the course schedule that works best for you. Overview mySchedule is embedded in goSFU to help you plan and enroll in your optimal schedule. It allows you to graphically view your schedule options, find desired course combinations, and create the course schedule that works best for you. Overview mySchedule is embedded in goSFU to help you plan and enroll in your optimal schedule. It allows you to graphically view your schedule options, find desired course combinations, and create the course schedule that works best for you.


Student Computer Labs - Remote Access for Undergraduate Students

Step 1:

Open the computer lab dashboard. Computer Lab Dashboard


Step 2:

Click on a campus Click on the IP Address of the computer you want to use


Important:

Remember the computer name for a later step, i.e., aq-3148-02


Step 3:

Login via CAS and MFA to access Guacmole at gateway.its.sfu.ca. Multi-factor Authentication enrollment is required for this service. Set up MFA


Step 4:

Find the computer you selected in step 2, by Option 1 (preffered): using the Search filter Option 2: browsing by Faculty/Campus > LabName RDP vs SSH Connection protocols RDP vs SSH are identified by the icon


Sign in using:

your SFU computingID and password, and domin: ADSFU Sign out when your are finished to make the computer available for others. Remote sessions will automatically time out after 3 hours of continuous use to allow all students the opportunity to use our computer labs.


The Guacamole menu is a sidebar which is hidden until explicitly shown. On a desktop or other device which has a hardware keyboard, you can show this menu by pressing Ctrl + Alt + Shift .


COPYING/PASTING TEXT

At the top of the Guacamole menu is a text area labeled "clipboard" along with some basic instructions.


TRANSFERRING FILES FOR SSH CONNECTIONS:

You can transfer files back and forth between your local computer and the remote desktop for SSH connections. Files can be transferred to the remote computer by dragging and dropping the files into your browser window, or through using the file browser located in the Guacamole menu. You can show this menu by pressing Ctrl + Alt + Shift . Use the option for "Upload File." RDP connections to windows or linux system will need to use other means such as Vault or Office 365 cloud drives.


Student Computer Labs - Remote Access for Graduate Students

Step 1:

A SFU VPN connection is required to use the .RDP file downloaded in step 4. If you haven't set it up, follow the instructions to set up SFU VPN on your device.


Step 2 (Mac only):

For Windows, skip to Step 3. Install Microsoft Remote Desktop from the App Store


Step 3:

Open the computer lab dashboard Click on a campus Computer Lab Dashboard


Step 4:

Click on the IP Address of the computer you want to use Allow the downloads from KeyServer Open the downloaded .rdp file to set up the remote connection. Note: IP number could change from session to session, please always connect from the list of computers on KeyServer.


using:

Your SFU computingID and password Be sure to use format ADSFU\userid , or userid@sfu.ca Sign out when your are finished to make the computer available for others. Remote sessions will automatically time out after 3 hours of continuous use to allow all students the opportunity to use our computer labs.


PaperCut FAQ

Overview This article contains frequently asked questions about PaperCut. Details


PaperCut FAQ

WHY CAN'T I USE THE PRINTER IN THE DINING HALL ON BURNABY CAMPUS?

Printing services are not currently available in Dining Hall.


PaperCut FAQ

WHY CAN'T I PRINT EVEN WHEN I HAVE PRINTING FUNDS ON MY ACCOUNT?

Printing balances shown on the Print Release Station reflect a combined total consisting of: Default (department funding) Cash


PaperCut FAQ

IRMACS FM

Dining Hall FM Print release stations/kiosks only recognize 'Cash' accounts and will not print jobs if there are insufficient funds in the ‘Cash’ account. Dining Hall FM funds can only be used on the Dining Hall printing.


Printing & Cash Loading Locations

BURNABY

Bennett Library 3rd Floor, includes cash loader Show in Room Finder Room AQ3148, includes cash loader Show in Room Finder Room WMC2502 Show in Room Finder


Printing & Cash Loading Locations

Surrey Library, SC3620 SC2300, the Fire Fighter Lab (cash loader located outside of SC2300)


How to Print

Overview This article contains step-by-step instructions for how students and library guest patrons can print. Details


How to Print

Step 1:

Add printing credit to your account (in-person or online) In-person


How to Print

by using the cash machines at the following locations:

Library 3 rd floor The machine accepts $1, $2 coins and $5, $10 and $20 bills but does not give change. The library front desk can break larger bills. SFU students : log in using your computing ID username that you use for goSFU, Canvas, etc. (not your student number or email address).


How to Print

Guest patrons:

case-sensitive username in the form of IC xxxxxxxxxx, including the space, and the corresponding case-sensitive password. Online by visiting www.sfu.ca/papercut while connected to SFUNET-SECURE wireless (SFU students only).


How to Print

Step 2:

Log onto a computer using the same credentials from Step 1 Guest patrons only have access to library computers.


How to Print

Step 3:

Open your document and print to black and white or colour Lab Mono: Prints black and white ($0.11 per side) Lab Color: Prints colour ($0.25 per side)


How to Print

Step 4:

Log onto the computer beside the printer and release your document Overview.


Installing the PaperCut Client

INSTALLING PAPERCUT CLIENT ON YOUR DEVICES

Setup wireless printing for Mac, Windows 7, Windows 8, and Windows 10. Note: Printers are already installed on the IT Services lab and Library computers. These instructions are for laptops, notebooks, and notepads only. Lab Printing macOS Lab Printing Windows (64-bit) Papercut Client macOS Papercut Client Windows (64-bit) Papercut Client Linux


Installing the PaperCut Client

Note:

The Mac will ask you to enter your username and password for the printer and to "Remember this password in my keychain". Use your SFU credentials and not the computer account. The message "Holding for Authentication" will be displayed if the local computer account is stored/used. Edit the OSX Keychain and modify the entry associated with the printer.


Transferring Printing Funds

Overview This article describes how to transfer printing credit to another student. Details


Transferring Printing Funds

TRANSFERRING FUNDS FROM YOUR PAPERCUT ACCOUNT

Only cash funds can be transferred. To transfer funds, Log on to your PaperCut account Click on Transfers from the left navigation menu Enter the amount to transfer Enter the person's computing ID to transfer funds to Click on . Funds will automatically be transferred from your account to the other person Funds will remain in the printing account for one year after graduation after which the print account will be deleted. Funds in default and Dining Hall account will not be refunded or transferable. Note: The PaperCut account portal is only available while connected to SFUNET-SECURE.


Refund Policy

Overview This article contains information about the PaperCut refund policy and how to request a refund. Details Pages that aren’t successfully printed will be refunded automatically as PaperCut can detect if a print job is successfully delivered.


Refund Policy

Refunds will only be provided on the following basis:

Fading or streaked printer tone; document has to be produced at time of claim. Lost print jobs due to printer hardware failure where job does not resume printing.


Refund Policy

Refunds will not be provided for:

Unspent balance in your PaperCut account (you can, however, transfer your account balance to another SFU or FIC student). Wrong print job or print job settings.


Refund Policy

HOW TO REQUEST A REFUND

Log on to your PaperCut account Click on Recent Print Jobs Click on r equest refund and provide a detailed explanation. If your document was printed but the quality is poor, bring the document to the nearest IT Service Center to help you re-print or to ask for a refund.


Refund Policy

Note:

The PaperCut account portal is only available while connected to campus systems, or to the


Refund Policy

SFUNET-SECURE

wireless network. Overview This article contains information about the PaperCut refund policy and how to request a refund.


ServiceHub Ticketing App Quick Start Guide

Administrative and Business Business Capability and Process Automation Enterprise Service Management For Ticketing Agents Overview Just getting started with ServiceHub at SFU or looking for a refresher? Explore online resources that walk though how to use the ticketing application. Access and Sign In In order to sign into ServiceHub Ticketing App, there are pre-requisites. If you don't have permissions to sign into the app, see How to gain access to ServiceHub Ticketing App for details. For a direct sign-in link, go to https:// servicehub.sfu.ca/tickets Access ServiceHub Ticketing App SFU ServiceHub Training For SFU-focused training for IT Technicians and ticketing agents, see our recorded Zoom training sessions for held on June 2022 IT Technicians Training Videos TeamDynamix Training For additional training, see various articles and videos provided by TeamDynamix below:


Access and Overview:

Accessing Interfaces (Video) Using TDNext (Video)


Working with Tickets:

Getting Started with Tickets Creating Tickets in TDNext (Video) Ticket Anatomy (Video) Common Ticket Activities (Video) Searching and Filtering (Video) Differences between Incident, Major Incident, Problem, Change, Release, and Service Request


Organizing Your Work:

Getting Started with Desktops Getting Started with Reporting Visualizing Information with Desktops (Video) Creating and Editing Desktops (Video) Using the My Work Application (Video)


CAS Apache Module

Information Security Identity and Access Management Central Authentication Service (CAS)


CAS Apache Module

OVERVIEW

Before SFU adopted CAS as its authentication method for the web, we already had an Apache authentication/authorization module that allowed limited access control based on maillist membership. With the arrival of CAS, we modified a version of mod_cas (later mod_auth_cas) that would allow Apache to use the SFU version of CAS version 2 (later CAS version 3) to grant access based on SFU maillists.


CAS Apache Module

DETAILS

With the arrival of CAS 5, the changes made to CAS by SFU are no longer needed, and the latest unchanged version of mod_auth_cas can be used. This version supports Apache 2.4 (which the older SFU modified version of mod_auth_cas does not). Because the 2.2 version of Apache is no longer being maintained by The Apache Software Foundation, you may want to upgrade your Apache, but that will also require that you upgrade to the latest version of mod_auth_cas.


CAS Apache Module

CAN WE CONTINUE TO USE THE OLDER VERSION OF MOD_AUTH_CAS?

The short answer is yes. However, that version of mod_auth_cas does not support Apache 2.4, so you are stuck with the older non-maintained version of Apache. There are a few other things to keep in mind if you want to continue using the old SFU version of mod_auth_cas. For example, in order to do the authorization, the SFU modified mod_auth_cas uses an SFU added feature of CAS, and adds an "allow=" string to the login and serviceValidate CAS entry points. We have added support for this to CAS 5 to continue to support the old mod_auth_cas, but this may not be supported in future upgrades to CAS. Another thing to keep in mind is that mod_auth_cas needs attributes from CAS to do the authorization work. The older versions of CAS didn't return attributes, so SFU modified CAS so that you could get the needed attributes from serviceValidate. In CAS 5, attributes are returned using p3/serviceValidate, but not with serviceValidate. We have added a setting in CAS 5 to allow some attributes to be returned by serviceValidate, and this setting will be set for those services that were using the old SFU mod_auth_cas before the upgrade to CAS 5. If you want to use the old SFU mod_auth_cas with a new service, you either need to let us know to set that setting for your service, or you need to specify "CASValidateURL https://cas.sfu.ca/cas/p3/serviceValidate" to get the attributes that are needed by mod_auth_cas.


CAS Apache Module

WHAT NEEDS TO BE DONE TO UPGRADE TO THE NEW MOD_AUTH_CAS?

There are a number of good reasons to upgrade to the new mod_auth_cas, including allowing you to upgrade to the new, fully supported, Apache 2.4. The first thing to do before upgrading is to read Using mod_auth_cas at SFU to get an idea how the new module works and where to get it. Once you have the new mod_auth_cas downloaded, built and installed, you need to make sure that you have set CASValidateURL to p3/serviceValidate like this: CASValidateURL https://cas.sfu.ca/cas/p3/serviceValidate The next step is to check if you have specified Authtype Basic when using mod_auth_cas. This was allowed in the old SFU mod_auth_cas so that you could use Apache basic authentication in conjunction with CAS when controlling access to a non-web application such as WebDAV. This is not supported in the new mod_auth_cas, but we have made available a simple authentication module mod_authn_cas which will handle this use case. See this page for information on mod_authn_cas . Using "Basic" was also allowed in certain circumstances as equivalent to "CAS". If that was how it was being used, simply use "Authtype CAS" instead. Next, check to see if you use AuthUserFile /path/to/.htpasswd to point to a file containing userid/password entries. The old mod_auth_cas would let you use these .htpasswd files to specify IDs or maillists to control access. The new mod_auth_cas doesn't support these .htpasswd files, so see the following table for replacing items in the .htpasswd file with Require lines. Line in .htpasswd file What it did Equivalent Require line in new mod_auth_cas +userid allow access to SFU userid Require user userid +!mail-list allow access to members of mail-list Require cas-attribute member:resource:dept:DEPT_NAME:some-group userid password allow access to made up ID this is not supported in new mod_auth_cas The final step is to replace the Require directives from the old mod_auth_cas with


CAS Apache Module

WHAT NEEDS TO BE DONE TO UPGRADE TO THE NEW MOD_AUTH_CAS?

new mod_auth_cas +userid allow access to SFU userid Require user userid +!mail-list allow access to members of mail-list Require cas-attribute member:resource:dept:DEPT_NAME:some-group userid password allow access to made up ID this is not supported in new mod_auth_cas The final step is to replace the Require directives from the old mod_auth_cas with equivalent Require directives for the new mod_auth_cas. The following table should help. Old mod_auth_cas New mod_auth_cas Require valid-user or Require valid-sfu-user Require valid-user Require user userid or Require sfu-user userid Require user userid Require user !mail-list Require cas-attribute member:resource:dept:DEPT_NAME:some-group Require valid-sfu-staff Require cas-attribute sfuEduPersonAffiliation:staff Require valid-sfu-faculty Require cas-attribute sfuEduPersonAffiliation:faculty Require valid-sfu-student Require cas-attribute sfuEduPersonAffiliation:undergrad Require cas-attribute sfuEduPersonAffiliation:grad Required valid-alumni-user Require cas-attribute sfuEduPersonAffiliation:alumnus


CAS for web applications


CAS for web applications

WHAT IS CAS

The Central Authentication Service (CAS) is a web application used by other web applications to authenticate visitors. In addition to providing authentication, CAS implements a single sign-on feature to make it easier for users to move from one authenticated application to another. SFU CAS is a slightly modified version of Jasig CAS . SFU has added a number of extensions to CAS (mostly authorization features such as integration with our mail list system), but has maintained compatibility with Jasig CAS, so applications that support Jasig CAS should work at SFU without modification.


CAS for web applications

WHEN TO USE CAS

Any application in use at SFU, whether running on the cgi.sfu.ca server, or running on a departmental or dedicated server, can use CAS for authentication. Third-party applications customized for SFU should be modified to use CAS whenever possible. Although CAS can provide some basic authorization , it is an authentication service. It determines that users are who they say they are. CAS can provide information to help an application make authorization decisions, but it is important to understand that some people who possess an SFU computing account may only be loosely affiliated with SFU. All applications that use SFU CAS must be registered as a service. Fill out the CAS Service Application form to get started .


CAS for web applications

THE EASIEST WAY TO USE CAS

In many cases, using CAS requires no new programming to protect either static web content or dynamic web applications. On systems that run the Apache HTTP Server, a runtime module ( mod_auth_cas ) is available to provide CAS authentication to the entire server (or a configurable subset of the server’s content). While CAS simply authenticates users, this module provides both authentication services and access-control services. It lets you grant access to specific users as well as users based on their membership in a maillist. It even lets users on your servers authenticate users and restrict access via local .htaccess files.


CAS for web applications

A PROGRAMMER’S VIEW OF CAS

If you decide that the Apache module is insufficient for your needs, you will need to write a small amount of custom code to handle authentication programmatically. Some client libraries are available to ease the use of CAS even further. Before you begin to integrate your application with CAS, however, you should understand a few details about the way CAS operates. First and more importantly, CAS is unlike many familiar authentication systems because it is not simply a password-validation tool. In a traditional environment, your web application will ask users for an ID and a password, and it will then call logic to determine whether this ID/password pair is valid. With CAS, however, your application never gains access to the user's password; to improve system-wide security, users supply their passwords only to the CAS server directly. Therefore, using CAS in your application may be more circuitous than you initially imagine, though be assured that the process is still straightforward and easy to master. When you first encounter a new user (e.g., one that has not yet established a session with your application), you'd normally display a username/password form in HTML. With CAS, you don't do this; instead, you simply redirect the user's browser to CAS's login URL, which is https://cas.sfu.ca/cas/login CAS then authenticates the user. If authentication fails – e.g., if the user cannot supply a correct password – then you’ll never hear from the user again. Instead, the user will remain at CAS’s site and will have the option to choose various “help” links that point to IT Services help sites to help them deal with computing account problems. Only if a user successfully authenticates does that user’s browser return to your application. Specifically, the user returns because CAS redirects the browser back to your application. CAS knows how


CAS for web applications

A PROGRAMMER’S VIEW OF CAS

to choose various “help” links that point to IT Services help sites to help them deal with computing account problems. Only if a user successfully authenticates does that user’s browser return to your application. Specifically, the user returns because CAS redirects the browser back to your application. CAS knows how to find your application because when you initially redirected the user to CAS, you supplied a service parameter, in the form https://cas.sfu.ca/cas/login?service=http://my/url (Note that any metacharacters in your service URL, such as question marks, ampersands, and equals signs, must be escaped appropriately using the standard URL encoding algorithm: %26 for &, %3D for =, and %3F for ?. This will be necessary if your service URL contains parameters of its own. Note also that while it is necessary that you use HTTPS to safeguard your own application's authentication in secure environments, CAS's overall security is not weakened if your application merely uses HTTP; instead, CAS still authenticates the user securely.) When CAS redirects the authenticated user back to your application, it will append a parameter named ticket to your URL. For instance, the URL you supplied CAS may be called as follows: http://my/url?ticket=ST-92834-m34Aa83f7a3f We call this ticket opaque because, unlike an X.509 certificate or a Kerberos TGT, it is not possible for your application to decipher its meaning in isolation or from first principles. It has no internal structure useful to your application. The only thing you can do with this ticket is to send it back to CAS, which involves opening an HTTPS connection to https://cas.sfu.ca/cas/serviceValidate and sending two query parameters: service, which must match the service URL you initially supplied to CAS when redirecting the user there, and ticket, which is the ticket you just received. CAS then responds either with an explicit refutation of the ticket (think


CAS for web applications

A PROGRAMMER’S VIEW OF CAS

involves opening an HTTPS connection to https://cas.sfu.ca/cas/serviceValidate and sending two query parameters: service, which must match the service URL you initially supplied to CAS when redirecting the user there, and ticket, which is the ticket you just received. CAS then responds either with an explicit refutation of the ticket (think “it’s not meaningful to me and does not represent a valid user”) or an acknowledgment that the ticket proves authentication. In the latter case, CAS also supplies information about the user in an XML document, most notably the account that the user logged in with. Note that this final connection to CAS occurs directly between your application and CAS; your application opens a socket connection and retrieves information from the CAS server. You do not redirect the browser; you speak directly to CAS, effectively closing the loop and completing the authentication process. The CAS client libraries focus on making the HTTPS communication simple in a variety of languages; you don’t need to know details about how to write an SSL or HTTPS client, nor do you need to know any details about how CAS’s response is formatted textually.


CAS for web applications

WHAT TO DO ONCE YOU AUTHENTICATE A USER WITH CAS

CAS is not a session-management mechanism; it provides no facility for helping you keep track of users once they’re authenticated. Typically, applications will want to track users just as they would if they’d validated a user’s password themselves. That is, you’ll probably want to establish your own session – using application-specific, in-memory cookies or a similar mechanism – right after you validate a user’s authenticity with CAS. CAS is a single sign-on facility; once a user authenticates to CAS, the user need not continue to supply a password for other applications that redirect the user to CAS. However, CAS is not a “single sign-off” facility; a user that logs out of CAS will still have access to your application if your application keeps a persistent session with the user. CAS does offer a Single Sign Out option, which, when activated, will notify an application that a user has logged out of CAS. The application can then terminate any remaining local sessions as well. See the Jasig documentation for more details. CAS does provide a “logout” URL that the user may visit; loading the URL causes CAS to forget about the user’s prior authentication. Applications may link to this URL at https://cas.sfu.ca/cas/logout


CAS for web applications

OTHER THINGS CAS CAN DO

CAS lets applications opt out of its single sign-on facility. For applications that consider their data especially sensitive, this facility may be appropriate to ensure that a CAS-authenticated user is still present and hasn’t, for instance, walked away from a public kiosk. Note that using this feature makes it difficult to integrate your application into a campus-wide portal and may disappoint users’ expectations of single sign on. To use this option, you would add the parameter renew=true to the login and serviceValidate URLs. CAS also lets applications choose to not force a user to log in if they are not already logged in. This will guarantee that the user will not be interrupted by a login page, and allow the application to put up a generic (or gateway) page if the user is not currently logged in. This option is chosen by adding the parameter gateway=true to the login URL.


CAS for web applications

OTHER CAS OPTIONS

CAS offers some other options to allow applications to modify how they interact with CAS. The following options are extensions added to the SFU version of CAS, and are not available in the Jasig version of CAS.


CAS for web applications

These options are:

error=error+message – If the application has determined that the user who has been successfully authenticated does not have access to the application, it can redirect to the login page again, this time using the renew=true option along with the error option to explain to the user why they need to try another user account. message=message+from+application – The application can choose to put a message to the user up on the login page. If this is not set, CAS will put a default "You have requested access to a site that requires authentication" message app=AppName – The application can specify its name so that CAS can put up a more specific "Login required" message. allow=handler1,handler2,… – CAS can use one or more “handlers” to authenticate a user. Each of the specified handlers will be tried in turn until it can be determined that the authentication has succeeded or failed. By default, the sfuhandler alone is used. If this option is used, it must be passed to both the login and serviceValidate URLs.


CAS for web applications

The handlers that are available are:

1. sfu – This is the default (i.e. if no allow list is given), and will match any SFU account. The serviceValidate call-back, will return a response like the following: <cas:serviceResponse> <cas:authenticationSuccess> <cas:user>userID</cas:user> <cas:authtype>sfu</cas:authtype> </cas:authenticationSuccess> </cas:serviceResponse> 2. alumni – This will match any alumni email address and password. The user must enter id@alumni.sfu.ca and their password. The following will be returned from the serviceValidate call-back: <cas:serviceResponse> <cas:authenticationSuccess> <cas:user>userID@alumni.sfu.ca</cas:user> <cas:authtype>alumni</cas:authtype> </cas:authenticationSuccess> </cas:serviceResponse> 3. staff 4. faculty 5. student 6. sponsored 7. apache - This was added to CAS to allow the Apache CAS module to authenticate accounts from a .htpasswd file serviceValidate call-back for this option: Some people have found it useful to use this from an application calling CAS directly to implement their own "accounts". Because CAS can't do the authentication for you, the password will be returned to your application. Because a password will be returned to you, CAS will not allow you to have an "apache" account that has the same id and password as an SFU account. The following would be returned from the <cas:serviceResponse> <cas:authenticationSuccess> <cas:user>id</cas:user> <cas:authtype>apache</cas:authtype> <cas:password>password</cas:password> </cas:authenticationSuccess> </cas:serviceResponse> 9. !mail-list - This allows access to members of a mail list. You specify an allow option with an exclamation mark followed by the mail list name. If you use the parameter: allow=!sfu-cas the following would be returned from the serviceValidate call-back if a member of that mail list logged in: <cas:serviceResponse> <cas:authenticationSuccess> <cas:user>ray</cas:user> <cas:authtype>sfu</cas:authtype> <cas:maillist>sfu-cas</cas:maillist> </cas:authenticationSuccess> </cas:serviceResponse> What Gets Passed Back By serviceValidate The serviceValidate URL will pass back an XML document indicating the success or failure of the validation. On failure, an error like the following will be returned: <cas:serviceResponse> <cas:authenticationFailure code=' ... '> Optional authentication failure message </cas:authenticationFailure> </cas:serviceResponse>


CAS for web applications

indicating that the ticket was invalid and why, or:

<cas:serviceResponse> <cas:authenticationSuccess> <cas:user> userID </cas:user> <cas:authtype>sfu</cas:authtype> </cas:authenticationSuccess> </cas:serviceResponse> indicating that the validation succeeded. The number and types of keyword/value pairs varies depending on the application. The user and authtype keywords are always returned. Other items may be returned (e.g., see the allow option above).


CAS for web applications

PROXY AUTHENTICATION

In a multi-tier CAS installation, an agent acting on behalf of a user, but without direct access to the user's cookie cache, may need to convince a third party that it represents the user legitimately. For example, a WebMail application that connects to a POP server to collect the user’s email, would have to convince the POP server that it is acting legitimately on behalf of a particular user. Using proxy tickets, a back-end service may determine (a) what user is being impersonated; (b) who is handling the impersonation. These two determinations allow service to accept proxied credentials selectively.


CAS for web applications

CAS

The Central Authentication Service: a trusted arbiter of authenticity. Service A web application that authenticates users via CAS. Proxy A service that wants to impersonate users to other services. Target (or back-end service ) A service that accepts impersonated (proxied) credentials from at least one particular proxy.


CAS for web applications

TICKETS

Parties involved in a CAS authentication make use of tickets , or opaque strings that prove some assertion to CAS. CAS uses the following tickets: Ticket-granting cookie (TGC) A ticket encapulated by a cookie that is sent to the user's web browser and returned only to CAS, and only over a secured channel. This ticket establishes the user's identity with CAS and lets CAS act as a single sign-on system for the web. Service ticket (ST) A ticket sent by CAS, through the user's browser, to a service. Each ST may be used only once, and must be combined with the unique identifier for one specific service in order to be useful. (Put another way, a service that knows its own unique identifier will refuse to accept STs intended for another service. This prevents one service from mounting a "man in the middle" attack against another.) Proxy-granting ticket (PGT) A ticket sent by CAS to a service holding a valid ST (but see below). This ticket (associated with an individual service and an individual user) confers the ability to produce proxy tickets (see below). Proxy-granting ticket IOU (PGTIOU) A ticket sent by CAS alone in a service validation response, and with a PGT to the callback URL. It is the web application's responsibility to maintain a table to correlate PGTIOUs and PGTs (see below). Proxy ticket (PT) A ticket usable by a proxy to access a target by impersonating a single user. The


CAS for web applications

PT

carries information about the proxy or proxies attempting to gain access. For targets that are also (second- or higher-level proxies), a


CAS for web applications

PT

may be used to obtain a


CAS for web applications

PGT

, but this


CAS for web applications

PGT

will preserve information about the linear series of proxies that lie between the user and the ultimate target.


CAS for web applications

PROXY MECHANISM

If an application that is using CAS needs to be a proxy , and so needs a proxy ticket to pass on to a target application, the proxy applicationserviceValidate URL, The needs to pass an extra query parameter to the proxyCallbackUrl parameter is used to specify a URL that CAS will connect to with two query parameters: pgtID – the actual value representing the


CAS for web applications

PGT

. pgtIou - the PGTIOU contained in CAS's response to the web application's request. Your application has the responsibility to maintain a table to correlate PGTIOUs and PGTs. The CAS servicevalidate callback will then respond with the following: <cas:serviceResponse> <cas:authenticationSuccess> <cas:user> userID </cas:user> <cas:authtype>sfu</cas:authtype> <cas:proxyGrantingTicket>


CAS for web applications

PGTIOU

</cas:proxyGrantingTicket> </cas:authenticationSuccess> </cas:serviceResponse> Your application can now match the


CAS for web applications

PGTIOU

to get the


CAS for web applications

PGT

from the table that was setup by your applications proxyCallbackUrl. The proxy application can now obtain proxy tickets (


CAS for web applications

Request:

The proxy application sends an HTTP request with two query parameters: pgt and targetService, representing respectively a


CAS for web applications

PGT

and the unique identifier (URL) corresponding to the target application to which the proxy application wishes to gain access. The URL to send the request to is: https://cas.sfu.ca/cas/proxy


CAS for web applications

Response:

A cas:proxyFailure message can be returned here for invalid or expired PGTs. On success, a message, of the following format, is sent by CAS to the application: <cas:serviceResponse> <cas:proxySuccess> <cas:proxyTicket>


CAS for web applications

PT

</cas:proxyTicket> </cas:proxySuccess> </cas:serviceResponse> This


CAS for web applications

PT

may then be sent by the application to the target


CAS for web applications

Request:

The target application sends an HTTP request with two query parameters: ticket and service, representing respectively the


CAS for web applications

PT

and the unique identifier (URL) of the target


CAS for web applications

application. The URL to send the request to is:

https://cas.sfu.ca/cas/proxyValidate


CAS for web applications

Response:

A cas:authenticationFailure message can be returned here for invalid or expired PTs. On success, a message, of the following format, is sent by CAS to the application: <cas:serviceResponse> <cas:authenticationSuccess> <cas:user> userID </cas:user> <cas:authtype>sfu</cas:authtype> <cas:proxyGrantingTicket>


CAS for web applications

PGTIOU

</cas:proxyGrantingTicket> <cas:proxies> <cas:proxy> proxy1 </cas:proxy> <cas:proxy> proxy2 </cas:proxy> <cas:proxy> proxy3 </cas:proxy> ... </cas:proxies> </cas:authenticationSuccess> </cas:serviceResponse> The target service may then make any access-control decisions it needs to make, based both on the username and on the proxy “path” conveyed by the response from CAS. As the general format of this latest response message suggests, proxies may be "chained" – that is, applied successively – before an ultimate target is reached. This chaining is achieved by the added PGTIOU to this recent message – when target services implement the "proxy granting" protocol. Thus, a target service may act as a proxy as well. Calls to proxyValidate can also specify allow options. The default allow option is sfu, so if this option is not specified, only SFU accounts will be returned to the application.


CAS Quick Tips

Information Security Identity and Access Management Central Authentication Service (CAS)


CAS Quick Tips

OVERVIEW

Below are some common troubleshooting steps for CAS.


CAS Quick Tips

DETAILS

The single sign-on doesn’t work across browsers. Open multiple CAS-enabled SFU applications in the same browser to avoid the chore of re-entering your login credentials. Signing out of a CAS-enabled application doesn’t immediately sign you out of all opened CAS-enabled applications. Please lock or sign out of your device if you are momentarily stepping away or have finished your work. Not all SFU applications use CAS. Therefore, you will need to enter your SFU credentials to sign in non-CAS applications even if you have signed in CAS-enabled applications in the same browser. For users with access to multiple accounts (such as role account and personal computing ID), it is recommended to log out, open a new browser, or use a private browsing window to switch between accounts for access to applications.


Using mod_auth_cas at SFU


Using mod_auth_cas at SFU

MOD_AUTH_CAS INTRODUCTION

mod_auth_cas is an Apache module that uses CAS to protect static and dynamic web content served by the Apache HTTP Server.


Using mod_auth_cas at SFU

Note:

There is an older version of mod_auth_cas that was extensively modified to work with SFU CAS. This version will still work, but is no longer supported. It only works with Apache 2.2, and that version of Apache is no longer being maintained by The Apache Software Foundation. If you are currently using the old SFU mod_auth_cas, and want to upgrade Apache to version 2.4, see the documentation here on moving from the old SFU mod_auth_cas to the new mod_auth_cas .


Using mod_auth_cas at SFU

DETAILS

Once you have built and installed mod_auth_cas in your Apache modules directory (say /etc/httpd/modules), you would edit your Apache configuration to load the mod_auth_cas module with LoadModule auth_cas_module modules/mod_auth_cas.so You then need to add a few required parameters to configure mod_auth_cas CASLoginURL https://cas.sfu.ca/cas/login CASValidateURL https://cas.sfu.ca/cas/serviceValidate CASCookiePath /usr/local/apache2/cas/ mod_auth_cas needs to make a direct connection to the CASValidateURL to validate the Service Ticket from CAS when the user logs in. To allow the SSL connection to be made, you need to install the X509 certificate of the Certificate Authority for the CAS server in your certificate folder (default /etc/ssl/certs/). That certificate, the DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, is available directly from DigiCert . You would then specify the directory containing that certificate using: CASCertificatePath /etc/ssl/certs/ You can then protect a directory in your Apache configuration by using: <Location /secured> Authtype CAS Require valid-user </Location> You can also protect directories by placing the contents of the Location block in .htaccess files.


Using mod_auth_cas at SFU

SUPPORTED REQUIRE DIRECTIVES

Require valid-user All valid users can access the resource. Require user userid [userid] ... Only the named users can access the resource. Require cas-attribute member:resource:dept:some-dept:some-group Only members of the named Grouper group can access the resource. You must grant the grprcas user READ and VIEW rights to your group. Only use policy groups for CAS access, not reference groups. Require cas-attribute member:mail-list DEPRECATED: Move to using Grouper groups. Only members of the named mail list can access the resource. Require cas-attribute sfuEduPersonAffiliation:staff Only SFU staff can access the resource. Require cas-attribute sfuEduPersonAffiliation:undergrad Only SFU undergrad students can access the source. Require cas-attribute sfuEduPersonAffiliation:grad Only SFU grad students can access the resource. Require cas-attribute sfuEduPersonAffiliation:faculty Only SFU faculty can access the resource. Require cas-attribute sfuEduPersonAffiliation:alumnus Only SFU alumni can access the resource. Require cas-attribute sfuIsLightweight:true Only SFU lightweight accounts can access the resource. Require cas-attribute sfuIsLightweight:false Only SFU fullweight account can access the resource.


Using mod_authn_cas at SFU