Canvas supports authentication with a variety of third-party identity providers, which can be configured in the Canvas interface. Each provider requires the admin to set an attribute to be associated with the account, such as a user ID, email, or login. Currently supported integrations include Facebook, Github, LinkedIn, Twitter, Google Apps, Microsoft (Office 365), Clever, CAS, LDAP, OpenID, and SAML. Some providers require custom components for configuration. All providers support Single Sign On (SSO) authentication.

Third-party authentication providers can be used in addition to Canvas authentication.

User Credentials

Once a provider has been saved in Canvas, the provider’s authentication login credentials must be added to each Canvas user’s account through SIS CSV files or the Authentication Providers API. (Currently there is no support for adding user credentials through the Canvas interface.) Each authentication provider supports specifically recognized parameters; some providers may recognize additional parameters. Unrecognized parameters are not supported.

To get additional help about authentication systems, including Single Sign On (SSO) support, view the Authentication documents in the Canvas Community Admin Group.

Just In Time Provisioning

As part of the authentication process, admins can apply Just in Time Provisioning, which tells Canvas to automatically create a user's accounts if one does not already exist. Currently when a user logs in to Canvas using a third-party authentication system, Canvas searches users in the account looking for a matching user parameter for that service. If a matching parameter is not found, Canvas returns the user to the authentication provider portal with a message the user could not be found. When Just in Time Provisioning (JIT) is enabled, Canvas automatically creates the user using an ID that matches the username used with the authentication provider.

JIT provisioning must be configured via API for the specific authentication provider (see the Authentication Providers API). It does not need to be configured for individual users via API or SIS.

Federated Attributes

As a complement to JIT provisioning, all authentication providers support federated attributes. When users log into Canvas, more information beyond just ID is passed to Canvas, and that information is associated with their existing user accounts. More information can be found in the Authentication Providers API.

As an admin, you can view all course, group, and account enrollments for a user in your account.

This page also allows you to quickly unenroll a user from any course, group, or account, if necessary. At the account level, unenrolling a user from a course or group has the same result as removing an enrollment in a course, except you can unenroll the user from multiple courses or groups at once.

Enrollments are commonly managed automatically in Canvas through student information system CSV files. However, if your instructors have permission to add or remove users, enrollments can be managed manually by a course instructor.

You can add new users to your account. Users can only be added at the account level.

If you use SIS Imports, you do not need to add any users to your account, as they can be added through your student information system (SIS).

Account Invitations

When a user account is manually added, Canvas gives an option to generate an account invitation. If this invitation is sent, the user is invited to complete the registration process by creating a password. Once the user has an account, the user can also be added to a course. If a user is invited to a course without having an account, the user will have to create an account before accepting the course invitation.

When users are invited to a course manually, they can view the course invitation link in their email and click it to view a preview of the Canvas course. To officially accept, they must click an Accept button in the Canvas interface. However, if you prefer to disable course previews and have users automatically join the course when they view the Canvas course, please contact your Customer Success Manager to disable invitation previews.

Email Addresses

Canvas identifies users by email address. When students are added to a course, Canvas attempts to reconcile any email address conflicts when the user first logs in to the course:

• If the user does not have a username in the course's root account, the user's email address is linked to another user within the account, or the institution does not use delegated authentication if open registration is enabled, an account will be created for the user. Adding an email address that is not already linked to an account will only work if Open Registration is enabled.
• If the email address is already associated with an account, the student will be asked to log in to Canvas using his or her existing email address.
• Sometimes a student may be using multiple email addresses within Canvas. If a student responds to an account invitation at one email address, but is logged in to Canvas using a different email address, the student will be asked if they want to link both addresses to the same account. 

You can delete a user from your account.

Notes:

• This process cannot be undone and will remove the user's data (including grades) from all courses and groups.
• If your account manages user information through a student information system (SIS), changes will also have to be made in the SIS. Any changes made in Canvas will not be passed back to the SIS.

You can merge two users within your account. Merging accounts combines the logins, contact methods, and enrollments for the two user accounts. After the accounts have been merged, the user can use the logins that originated from either account to view all their course enrollments within the same account.

Note: Merging user accounts cannot be undone.