Parent Registration with SAML Authentication

Yes

Purpose

This guide outlines the parent registration setup and workflow for those that use SAML authentication for their students.

SAML Provider Type

Please select your SAML provider type from the list below:

ADFS (Active Directory Federated Services)
Microsoft Azure
Google SAML

ADFS or *Microsoft Azure

*if using Microsoft Azure, you must be syncing with your local directory.

Setup Options

For institutions using either ADFS or Microsoft Azure authentication for students, there are two options for the parent registration setup.

Setting a Canvas password for the student
This option requires that a Canvas password be set for each student. The student would continue to login with SAML, but parents would use the student's Canvas username and password as part of their registration process. Canvas passwords can be set for students in your data provisioning process (CSV files, PowerSchool to Canvas integration, Clever to Canvas integration, etc.). If Canvas passwords for students have been reset manually beforehand, you must force a password change using the API. Please contact your Customer Success Manager (CSM) if you have questions regarding this forced password change. Canvas must be enabled as an authentication provider and self registration must be enabled for the observer role. To view the user workflow for this option, click here.
Configure Canvas with LDAP
You must allow our LDAP access IP addresses to access one or more of their LDAP servers; please contact your CSM for the list of IP addresses. This server can then be configured as a secondary (LDAP) authentication source for Canvas. To configure Canvas with LDAP, click here. Note that for parent registration to function, the login attribute config must be left blank. Students and teachers would continue to authenticate using SAML. Parents would use the student's username and password as part of their setup process, but the credentials would be validated over the LDAP connection rather than the SAML connection. To view the user workflow for this option, click here.

Back to top

Google SAML

Setup Options

Setting a Canvas password for the student
This option requires that a Canvas password be set for each student. The student would continue to login with SAML, but the parents would use the student's Canvas username and password as part of their registration process. Canvas passwords can be set for students in your data provisioning process (CSV files, PowerSchool to Canvas integration, Clever to Canvas integration, etc.) To view the user workflow for this option, click here.

Back to top

User Workflow

If you are utilizing Canvas password for students, parents must go directly to the Canvas login page, which follows the /login/canvas format (e.g. example.instructure.com/login/canvas). If you are utilizing LDAP, parents must go directly to the LDAP login page, which follows the /login/ldap format (e.g. example.instructure.com/login/ldap). Alternatively you may create a discovery page, which will direct parents to the correct URL. Once they've navigated to the correct login page, parents will see this a page similar to this (dependent on your branding):
Parents new to Canvas will click on the parent link in the upper left corner.
They will see this popup:

Parents will need to complete the information in each text box and select the terms of use checkbox.
After clicking the start participating button, parents will be authenticated into Canvas and receive a message that instructs them to check their email in order to complete their registration.
The email message will prompt parents to click a link to complete registration.
Upon opening said link, parents will see this page to be completed with their information:

Note that parents should remember this username and password to log into Canvas later.
Once the register button is clicked, parent registration is complete and the parent will see the Canvas dashboard. To log in again later, parents must navigate to the Canvas login page, which follows the /login/canvas format (e.g. example.instructure.com/login/canvas); here, parents can login using the credentials they registered.