cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
fosterl
Community Contributor

Non-existent users can now be enrolled in courses

Hi Admins! I just noticed a disconcerting change, which I think first appeared after the Jan. 9 update.

We do not allow anyone in Canvas to use the +People button, except for a very specific role, and Admins. I use it fairly frequently to add students to a new term course site where they need to finish an incomplete. Previously, if I made a typo in the email address, like fotserl@oregonstate.edu instead of fosterl@oregonstate.edu, I would get an error message telling me the user did not exist. Now I can type in any email/login and get "Validated and ready to add 1 user". I am dreaming that this used to generate an error (like it still does for the non-admin role)? The enrollment in the course gets created (as invited), but no user gets created.

Canvas support says this is the expected behaviour for admins.

10 Replies
powellj
Community Participant

I remember seeing this as far back as Summer 2014 when we first started looking into Canvas. I did it once early on and had the same thing happen. It's happened on occasion since then, but now I catch myself before I complete the process. I honestly don't recall ever seeing that error message though?

fosterl
Community Contributor

Jacci, thanks for responding. I guess I'm just losing my mind; or I saw that error when masquerading as the non-admin role.

The thing that makes me catch it is the Name box comes up blank when it says the user is validated.

millerjm
Community Champion

Hi Lindy,

How do you lock down the ability for non-admins to access the +People button?

We haven't had much luck with that - the JS override only works sometimes and we had to give instructors the right to add students in permissions in order to give them access to the "View Prior Enrollments" screen, so we are stuck relying on the JS override, which isn't very secure or reliable.  Smiley Sad

Joni

fosterl
Community Contributor

It's just the Permission to Add/remove other teachers and Add/remove students, but as you say, it prohibits teachers from seeing Prior Enrollments too.

millerjm
Community Champion

ahh, yes, and due to financial aid reporting, we have to leave Prior Enrollments on...thanks for the reply!

kona
Community Coach
Community Coach

To get around this we allow financial aid to view/print an Assignment submission report for every student that uses Canvas - Assignment Submissions Report Programming. This cut down on faculty needing to see concluded student enrollments through People. Faculty can still access concluded enrollments via the Grades tab though, so it all seems to work (without allowing faculty the ability to Add/remove students).

millerjm
Community Champion

Thanks, Kona!  I'll have to check this out!

nlatimer
Community Champion

I don't ever remember seeing an error, either. It was what you mentioned that would catch it for me...the fact that there is no "Name" filled in to the left of the user's email address on the validation screen.

reedt
Community Participant

My campus just became aware of this issue as well and have a hard time believing it's been there the whole time. A few weeks ago we started finding incomplete user account profiles in the system. They had email address for the name and email field and everything else was blank. We corrected them as we found them, but only identified how they were being created this week. In an effort to reduce this from happening on a broad scale, we have turned off the Course Role permissions: Add/remove other teachers, course designers or TAs to the course, and Add/remove students for the course for Teachers, TAs, and Designers. However, we would prefer that this ability to "invite a user to create an account through the Add People button" be controlled in the Permissions. I can understand that this functionality is a convenience for some, but it's problematic for us. This feature opens up the possibility of a user having multiple accounts in the system, and possibly multiple enrollments in a course - one official enrollment via SSO and SIS Import, and one or more unofficial enrollment(s) with a personal email address. This is a mess.