Authentication Login Attribute Change

[camiarcher1]

Currently we have our Login Attribute set to NameID in the Authentication setting. Can this be changed to SIS ID in the Authentication page and Azure? Or is anyone using the SIS ID for the login attribute already?

We have a purge process in our SIS and Active Directory, which deletes user accounts and frees up user names. We found that because there is not a purge process in Canvas old records will have a username still assigned that may match a newly created user and SSO will allow the new user to see all of their old content or course work. Using the SIS ID for authentication would eliminate this as those are unduplicated. 

[mzimmerman]

Hi @camiarcher1 

In the authentication provider settings, the "Login Attribute" is the field coming from the authentication provider which is matched against the login_id in Canvas.  As far as I know, there isn't a way to force Canvas to match the "Login Attribute" against the Canvas sis_id.

The simplest way to do what you want is to switch the "Login Attribute" value to whatever field is the equivalent of your SIS ID in the authentication provider, then do a bulk replacement in Canvas, replacing all the existing login_ids with a copy of the value in the sis_id field using an SIS Import.  Then you would need to make sure that accounts created in the future use the same value for both the sis_id and and the login_id.