External users

[KelsieMcDole]

I have a use case where I need to add groups of users to a course each semester but they are all external to our Campus. They would not be able to authenticate through SSO. Should I set them up manually? Looking for ideas on how others navigate and manage this. 

[chriscas · Accepted solution]

Hi @KelsieMcDole,

I'd probably still use the sis csv import process for this.  Even if a user can't login through SSO, you can configure a csv file for them.  In the users CSV, set the authetication_provider_is to 'canvas' and also have the 'canvas_password_notification' parameter set to true so the user is prompted to setup their Canvas password.  Populate all the other fields (name, email, etc) as normal.  You can then use the enrollments csv file as usual to add the user's enrollments.  I hope this makes sense!

[NoahBoswell · Accepted solution]

Hey @KelsieMcDole ,

In addition to what @chriscas said, which can certainly work, you could also make it so they can sign into your canvas instance by adding /login/canvas at the end of the URL, and logging in the traditional Canvas way. If you allowed account sign-ups under the Authentication tab at the account-level, they can create their own accounts and join courses with a join code / invitation by teacher, or you can manually add these users by clicking the + People button under the account level's People tab, and entering their information there.

You can also check out: https://community.canvaslms.com/t5/Admin-Guide/How-do-I-create-and-add-users-to-an-account/ta-p/90 

I hope that helps a bit too.
Noah

[chriscas · Accepted solution]

Hi @KelsieMcDole,

I'd probably still use the sis csv import process for this.  Even if a user can't login through SSO, you can configure a csv file for them.  In the users CSV, set the authetication_provider_is to 'canvas' and also have the 'canvas_password_notification' parameter set to true so the user is prompted to setup their Canvas password.  Populate all the other fields (name, email, etc) as normal.  You can then use the enrollments csv file as usual to add the user's enrollments.  I hope this makes sense!

[NoahBoswell · Accepted solution]

Hey @KelsieMcDole ,

In addition to what @chriscas said, which can certainly work, you could also make it so they can sign into your canvas instance by adding /login/canvas at the end of the URL, and logging in the traditional Canvas way. If you allowed account sign-ups under the Authentication tab at the account-level, they can create their own accounts and join courses with a join code / invitation by teacher, or you can manually add these users by clicking the + People button under the account level's People tab, and entering their information there.

You can also check out: https://community.canvaslms.com/t5/Admin-Guide/How-do-I-create-and-add-users-to-an-account/ta-p/90 

I hope that helps a bit too.
Noah

[cms_hickss · Accepted solution]

Hi @KelsieMcDole

My school actually does not allow users to access the system without SSO. What we have in place with our Information Security Office is a "Sponsored Account" system (and it is used by more than just the LMS, as Vendors and departments often have access to various things around campus). The Sponsored Account process creates a (let's call it basic) user with a username and access to set up MFA for our SSO. You can see more information on the Sponsor Account here in case it is something you want to pursue with your school.

That user is then pushed into the LMS (from our SIS). The access the user needs (teacher, student, etc) and the course type (academic or non-academic) determine how the user is added to the course.

[dbrace]

This is something similar to what my institution implemented.  Previously I would manually create Canvas user accounts, have phone conversations with them to verify who they are, and then they would login by going to /login/canvas.

Now we have a process that involves them working with our HR department to (1) request a centalized account, (2) verify their identity), and (3) login to their account, changed their password, and configure MFA.

After all of that has been done, I manually provide them with the necessary access.

-Doug