Is there any harm with creating observers accounts using their email addresses as their login IDs and user IDs?

[rpsimon]

Previously, we used our SIS to generate a user id using a student's SIS ID plus an additional number.  I found that parents would lose this information and it would become difficult for them to login to Canvas without asking me for help.  What if we now use the parents' email addresses as their user ids and login ids?  Are there any privacy or security concerns with doing so?  What do you use as the user and log in ids for your parents/observers at your schools?

[chriscas]

Hi @rpsimon,

I'm in higher-ed, so we don't really have parent observers here like k12.  With that said, when we do have extrenal users (guest speakers, reviewers, etc) being added to Canvas, we do have them create a login to our SSO using their personal email address.  Again, that's slightly different from Canvas itself, but it's really the same idea.  With our sso, the login_id in Cavas ends up being their personal email address with the @ replaced by a +, but when they login to SSO they just enter their email and password they created.

We haven't really run into any privacy issues doing things this way, and I do agree with you that this is likely going to be much easier for parents to remember that a somewhat random student id.

-Chris

[NoahBoswell]

Hi there @rpsimon !

I wanted to add on, with experience from a K12 environment. Parents were able to use their emails as their Login IDs, and I've personally never experienced any issues, both from the Free for Teacher instance as well as from a paid Canvas environment. To my knowledge, we never hit major bumps in the road with security or privacy concerns, especially since that information was set up to only be viewed by certain users.

I hope that helps, too!

Noah

[rpsimon]

Tagging you both @chriscas and @NoahBoswell since you both have been helpful.  🙂  

I see now after testing that I also need to include the email field in my csv as well.  The image below is probably a bit too small to see properly, but it's the users.csv SIS import.  Currently, we do not enter the email address in the import so this would be new also.  

Also - how do you manage the parents' passwords for Canvas?  Is there a way to give parents the ability to reset them in case they forget them?  I don't think there is.  

Thank you. 

[NoahBoswell]

I'm glad I was able to help out! In my experience, parents always used the generic canvas login to access their accounts. If they use the /login/canvas URL, they will be able to change their passwords inside of their user account settings or request a reset password link from the generic login page. This of course can also be done by an admin, if needed.

Note: If they decide to change it from their user account settings, they will need to click the 'Edit Settings' button on the right-hand side of the page before having access to see the Change Password button.

[rpsimon]

The problem is that I don't see that as an option to do that. I want to be able to set (temporary) passwords for the parents and for them to be able to reset them without needing my assistance.  If it's easier for you to communicate via email than through this community, just let me know and we can be in touch via email.  Thanks!

[NoahBoswell]

I'm totally fine with here in the Community or over email -- that can be your decision!

When you made the fake account, did you assign it credentials as the admin, or did you create it as a new account from scratch not on your admin account? Users usually can't change their password if their institution assigns it to them, it only works if they create it themselves. Also, if it was created through Google or through another SSO, the change password button doesn't appear.

[rpsimon]

I created it as an admin, assigned credentials, and imported it as a csv.  

I am wondering what the best method is to use going forward.  

[NoahBoswell · Accepted solution]

Aha! Yep, I'm pretty sure imports by admins prohibit parents from changing their own password because that's how it was generated into the system.

If you are looking to allow parents / observers to have control over their own account settings, including the ability to reset their passwords, I recommend enabling Self Registration under the Authentication tab at the root-account level, and only allowing observers to sign up for an account. This will allow them to sign up and connect to their student's account seamlessly. They will need to use the schoolname.instructure.com/login/canvas URL to sign in, if you use your general URL and have SSO enabled for students and staff, they won't be able to login that way.

The only thing you'll need to remember to do, is to ensure students have permission to generate pairing codes (this can be done under the Permissions tab at the account-level). The student will need to go into their user settings and generate this code (the parents can, too if they know their student's credentials), and parents will enter the pairing code on the sign-up page. They cannot create an account without the pairing code, so this will help prevent random accounts being created.

Here are some guides with some additional information, if you're interested in checking them out!
How do I generate a pairing code for an observer as a student?
How do I sign up for a Canvas account as a parent?
How do I log in to Canvas as an observer?

Do you think this would be a possible solution for you and your institution?

[dbrace]

@melodyc_lam, do you have any suggestions for @rpsimon?

-Doug

[melodyc_lam]

I was summoned by @dbrace (Thanks!) to provide some input. I work with a very large K-12 district with parents that will have multiple students that they need to observe. We only make observer accounts through Self Registration and only allowing observers to make an account. The need to create a "student pairing code" (as @NoahBoswell states) ensures that parents are only observing the students in their household.

If a parent needs their password reset, they can reset it through this method. I do find that with self-enrollment that sometimes you do have situations where parents need to change their email but I handle those on a case-by-case basis.

[dbrace]

Thanks for chiming in, @melodyc_lam!