NORMALIZATION-COLLISION

[AmirahAlNufily]

An unexpected "NORMALIZATION-COLLISION-UUID" has appeared in the login information for users. This issue affects users who are automatically synced from our Active Directory (AD). What could be causing this?

[HansDB]

Noticed the same thing and nothing has changed on our end. Any additional information by Instructure as to why this has happened would be nice.

[AT-INCAE]

I have the same problem, many or our users have this note in the account

[dbrace]

H @AmirahAlNufily,

Do you have "Just in Time Provisioning" enabled?

How do I configure third-party authentication providers for a Canvas account? - Instructure Communit...

Have you reached out directly to Canvas Support?

-Doug

[AmirahAlNufily]

Hi Doug,

Thanks for thre reply, no, it's currently disabled, and I haven’t contacted Canvas support yet. Could you please share more information on how to get in touch with them? I’d really appreciate it!

-Amirah

[dbrace · Accepted solution]

You are welcome, Amirah.

The process for getting ahold of Canvas Support can vary for each school/organization but the options that are available to you should be within the "Help" of Canvas when you are logged into the LMS.

If you do not see anything in that location, from the same email address that you use when you are logged into Canvas as an admin (this makes it possible for them to associate the inquiry with your Canvas user account), send an email to support@instructure.com.

After sending that email, you should receive an automated reply/email from their ticketing system. It could take up to 10 minutes for you to get that reply/email.

If possible, and if the solution is not completely specific to something unique or exclusive to your school/organization, please come back to this question and let us know what the solution was. Doing that could help others.

Best of luck,

-Doug

[AmirahAlNufily]

Perfect, thanks very much for the informative details. I’ll contact them and will absolutely come back to this chat for the solution, if applicable.

[ApplicationProv]

We had the same issue. It appeared on our teachers who were also parents' of students in our district (so both their parent & teacher accounts used the same login which WAS working fine since the teacher account logs in via SAML and the parent login is on the generic Canvas login window).  It also seemed to appear on guardians that we imported from our SIS and were created manually also.

Here is Canvas' response: 

My name is Seth and I'm with the Level 2 Canvas Support team. Due to a previous oversight Canvas was allowing multiple logins with the same login_id to be created where one of the logins had a null authentication_provider_id and the other had the authentication_provider_id set to the id of a "legacy" authentication provider (that is a Canvas auth, SAML, CAS, or LDAP authentication provider). The "legacy" authentication providers behave a little bit differently than the rest of the authentication providers as they will also match logins with a null authentication_provider_id in addition to logins with the authentication_provider_id set to their own id. In one of our recent deploys our engineers fixed this so that if two logins share the same login_id and one of them is linked to a "legacy" type authentication provider the other cannot have a null authentication_provider_id. As a part of this they also ran a fix-up to remove any cases where this requirement was not being met by adding that NORMALIZATION-COLLISION prefix along with a randomized string. They had a number of rules outlined below to attempt to prevent modifying logins which were in active use.

1. Prefer logins with a SIS ID
2. Then the most recently used login
3. Then logins explicitly linked to an auth provider if none have ever been used
4. Then prefer logins with a password actually set on them
5. Then prefer logins where the (case insensitive) login_id matches the normalized login_id (normalization according to https://datatracker.ietf.org/doc/rfc4518/)
6. And finally prefer the most recently created login

In this case it looks like you had a number users whose logins ended up being updated by the fix-up. If the login which was modified is still needed for the user to be able to log in then there are a few options for updating the user's logins to allow them to log in again. Below one option is outlined below. If you are needing assistance with updating user logins don't hesitate to reach out. Additionally, if you have a large number of users who all need the adjustment to their logins made (e.g. update all the logins with the NORMALIZATION-COLLISION prefix to associate them with an authentication provider then remove the prefix) then we can work with our engineers to make that change in bulk.

If a login which was in use had the NORMALIZATION-COLLISION prefix added then to allow that login to be used again you would want to first update the login with the matching (or previously matching) login_id and null authentication_provider_id to set the authentication_provider_id to the id for whichever authentication provider the login is used with, then once that is done you can update the login with the NORMALIZATION-COLLISION prefix to remove the prefix from the login_id. The authentication_provider_id can only be set via API or a SIS import. The API endpoint for updating a login is documented here https://developerdocs.instructure.com/services/canvas/file.all_resources/logins#method.pseudonyms.up... while the formatting for a SIS import to update a login is found in the users.csv section of our docs here https://developerdocs.instructure.com/services/canvas/sis/file.sis_csv#users.csv. You can find the ids for the authentication providers currently available in your instance using this API endpoint https://developerdocs.instructure.com/services/canvas/file.all_resources/authentication_providers