cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
itadmin
Community Contributor

Observers no longer able to add students via students' username and password

Jump to solution

Hi everyone

I have a weird issue involving the creation of observer accounts. I admin Canvas for a K12 (primary) school which rolled out Canvas at the start of the year.

I enrolled all the students in Canvas using the SIS Importer but they log into Canvas using Google authentication. We were one of the first schools to turn this feature on late last year. However as part of the SIS import process, all the students are still assigned a login ID and a password, which can be different to their Google authentication details, which we can only use for the creation of observer accounts.

In the last couple of weeks or so I've noticed parents are no longer able to make an observer account tied to their child's account because Canvas is no longer accepting the students' username and password that was defined when I created their accounts (we distributed each student's username and password to parents with instructions on how to create their observer accounts). Inputting their Google login details in its place does not, and has never worked, but the SIS defined username and password solution has been rock solid up until a couple of weeks ago when it just stopped working, and showing a "incorrect username/password" error. No combination of usernames and passwords works.

Thankfully we got most of the parent community on the system with observer accounts before this changed but now I'm stuck with manually altering each student's authentication_provider_id to blank via the SIS importer, then creating the observer account because the Canvas username and password works after I do this, then reverting the authentication_provider_id back to Google so the student can log in.

Clearly there's something that's changed recently which has broken the process we had used and advertised to parents. The Canvas username and password only work when logging in via Google is disabled for the student. I'm getting by for now but this isn't a sustainable long term solution. If anyone has any ideas or is aware of any information that I am not, I would love to hear it!!

1 Solution

Accepted Solutions
itadmin
Community Contributor

Just in case anyone else finds this thread and has the same issue, here's what Canvas support sent through to me:

Our product and engineering team have comeback to me and advised me that the SSO's and IdP's must send a logout request to Canvas AND redirect back to Canvas for observer self-registration to work correctly. If it is not possible to do this with Google's SAML service, then they will not be able to use the observer self-registration feature - this is intended behavior.

So, with that information it would be something you would need to look into with Google to see if this is something their service is able to do and be able to configure it.

This went skyrocketing over my head, so I asked for a simpler explanation and received the following:

I apologize for any confusion. I have been advised by our engineers that the Google SSO is just a standard authentication system, which does not support what you are trying to do.

The issue here is with what Google are doing with there SSO. If the observer self registration is not working for you as intended you will need to contact Google directly for them to configure it for you. We have not made any changes to the Google SSO as we don't have any authority over how Google configure there servers, therefore this is working as intended.

So, strangely, Google's SSO is being blamed for this problem. Why that has an impact on the Canvas login setup - a separate system for all intents and purposes - is beyond me.

Upon bringing this up with our Customer Success Manager, he suggested we create parent accounts with the SIS importer and use the API to link the parent (observer) accounts to the student accounts. He suggested this github script to do this but I have no idea how to get started to make this happen. Looks like I have some upskilling to do.

View solution in original post

5 Replies
clong
Community Champion

HI Jimmy,

I'm not aware of anything in Canvas that has changed the last couple of weeks that would cause this problem. I do know that it is recommended that the student's username (email) in Google match what it is in Canvas and it sounds like this might be something for you to check.

Filing an official help case would be the next step. To do this you can click on the help menu in Canvas then select "Report a Problem". This will enable an the technical support team to look at your settings and test things out.

itadmin
Community Contributor

Hi Chris

Yes, the email address assigned to the students in Canvas is already identical to the one assigned to them in Google Apps.

I thought my next step would be to contact the support team so I will get onto that now.

itadmin
Community Contributor

Just in case anyone else finds this thread and has the same issue, here's what Canvas support sent through to me:

Our product and engineering team have comeback to me and advised me that the SSO's and IdP's must send a logout request to Canvas AND redirect back to Canvas for observer self-registration to work correctly. If it is not possible to do this with Google's SAML service, then they will not be able to use the observer self-registration feature - this is intended behavior.

So, with that information it would be something you would need to look into with Google to see if this is something their service is able to do and be able to configure it.

This went skyrocketing over my head, so I asked for a simpler explanation and received the following:

I apologize for any confusion. I have been advised by our engineers that the Google SSO is just a standard authentication system, which does not support what you are trying to do.

The issue here is with what Google are doing with there SSO. If the observer self registration is not working for you as intended you will need to contact Google directly for them to configure it for you. We have not made any changes to the Google SSO as we don't have any authority over how Google configure there servers, therefore this is working as intended.

So, strangely, Google's SSO is being blamed for this problem. Why that has an impact on the Canvas login setup - a separate system for all intents and purposes - is beyond me.

Upon bringing this up with our Customer Success Manager, he suggested we create parent accounts with the SIS importer and use the API to link the parent (observer) accounts to the student accounts. He suggested this github script to do this but I have no idea how to get started to make this happen. Looks like I have some upskilling to do.

 @itadmin ​, thank you for posting this update and for introducing me to the very useful word "upskilling." Smiley Happy

kona
Community Coach
Community Coach

 @itadmin ​, I'm not a programmer (but I'm married to one Smiley Wink) and my best guess for this, "So, strangely, Google's SSO is being blamed for this problem. Why that has an impact on the Canvas login setup - a separate system for all intents and purposes - is beyond me." is that even though they are separate systems they have to be able to talk a similar language in order to communicate. Or think about putting a square peg into a round hole. Unless you use a lot of brute force it doesn't work. Yet, you could possible add something to either the round or square side to allow them to fit together.

What Canvas is saying that while the Google SSO-Canvas configuration did work before, something has changed on the Google side of things (possibly an update or change in their code/programming) that made talking/configuring with Canvas not work correctly. This actually happens all the time when you try to get two completely different systems to work with each other and is currently going on with Turnitin and Canvas.

Regardless, I'm sorry to hear you're having this problem and I hope Google is able to resolve the issue.