Require SSO login for certain users

[solomong]

Hi,

Is it possible to restrict users to SSO when they are able to use it (i.e., students and faculty) but still leave the Canvas login available as well for parents and others?

Thanks!

[nwilson7 · Accepted solution]

@solomong We do this in a way, there may be other ways as well. 

We have our SSO login for all users that attempt to go to our Canvas either through the normal Canvas login or our vanity URL.  However, this does not change the (what we call backdoor) link https://institution.instructure.com/login/canvas so we provide that link to anyone without our SSO credentials. 

We also do not sync passwords to Canvas, our SSO handles all of that which means the backdoor only works for people without our school accounts.  This then forces people with school accounts to have to use SSO and people without have to use the backdoor link.

Again, I am guessing there are other ways but this has worked well for us.

-Nick

[solomong]

Hi Nick,

Thanks for the reply. That solution also occurred to me and I imagine it's about the only way to do it. However, if an SSO user hits the /canvas login link, can't they just click Reset Password to establish a local login? Probably most of them wouldn't...

Thanks again,

Jerry

[nwilson7]

@solomong Not sure if this is by design or not but the reset password does not work for SSO accounts (at least for us).  It seems Canvas picks up that we are using SSO and it never emails the user the reset link.  It does work for our backdoor accounts but does not work for any that we force through SSO.

-Nick