Limiting the Canvas Backdoor Login after SSO

I am an Instructional Designer and Canvas Admin at a College. We just enabled SSO through MS Azure/Entra, and the /login/canvas "Backdoor Login" remains. I like that for admins, but is there a way to restrict which users can sign into [domain].instructure.com/login/canvas to just admins?

Find more posts tagged with

Admin

Accepted answers

Chris

Hi @Beehive,

I don't know of a switch to limit that login to admins only, but someone else may know different.

The method we use is to associate our users with our specific SAML login provider id in our SIS files, so they can only log in through that provider (not the Canvas auth). You can find info about this at SIS Import Format Documentation - Canvas LMS REST API Documentation (instructure.com) (see the authentication_provider_id option under the users.csv file). Might that wok for you?

-Chris

All comments

Chris

Hi @Beehive,

I don't know of a switch to limit that login to admins only, but someone else may know different.

-Chris

Beehive

Hi Chris,

Thank you, this looks like it will do the trick! I'll give this a try in Beta and see if that works, but that seems to be the fix.

Thanks again,

Nathan (aka "Beehive"... I'm terrible at coming up with usernames....)

James

Nathan ( @Beehive )

I'm a slow typist and needed to test some things. I see you've taken a liking to Chris' solution, but I had already put a lot of work into this response, so I'll send it anyway.

There are some other approaches. Since the /login/canvas never appeared to students, it won't be a big problem getting them to switch over. However, it leaves the in-secure method available for them to use and you'll want to prevent that.

The approach that first came to mind is to assign random but secure passwords for all of the existing users -- except for admins so that they cannot use it. That's what we did when we created the accounts before we had SAML (and before the option to limit to specific authentication methods was available through a SIS import). This kept our students from using the Canvas login, but it kept it available as a backdoor. We still use the /login/canvas URL for some other parts of the college that don't use the Microsoft logins.

If a student stumbles across the /login/canvas page somehow, you'll want to keep them from using it. Hopefully no student goes to the trouble, but some might find that "My old password still works if I go to /login/canvas" and bookmark it.

I will say that this can be disruptive. We used to CAS before switching to Microsoft and many students (and staff) had bookmarked the CAS login rather than the main Canvas page. We switched to Microsoft Azure / SAML, but left the CAS up and running since there were other systems on campus that used it. When the CAS server stopped working, we had people who couldn't get to Canvas because they had bookmarked the wrong page.

I would send out an announcement in Canvas that the old login page is going away and going to stop working before you make any changes.

If possible, make the change when it would least impact students. Doing it during finals week is not a good choice.

You can help people make the transition. Here are three techniques in order from least invasive to most extreme.

Modify the login page through the Theme Editor
Modify the login page using JavaScript
Remove the Canvas login

You can modify the Canvas Login page by going to the Admin > Themes and using the theme editor. While you don't get to change the text, you could select a background image that contains instructions that this method has been discontinued and direct them to the proper way to login. Since it's a background image, there's the accessibility issue. It's not perfect, but it can ease the transition and provide a reminder for those who missed the many emails you sent them telling them of the upcoming change.

You could also use custom JavaScript to check for the pathname /login/canvas and then modify the page. Remove most of what is there and then add a note explaining what the student needs to do.

What you might do is check for the presence of a querystring. If the pathname is correct and the querystring is empty, then give your message. If the pathname is correct and a querystring exists -- you could even set it to a specific string -- then don't make the changes to the page.

For example,

/login/canvas gets modified
/login/canvas?login does not get modified and delivers the original page for your backdoor.

Here's a snippet to get you started. There are two options. The first notifies them and the second redirects them.

(function() {
  'use strict';
  if (window.location.pathname.startsWith('/login/canvas') && window.location.search === '') {
    // Dynamically generate the URL for the main login page
    // You could hardcode it, but this allows beta and test to work.
    const mainLogin = `${window.location.protocol}//${window.location.host}`;
    // option 1 - replace existing content with message and link
    const content = document.getElementById('content');
    content.innerHTML = `<p>This login page no longer works. Go to the <a href="${mainLogin}">main Canvas page</a> to login.</p>`;
    // option 2 - redirect to main page
    // window.location.replace(mainLogin);
  }
})();

You could allow the admin bypass by modifying the check for something like window.location.search !== '?login'

I'm not a fan of innerHTML and try to avoid it. You could use content.replaceChildren() and then content.appendChild() after creating the elements. However, simpler is often better and since it's just one of many options, I didn't want to overcomplicate things.

If you take this approach, definitely test it in your beta instance first. Otherwise, a slipup could disable your entire Canvas site.

Note that you will still have to change passwords or do something. There's nothing preventing a student (or someone else) from discovering that if you put query string it will let you in.

The extreme option is to eliminate the backdoor completely. I've been a Canvas Admin for 12 years and have rarely had to use the Canvas login because my main one stopped. Mostly it was when our college network has having issues and CAS wasn't available. Since we've switched to Microsoft for logins (I think it was about 4 years ago), I don't remember using it all.

You could delete the Canvas login option under Admin > Authentication. This removes it for everyone, even the backdoor for admins. Make sure your Microsoft logins are working first before you do this. This could be a temporary thing. Once everyone stops trying to use the Canvas login (yes, I know that is no guarantee), you could turn it back on for the admin to have their backdoor.

All of these approaches are to make it harder for students to use the Canvas login. Ultimately, you'll need to change the passwords or take the approach that @chriscas suggested.

Unanswered Questions

Overlapping Scroll Bars
I'm not sure that this is the right place to post about this, but I was wondering if anyone has a fix for how the scroll bar for the entire page covers the scroll bar for just a document viewed in Canvas. The scroll bar for a document will stay visible until one attempts to interact with it, at which point the bar for the…
IB MYP reporting for assignments and Grade book
Hi There, We are in the process of transitioning to Canvas this year and were wanting to connect with any other MYP schools to see how you setup Assignment and grading under your modules. Or you could guide us to any resources you may have.
A small pre-submission habit that’s helped with written assignments in Canvas
After using Canvas for a while, I picked up a small habit that’s saved me some last-minute stress with written submissions. Even when drafts are original, longer explanations and summaries tend to reuse common phrasing, especially in research-heavy assignments. Before submitting, I usually do a quick cleanup pass to reduce…
How do I view numbers in the learning mastery gradebook?
In the "How do I use the Learning Mastery Gradebook" page, under "Student scores" (https://community.instructure.com/en/kb/articles/660932-how-do-i-use-the-learning-mastery-gradebook-to-view-outcome-results-in-a-course#view-student-scores), the displayed gradebook shows a little colorful square and also points for each…
Request for New Quizzes - Show Question-Level Feedback without Manual Grading
In Classic Quizzes, it is possible to display question-level feedback to students without manually grading an essay question on a quiz. Can this be enabled in New Quizzes? Use Case: This feature is vital for practice quizzes that include essay questions along with other question types. We mix essay questions with other…