nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How do I configure third-party authentication providers for a Canvas account?

Canvas supports authentication with a variety of third-party identity providers, which can be configured in the Canvas interface. Each provider requires the admin to set an attribute to be associated with the account, such as a user ID, email, or login. Currently supported integrations include Apple, Facebook, Github, LinkedIn, Google Apps, Microsoft (Office 365), Clever, CAS, LDAP, and SAML. Some providers require custom components for configuration. All providers support Single Sign On (SSO) authentication.

Third-party authentication providers can be used in addition to Canvas authentication.

User Credentials

Once a provider has been saved in Canvas, the provider’s authentication login credentials must be added to each Canvas user’s account through SIS CSV files or the Authentication Providers API. (Currently, there is no support for adding user credentials through the Canvas interface.) Each authentication provider supports specifically recognized parameters; some providers may recognize additional parameters. Unrecognized parameters are not supported.

For additional help with authentication systems, including Single Sign On (SSO) support, view the integration documents in the Canvas Community.

Just In Time Provisioning

As part of the authentication process, admins can apply Just in Time Provisioning, which tells Canvas to automatically create a user's account if one does not already exist. Currently, when a user logs in to Canvas using a third-party authentication system, Canvas searches users in the account looking for a matching user parameter for that service. If a matching parameter is not found, Canvas returns the user to the authentication provider portal with a message the user could not be found. When Just in Time Provisioning (JIT) is enabled, Canvas automatically creates the user using an ID that matches the username used with the authentication provider.

JIT provisioning must be configured via API for the specific authentication provider (see the Authentication Providers API). It does not need to be configured for individual users via API or SIS.

Federated Attributes

As a complement to JIT provisioning, all authentication providers support federated attributes. When users log into Canvas, more information beyond just ID is passed to Canvas, and that information is associated with their existing user accounts. More information can be found in the Authentication Providers API.

View the video transcript

00:05: How do I configure third-party authentication providers for a Canvas account?

00:09: In Global Navigation, click the Admin link, then click the name of the account.

00:15: In Account Navigation,

00:16: click the Authentication link.

00:19: In the Authentication drop-down menu, select an authentication service.

00:23: Enter the data required by the service

00:25: . Some providers require custom components for configuration.

00:30: To enable Just in Time Provisioning, click the Just in Time Provisioning checkbox.

00:36: To use a federated

00:37: attribute, select a Canvas provider attribute in the drop-down menu.

00:41: This is the attribute that you want to use in Canvas. Available attributes include

00:46: admin roles, display name, email, given name, integration ID, locale, name, sis

00:54: user ID, sortable name, surname, and time zone.

01:00: Click the Add Attribute button.

01:03: In the Provider Attribute drop-down menu, choose the attribute value that will match

01:07: the selected

01:08: Canvas attribute. Available values include email, family name, given name, locale,

01:14: name, and sub (subject identifier—a

01:16: user ID commonly used with Google, and Microsoft specifications). Note that not all values

01:23: will

01:23: exactly match the

01:24: Canvas attribute. For

01:26: instance, if you set email as an attribute in Canvas, the provider attribute value

01:31: options also

01:32: include email, meaning that the email address from the provider will also be updated for

01:37: the email address in Canvas. However, some

01:39: Canvas attributes may not align with the available provider attribute values.

01:45: values.

01:47: To enable automatic confirmation of email address, click the Autoconfirm checkbox.

01:52: To remove the attribute, click the Delete icon.

01:56: Canvas

01:56: enforces MFA is functionally equivalent to the legacy

01:59: UIs checkbox for MFA Required being enabled;

02:02: any accounts that previously had the legacy MFA Required checkbox enabled

02:07: have this option selected.

02:09: To configure the Multi-Factor Authentication (MFA) settings, ensure that this feature

02:14: is first set to Required or Required for Admins within Account Settings.

02:20: To have Canvas enforce the MFA, select the Canvas

02:23: enforces MFA option. To have SMS carriers send one-time passcodes, click the Send

02:30: one-time passcodes via SMS (US carriers only) checkbox.

02:35: To have the provider enforce the MFA, select Provider

02:39: enforces MFA option.

02:42: To have the user opt in, select User can opt in to MFA option .

02:48: Canvas

02:48: enforces MFA is functionally equivalent to the legacy UIs checkbox for MFA Required

02:53: being enabled;

02:54: any accounts that previously had the legacy MFA Required checkbox enabled

02:59: have this option selected.

03:02: To configure the Multi-Factor Authentication (MFA) settings, ensure that this feature

03:07: is first set to Required or Required for Admins within Account Settings.

03:12: To have Canvas enforce the MFA, select the Canvas

03:16: enforces MFA option. To have SMS carriers send one-time passcodes, click the Send one-time

03:23: passcodes via SMS (US carriers only) checkbox.

03:28: To have the provider enforce the MFA, select Provider

03:32: enforces MFA option.

03:35: To have the user opt in, select User can opt in to MFA option .

03:41: To change the position of your authentication providers, click the Position menu

03:45: and choose the placement number for the new position. Positions affect the

03:50: Discovery URL when an account has configured SSO Settings.

03:55: To delete the provider, click the Delete button.

03:58: If you are using SAML authentication, you can manually refresh SAML metadata by

04:03: clicking the Refresh Metadata button.

04:06: To remove all previously configured authentication providers, click the Remove

04:10: Authentication button.

04:12: Removing all authentication methods may affect your students' ability to log in to

04:17: Canvas.

04:18: To confirm, click the OK button.

04:22: This guide covered How do to configure third-party authentication providers for

04:27: a Canvas account.

Open Account

Global Navigation with the Admin link and an account name highlighted.

In Global Navigation, click the Admin link [1], then click the name of the account [2].

Open Authentication

Account Navigation menu with the Authentication link highlighted.

In Account Navigation, click the Authentication link.

Choose Provider

Authentication drop-down menu with an authentication service selected.

In the Authentication drop-down menu, select an authentication service.

Note: If your account is part of an established trust account, you can select Trusted Canvas instance from the Identity Provider drop-down menu.

Save Provider Data

Authentication provider configuration form with the provider data fields and the Just in Time Provisioning checkbox highlighted.

Enter the data required by the service [1]. Some providers require custom components for configuration.

To enable Just in Time Provisioning, click the Just in Time Provisioning checkbox [2].

Set Federated Attributes

Federated Attributes section with the Canvas provider attribute drop-down menu and the Add Attribute button highlighted.

To use a federated attribute, select a Canvas provider attribute in the drop-down menu [1]. This is the attribute that you want to use in Canvas. Available attributes include admin roles, display name, email, given name, integration ID, locale, name, sis user ID, sortable name, surname, and time zone.

Click the Add Attribute button [2].

Provider Attribute drop-down menu with the attribute value, Autoconfirm checkbox, and Delete icon highlighted.

In the Provider Attribute drop-down menu, choose the attribute value that will match the selected Canvas attribute [1]. Available values include email, family name, given name, locale, name, and sub (subject identifier—a user ID commonly used with Google, and Microsoft specifications).

Note that not all values will exactly match the Canvas attribute. For instance, if you set email as an attribute in Canvas, the provider attribute value options also include email, meaning that the email address from the provider will also be updated for the email address in Canvas. However, some Canvas attributes may not align with the available provider attribute values.

To enable automatic confirmation of email address, click the Autoconfirm checkbox [2].

To remove the attribute, click the Delete icon [3].

Require Multi-Factor Authentication

MFA Required section with the MFA enforcement options and SMS passcode setting highlighted. More information in the step text.

Canvas enforces MFA is functionally equivalent to the legacy UIs checkbox for MFA Required being enabled; any accounts that previously had the legacy MFA Required checkbox enabled have this option selected.

To configure the Multi-Factor Authentication (MFA) settings, ensure that this feature is first set to Required or Required for Admins within Account Settings.

To have Canvas enforce the MFA, select the Canvas enforces MFA option [1]. To have SMS carriers send one-time passcodes, click the Send one-time passcodes via SMS (US carriers only) checkbox [2].

To have the provider enforce the MFA, select Provider enforces MFA option [3].

To have the user opt in, select User can opt in to MFA option [4].

Note: Your institution's Customer Success Manager can set MFA to the following: Disabled, Optional, Required for Admins, or Required.

Save Data

Authentication provider configuration form with the Save button highlighted.

Click the Save button.

Manage Provider

Saved authentication provider with the Position menu and the Delete button highlighted.

To change the position of your authentication providers, click the Position menu [1] and choose the placement number for the new position. Positions affect the Discovery URL when an account has configured SSO Settings.

To delete the provider, click the Delete button [2].

Manage SAML Authentication

SAML authentication provider with the Refresh Metadata button highlighted.

If you are using SAML authentication, you can manually refresh SAML metadata by clicking the Refresh Metadata button.

Remove Authentication

Authentication Settings with the Remove Authentication button highlighted.

To remove all previously configured authentication providers, click the Remove Authentication button.

Note: The remove button does not affect SSO Settings or Canvas authentication.

Confirm Removal

Confirmation dialog with the OK button highlighted for removing all authentication providers.

Removing all authentication methods may affect your students' ability to log in to Canvas. To confirm, click the OK button.

Help make the guides even better!

Have a suggestion, spot a typo, or notice something outdated? Sign in and let us know!

Sign In

Child Item

Canvas LMS Admin Guide

Still have a question about this topic? Ask the Community!

Ask a Question