Skip to content

Use several sign-in providers

Canvus Server 26.11.1 and later can offer up to five single sign-on providers at the same time, for example Microsoft for your staff and Google for a partner organisation. You manage them in Admin > Authentication. The login page shows one button for each provider that is turned on.

Guides for each provider type:

How the list works

Admin > Authentication has a Sign-in providers list. Each provider is a card that shows its name, On or Off, its type and a status line.

  • Add provider adds a provider. It asks Which kind of provider? and offers Microsoft Entra ID, Google Workspace and Other OpenID Connect provider. The server can have five providers. When it has five, the button is off and its tooltip reads This server already has five providers. Remove one first.
  • Edit opens the provider's form. Close closes it. A provider's type cannot be changed. To use another type, remove the provider and add a new one.
  • The arrow buttons on a card move the provider up or down. The order of the list is the order of the buttons on the login page.
  • Remove removes the provider after you confirm.

Turn a provider off

Open the provider with Edit, clear Offer this provider on the sign-in page and select Save. The provider stays in the list with the status Not offered on the sign-in page. and its button disappears from the login page. Its settings are kept.

Remove a provider

Select Remove on the card and confirm. The confirmation reads People who signed in with it keep their Canvus accounts but can no longer sign in this way.

  • Users keep their Canvus accounts, canvases and permissions.
  • They cannot sign in through the removed provider. If they have a password, they can still use it.
  • If you add the same provider again later (same issuer), the users sign in as before. Canvus keeps the link between the person and the provider.

The shared Network section

The Network section below the list applies to every provider. It holds Outbound proxy URL, Trusted proxies and Extra root CA certificates (PEM). See Behind a proxy or with an internal certificate authority.

It has its own button, Save network settings, and its own message, Network settings saved. Saving a provider does not save the Network section, and saving the Network section does not save a provider.

To test network settings before you save them, type them in the Network section and select Test connection on a provider. The test uses the values you typed. The provider form says so: "Uses the proxy and certificate settings shown below, even if they are not saved yet."

The redirect address

Every provider uses the same redirect address, shown in the Redirect URI field at the bottom of the page. Add it to each provider's app registration.

Entries that could not be read

If the settings file has a provider entry that Canvus cannot read, a banner appears above the list: 1 provider entry in the settings file could not be read. It counts towards the limit of five. With several entries it reads <n> provider entries in the settings file could not be read. They count towards the limit of five.

An entry that cannot be read is not in use. It still takes one of the five places. Each one is listed by name (or entry <number> when it has no name) with a Remove button. The confirmation reads This entry in the settings file could not be read, so it is not in use. Removing it frees its place.

What to do: if you do not recognise the entry, select Remove. If you need that provider, remove the entry and add the provider again with Add provider.

How accounts are matched

When someone signs in for the first time through a provider, Canvus finds their account in this order:

  1. By the provider's own user ID for that person. If this person has signed in through this provider before, that is their account.
  2. By e-mail address, on the first sign-in only. If a Canvus account has the same e-mail address, Canvus links the person to it. The comparison ignores upper and lower case.
  3. Otherwise Canvus creates a new account, but only if Allow new accounts is on and the other rules of the server allow it. See What happens on first sign-in.

The consequence: a provider can sign a person in to an existing Canvus account just by vouching for that person's e-mail address. Two providers that both vouch for the same address both reach the same account. Only enable providers that you trust to vouch for an e-mail address. For Google Workspace, Canvus also checks the organisation domain. For other OpenID Connect providers, use Allowed e-mail domains and keep Require a verified e-mail address on. See The form fields.

If you set up sign-in on a 26.11.1 preview build

  • An existing Microsoft set-up keeps working. Nothing changes in Microsoft Entra. It appears as the first provider in the list.
  • Canvus converts the settings file the first time you save settings in Admin > Authentication. Before it does, it keeps a copy of the old file as sso-config.v1.json in the same folder as sso-config.json.
  • A generic provider that had no Require a verified e-mail address setting keeps its old behaviour, with the switch off.
  • The folder depends on how you installed Canvus. Where the settings are stored lists it for the container, the Linux .deb package and Windows. File locations lists the other server folders.
  • A provider of the type Other OpenID Connect provider that points at Google must be removed and added again as Google Workspace. See Set up single sign-on with Google Workspace.

To return to an earlier preview build, copy sso-config.v1.json over sso-config.json in the same folder and restart the server before you open Admin > Authentication. Providers that you added later are not in the old file.