[ARCHIVED] Non-existent users can now be enrolled in courses

[fosterl]

Hi Admins! I just noticed a disconcerting change, which I think first appeared after the Jan. 9 update.

We do not allow anyone in Canvas to use the +People button, except for a very specific role, and Admins. I use it fairly frequently to add students to a new term course site where they need to finish an incomplete. Previously, if I made a typo in the email address, like fotserl@oregonstate.edu instead of fosterl@oregonstate.edu, I would get an error message telling me the user did not exist. Now I can type in any email/login and get "Validated and ready to add 1 user". I am dreaming that this used to generate an error (like it still does for the non-admin role)? The enrollment in the course gets created (as invited), but no user gets created.

Canvas support says this is the expected behaviour for admins.

[powellj]

I remember seeing this as far back as Summer 2014 when we first started looking into Canvas. I did it once early on and had the same thing happen. It's happened on occasion since then, but now I catch myself before I complete the process. I honestly don't recall ever seeing that error message though?

[fosterl]

Jacci, thanks for responding. I guess I'm just losing my mind; or I saw that error when masquerading as the non-admin role.

The thing that makes me catch it is the Name box comes up blank when it says the user is validated.

[nlatimer]

I don't ever remember seeing an error, either. It was what you mentioned that would catch it for me...the fact that there is no "Name" filled in to the left of the user's email address on the validation screen.

[millerjm]

Hi Lindy,

How do you lock down the ability for non-admins to access the +People button?

We haven't had much luck with that - the JS override only works sometimes and we had to give instructors the right to add students in permissions in order to give them access to the "View Prior Enrollments" screen, so we are stuck relying on the JS override, which isn't very secure or reliable. 

Joni

[fosterl]

It's just the Permission to Add/remove other teachers and Add/remove students, but as you say, it prohibits teachers from seeing Prior Enrollments too.

[millerjm]

ahh, yes, and due to financial aid reporting, we have to leave Prior Enrollments on...thanks for the reply!

[kona]

To get around this we allow financial aid to view/print an Assignment submission report for every student that uses Canvas - Assignment Submissions Report Programming. This cut down on faculty needing to see concluded student enrollments through People. Faculty can still access concluded enrollments via the Grades tab though, so it all seems to work (without allowing faculty the ability to Add/remove students).

[millerjm]

Thanks, Kona!  I'll have to check this out!

[reedt]

My campus just became aware of this issue as well and have a hard time believing it's been there the whole time. A few weeks ago we started finding incomplete user account profiles in the system. They had email address for the name and email field and everything else was blank. We corrected them as we found them, but only identified how they were being created this week. In an effort to reduce this from happening on a broad scale, we have turned off the Course Role permissions: Add/remove other teachers, course designers or TAs to the course, and Add/remove students for the course for Teachers, TAs, and Designers. However, we would prefer that this ability to "invite a user to create an account through the Add People button" be controlled in the Permissions. I can understand that this functionality is a convenience for some, but it's problematic for us. This feature opens up the possibility of a user having multiple accounts in the system, and possibly multiple enrollments in a course - one official enrollment via SSO and SIS Import, and one or more unofficial enrollment(s) with a personal email address. This is a mess.

[Robbie_Grant]

 @fosterl ,

We are giving the Canvas Admins area a little bit of love (especially questions that are really, really old) and just want to check in with you.  This will also bring this question new attention. 

Were you able to find an answer to your question? I am going to go ahead and mark this question as answered because there hasn't been any more activity in a while so I assume that you have the information that you need. If you still have a question about this or if you have information that you would like to share with the community, by all means, please do come back and leave a comment.  Also, if this question has been answered by one of the previous replies, please feel free to mark that answer as correct.

Robbie