Creating a user via the api with a destination parameter to automatically login user

[DavidGeismar2]

I am creating a user through the canvas API and once created I need to redirect my user to the canvas instance and ideally have the user automatically signed in.

Looking at the docs : https://canvas.instructure.com/doc/api/users.html#method.users.create,

I can see that I have to set :

- user[skip_registration] as true

- pseudonym[password] as a random password

- pseudonym[send_confirmation] as true

1) When I do this, the user indeed receives a confirmation informing him that his account was created. However the email does not tell the user what is his password, which is unfortunate. Is there a way to let canvas set a random password for the user and then send that password to the user ? Or if I have to set it myself do I have to do all the work and send an email myself to inform the user of its password ?

Now, the second part of my question. I would like to be able to redirect the newly created user to the canvas instance and I would like the user to be automatically logged in.
Unfortunately I dont think Canvas implements SSO JWT in the same way as an LMS like 360Learning does --> https://support.360learning.com/hc/en-us/articles/209016626-Technical-guide-SSO-JWT

Did I miss something or does canvas actually has some sort of SSO JWT ?

However I noticed in the api doc for "create user" a "destination" parameter. It says :

"If you’re setting the password for the newly created user, you can provide this param with a valid URL pointing into this Canvas installation, and the response will include a destination field that’s a URL that you can redirect a browser to and have the newly created user automatically logged in. The URL is only valid for a short time, and must match the domain this request is directed to, and be for a well-formed path that Canvas can recognize."

Indeed, when I do as such, I get back in the response something like :
{"id"=>663,
"name"=>"JDJ DJDJD",
"created_at"=>"2024-08-20T01:32:46+02:00",
"sortable_name"=>"DJDJD, JDJ",
"short_name"=>"JDJ DJDJD",
"sis_user_id"=>nil,
"integration_id"=>nil,
"sis_import_id"=>nil,
"login_id"=>"dageismar+raarkarkkr@gmail.com",
"locale"=>"en",
"uuid"=>"maX5Qf4Rz67jq1e8DTEeivMZcoFyqoAOhpVtyGOT",
"destination"=>
"https://somedomain.instructure.com/?session_token=somerandomtoken"}

However, when I try to use that destination url, I am always redirected to the login screen and asked for my credentials :(.
Am I missing something here ?

[reynlds]

I followed your process and it worked fine for me in an incognito window. Here is my parameters dict (in python):

params = {"user[skip_registration]":True,
          "pseudonym[password]":"MYPASSWORD",
          "pseudonym[send_confirmation]":False,
          "user[name]":"Mark Test User 444",
          "user[terms_of_use]":True,
          "pseudonym[unique_id]":"marktestuser444",
          "pseudonym[integration_id]":"marktestuser444",
          "pseudonym[authentication_provider_id]":2,
          "destination":"https://MYDOMAIN.beta.instructure.com"}

I tried it with and without the "authentication_provider_id" and got the same results as I was able to use the long URL to successfully enter my Canvas instance one time with it. Attempted reuse of the special URL tossed me out to our general authentication process. Also, I only got the single-use URL when I provided a password parameter, which could be generated on the fly. I also provided my Beta environment URL as the "destination". We primarily authenticate through Azure AD, but do have some service accounts that fall back to the Canvas login if needed.

[DavidGeismar2]

thanks @reynlds, I managed to make it work !
However, this only partly responds to my current need. My process is the following :

1) User registers on third party app and is then logged in in third party app

2) Third party app creates user on canvas through the API

3) there is a link/button in third party app that redirects the user within canvas with the user already logged in

The destination feature is great but the fact that it will work only once is annoying. I would like the navigation between 3rd party app and Canvas to be seemless and the user should not have to reloggin within canvas when it comes from 3rd party app.

With other LMS's I have achieved this using a feature called SSO JWT, described in the following article for example :   https://support.360learning.com/hc/en-us/articles/209016626-Technical-guide-SSO-JWT

Unfortunately it seems that canvas doesnt implement that. Any ideas ?

[reynlds]

I'm not an "LTI guy" but it sounds like a custom LTI integration, or a scoped API deployment with a service user/token, may be your best bet. I always suggest caution in things like this, especially when turning over user or course creation/manipulation to an integration. Best o' luck!