Selective Two-Factor Authentication for External Users

[mmitchell]

Duo and Central Authentication Service (CAS) allow us to enable two-factor authentication selectively for our SIS users but we also need selective two-factor authentication for our external users that login through the side door URL.

2FA isn't the ultimate security measure but institutions that use external accounts for admin purposes would probably appreciate bigger padlocks on the side doors. Not all external users would need 2FA but having the option would be awesome.

This idea has been developed and deployed to Canvas

For more information, please read through the  Canvas Deploy Notes (2021-06-09).

[A00364575]

This probably won't get a lot of votes because it's mostly an admin feature, but that doesn't diminish its importance. This will be a big step for Canvas to continue saying it's the most secure LMS around. Thanks for posting!

[mmitchell]

Thanks for up-voting Neal!

[ahess4]

I think you are talking about 2FA for internally authenticated accounts in canvas. In that case, 2FA is already available in the open source version of canvas (and has been for quite some time - as in years), and it works great. It even works with the Duo app by adding a new account in the app and scanning the 3d barcode. Couldn't be too hard for Instructure to roll this feature into the production version...

I haven't played around with it and Duo/external authentication, yet. So, I'm not sure if set to 'Required', if that will be for internal auth account only, or potentially apply to external auth and Duo (or any other external 2FA setup) - creating a situation where external auth users have two 2FA prompts when they login. In our situation, only admins have internal auth ability, so 'Required for Admins' would work great for us.

The options for it are: Disabled, Optional, Required for Admins, Required.

[mmitchell]

Required for Admins would be an excellent solution. All of our admin accounts would be covered. Thank you for sharing this. The screenshots are perfect.

[Stef_retired]

Comments from Instructure

Canvas Multi-Factor Authentication can be set on a per-authentication-provider basis. This change allows admins to set MFA requirements for individual authentication providers.

For more information, please read through the  Canvas Deploy Notes (2021-06-09).