⚠️ For info on SSO authentication integrations like
Okta, Microsoft Entra ID, OneLogin, etc, click here ⚠️
Overview
Automatically authenticate your users to provide a seamless feedback experience when using a Canny widget. Canny offers two primary options for user authentication:
The Canny Identify SDK for automatic background authentication and
Single Sign-On (SSO) for direct user login.
We also recommend setting up an SSO redirect to authenticate unidentified users.
Benefits
Remove hurdles for users who just want to leave feedback
Ensure you're hearing from the right people
Make Canny feel native to your product
Regular testing of authentication flows to identify and resolve potential issues
Ensuring SDK and SSO configurations follow the latest security standards
SSO for Widgets
With SSO enabled, a user will not have to log into Canny or identify themselves. They'll just be able to click and leave feedback.
SSO Redirects
Send a user to your site for authentication before routing them back to Canny to participate, after you have identified them. This method enhances the user experience by keeping them within your website's interface while ensuring secure authentication through your backend system.
Implementing SSO for widgets
1. The first step is to install the web widget into your product.
2. Once that's complete, you can follow the steps here. You'll need to:
a. Install a JWT library
b. Generate tokens on your server
c. Validate your SSO Token
3. Lastly, go to the Boards tab in your Canny settings and select Widget to add the URL where you're embedding the Canny widget:
Canny will also send users to that URL when they click on messages from Canny.
Resolving Issues with SSO Setup
If SSO is not correctly set up, it may lead to errors when submitting feedback or accessing features. Here are steps to troubleshoot SSO setup issues:
Verify the SSO Configuration: Request your technical team to review the current SSO setup to ensure it is passing correct user data to Canny.
Consult Official Documentation: Review Canny’s SSO setup guide at developers.canny.io/install/widget/sso for detailed steps and best practices.
NOTE: When an SSO token is generated, an optional exp (expiration) field can be included to expire the token at a set time.
FAQs
Q: What are the main benefits of using the Identify SDK over SSO?
A: The Identify SDK enables behind-the-scenes automatic authentication, while SSO is used for explicit in-page logins.
Q: Can these two methods be combined?
A: Yes, you can integrate both methods to address different user interactions and scenarios effectively.
Best Practices for Authentication
Test authentication flows regularly to identify and resolve potential issues.
Provide clear user guidance if errors occur during the authentication process.
Regularly update SDK and SSO configurations to align with security best practices.
Verify the SSO configuration regularly by having your technical team review the setup to ensure correct user data is passed and integration remains seamless.