Canvas Login Frustrations Are Real
I spent about three hours last fall debugging why my students couldn't authenticate through our UNT instance during the first week of classes. Two dozen emails, four phone calls to the ITS help desk, and one confused department head who insisted the problem was "with the new system" turns out it was an expired certificate on the SAML service provider side. It happens. Usually less dramatically, but often enough that you learn the patterns. The login flow for UNT Canvas goes through Shibboleth first, which acts as the identity provider handling authentication before Canvas receives your credentials back. You hit canvas.unt.edu, get redirected to login.unt.edu, enter your EUID and password, and then get bounced back into Canvas with a valid session token. That is the happy path. Here is what usually breaks it. The most common failure point I see is cached credentials colliding with a password reset. If you changed your password recently through the myUNT portal and then try to access Canvas on a browser where you previously authenticated, the old session token gets rejected and you end up in a redirect loop between Canvas and Shibboleth. The workaround is straightforward but nobody remembers it: clear all cookies for both canvas.unt.edu and login.unt.edu in the same session. I used to tell people to just use incognito mode as a quick test, but that only masks the problem rather than solving it. Clearing the cookies from both domains simultaneously is what actually resolves the loop. Doing it from one domain while leaving the other intact won't help because the stale token lives across both.
Another issue that drives people crazy is the "invalid session" error that appears when you're working through an institutional VPN. Our VPN routes traffic through a different egress point than campus WiFi, and Canvas sometimes flags the IP mismatch as a security anomaly, especially during high-latency periods. The fix is switching to the campus network or disabling the VPN temporarily while you log in. Once you're in, you can reconnect the VPN without losing your session. For mobile users, the situation is messier. The Canvas Student and Teacher apps do not support SSO through the standard Shibboleth flow the way the web version does. I had a professor try to use the app for an entire semester because she preferred the offline access, and she was stuck in a perpetual login state every time she needed to post an assignment. The mobile app requires you to add your institution manually and then authenticate, which under our setup often fails silently because the app doesn't handle the Shibboleth redirect properly. She ended up using the mobile browser version instead, which works identically to desktop and supports the full SSO chain. There is also a known timeout issue during peak registration weeks. Canvas authentication responses from Shibboleth can take up to 45 seconds under heavy load, and browsers will sometimes abort the connection before the token returns, showing a generic "authentication failed" message that points everyone at the help desk. This is not a client-side problem. It is the identity provider queueing requests. The workaround is to avoid logging in during the first 48 hours of any major term start and to check the UNT ITS status page for known incidents before wasting time troubleshooting.
For IT staff managing this internally, the Shibboleth logs at /var/log/shibd/shibd.log are where you should look first. A status code of 200 means the authentication succeeded but Canvas may have rejected the assertion. Status 401 or 403 at the Shibboleth level means the EUID or password was rejected outright, which typically traces back to Active Directory sync issues or a suspended account. I once spent two days chasing a login issue that turned out to be a single student's account being deactivated in AD by a script running from a legacy system nobody remembered was still active. The fix was reactivating the account and having the student clear their browser cookies to refresh the session. One counter-intuitive thing about Canvas SSO that people miss: the logout button in Canvas does not actually terminate your Shibboleth session. You can log out of Canvas and still be authenticated at the identity provider level, which means anyone with access to your computer can open a new Canvas tab and be logged in automatically without re-entering credentials. If you are using a shared machine, you need to explicitly visit login.unt.edu and click sign out from the Shibboleth portal to fully terminate the session. This is by design, not a bug, but it catches a lot of people off guard. The main limitation of this setup is that it depends entirely on the health of the underlying identity infrastructure. If Shibboleth goes down, Canvas goes down with it, and there is no bypass. Unlike some institutions that offer a fallback local authentication method, UNT Canvas requires the SSO chain to complete before any content is accessible. This means during any outage of the identity provider, the correct response is to check the ITS status page and wait rather than repeatedly attempting to log in, which only adds to the queue load.
Get the Full Details
If you are troubleshooting this right now and none of the above resolves it, the most effective next step is to contact the UNT ITS Service Desk with your browser user-agent string, the exact URL you were hitting, and the timestamp of the error. They can pull server-side logs that show exactly where in the authentication chain the failure occurred, which is information you cannot get from the client side alone.
