Connecter Canva à Lutril
Lutril connects to Canva over SCIM 2.0 and reads every user in the team, including the ones who have been deprovisioned, with their role and their state. A grant provisions an account with no password, for single sign on, and the deadline deprovisions it. Reinstating somebody is NOT automated, deliberately: Canva documents no call that puts a deprovisioned user back, so Lutril refuses rather than reporting access it cannot verify.
Accès demandés
- The SCIM token is not scope based. It is generated per team and carries whatever SCIM provisioning allows: reading users, creating them, and setting a user inactive.
Étapes de configuration
- 1
Check your plan first, because this is where most Canva connections stop. Canva restricts its SCIM API to Canva Enterprise for a SINGLE team. It is not available for Canva for Teams, and not for a multi team organization. The Connect API is no substitute: its users endpoint returns only the caller, so it cannot enumerate a team at all.
Canva SCIM availability - 2
Open your Canva team settings and go to SSO and provisioning. SCIM hangs off single sign on, so the team needs SAML configured first.
Open Canva team settings - 3
Under SCIM, turn on SCIM user provisioning and copy the access token it generates.
- 4
In Lutril, connect Canva and paste the token.
- 5
Accounts are created without a password. Canva provisions SCIM users for single sign on, so Lutril never generates a password and has nothing to send anyone: the person signs in through your identity provider.
- 6
Canva implements no delete for a SCIM user. The only removal there is sets the user inactive, which is what Lutril does at a deadline, and the account record stays in place.
Deprovisioning a Canva user - 7
Reinstating is where Lutril deliberately stops. Canva documents how to deprovision somebody and nothing about putting them back, and its own error for a soft deleted account says the person has to log in to restore it themselves. So a grant that lands on a deprovisioned account is refused with an explanation rather than reported as granted. Because of that, Canva is excluded from fully unattended provisioning: a human approves, and Lutril still takes the access back on time.
- 8
Canva publishes only two SCIM roles, Member and Brand Designer, and neither is an administrator. There is no privilege ladder for a grant to climb, so Canva access is time boxed on the account rather than on a role.
Où le créer
Documentation officielle
Connectez-vous à Lutril pour brancher Canva, ou réservez une démo et nous le mettons en place avec vous. Sans slides.