Overview

Businesses operating multiple storefronts within a single nopCommerce application may need customers, employees, and business partners to access more than one store. Managing authentication across these storefronts can become complicated when users encounter separate login experiences or administrators need to configure authentication for individual stores.

nopCommerce Multi-Store Single Sign-On (SSO) enables organizations to authenticate users across multiple storefronts through a compatible external Identity Provider (IdP). By configuring SSO for the relevant substores, businesses can simplify authentication, reduce the need for separate store-specific credentials, and streamline authentication management across their nopCommerce environment.

Prerequisites

The organization operates multiple stores within a single nopCommerce application. These stores may serve different customer groups, business units, or commercial requirements, while some users need access to more than one storefront.

The organization wants to integrate its nopCommerce stores with a compatible external IdP so users can authenticate using their existing identity provider credentials. The SSO implementation must use an authentication protocol supported by both the selected IdP and the miniOrange nopCommerce SSO plugin, such as OAuth 2.0 or SAML 2.0.

Administrators need to activate the SSO license for the main store and enable SSO for the relevant additional stores. Where role-based access control is required, administrators may also need to configure identity and role mappings according to the plugin's supported capabilities.

The Challenge

Business Challenges

• Fragmented login experience: Users accessing multiple storefronts may encounter repeated authentication prompts, disrupting their workflows and making access less convenient.
• Increased administrative effort: Maintaining SSO configurations across multiple stores requires administrators to coordinate authentication settings for each relevant storefront.
• Inconsistent access requirements: Different storefronts may require different resource restrictions based on users' roles and responsibilities.
• Growing management complexity: As organizations add more storefronts, maintaining consistent authentication and access policies across the nopCommerce environment becomes increasingly challenging.
• Reduced user productivity: Repeated authentication steps can slow down employees and business partners who regularly access multiple stores.

Technical Challenges

• Store-specific SSO configuration: Administrators need to configure authentication settings for the relevant substores.
• Identity provider compatibility: The selected SSO module must support the authentication protocol used by the organization's IdP.
• Role-based access management: Organizations need to map identity provider roles to nopCommerce roles when access to specific resources must be restricted.
• Configuration consistency: SSO settings across the storefronts must align with the organization's authentication and access requirements.

Our Solution

miniOrange provides OAuth 2.0 and SAML 2.0 SSO modules for nopCommerce, enabling authentication through compatible external identity providers. The solution supports multi-store SSO within a single nopCommerce application, allowing administrators to activate the license for the main store and enable SSO for the substores where it is required.

Single Sign-On Across Multiple Stores

The miniOrange nopCommerce SSO solution enables users to authenticate through a compatible Identity Provider and access multiple SSO-enabled storefronts without maintaining separate credentials for each store.

When a user accesses another enabled storefront, the store initiates its configured SSO flow. If the user's IdP session is still active, the IdP may authenticate the user without requiring them to enter their credentials again, subject to the IdP's session settings and authentication policies. Each storefront must establish its own authenticated session when the user accesses it.

Store-Specific SSO Configuration

The solution supports managing SSO settings for individual substores within a nopCommerce application. Administrators can configure the relevant authentication settings for each storefront according to the selected SSO protocol and identity provider.

This capability helps organizations manage authentication across multiple storefronts while accounting for their individual configuration requirements.

Role Mapping for Store Access

The miniOrange OAuth and SAML SSO modules support mapping identity provider roles to nopCommerce roles and restricting resources to specified roles.

Administrators can use these mappings to align access restrictions with users' assigned roles. This helps organizations apply role-based access requirements to the relevant resources within their nopCommerce environment.

User Journey: How SSO Works Across Multiple nopCommerce Stores

Meet Emily, a regional sales manager who regularly accesses three storefronts operated by her organization: the retail store, the wholesale store, and a regional store. Each storefront serves a different business requirement, but Emily uses the same corporate identity to authenticate.

The organization uses the miniOrange nopCommerce SSO solution to integrate its stores with a compatible external Identity Provider (IdP). After activating the license for the main store, the administrator enables SSO for the relevant additional stores and configures the appropriate OAuth 2.0 or SAML 2.0 integration.

Here's how Emily accesses the different stores.

1. Logging Into the First Store (Retail Store)

Emily begins her workday by visiting the retail store and selecting the configured SSO login option.

Authentication Flow:

• The retail store initiates the configured SSO authentication flow.
• Emily is redirected to the organization's identity provider.
• She authenticates using her corporate credentials, subject to the IdP's authentication policies.
• The identity provider returns the authentication response through the configured SSO protocol.
• The SSO module processes the response and establishes Emily's login session in the retail store.

Outcome:

Emily can access the retail store using her corporate identity without maintaining a separate set of credentials specifically for that storefront.

2. Accessing the Second Store (Wholesale Store)

Later, Emily visits the wholesale store to review information available to her there. Since SSO is enabled for this store, she can use the same corporate identity to authenticate.

Authentication Flow:

• Emily selects the SSO login option configured for the wholesale store.
• The wholesale store initiates authentication using its configured SSO settings.
• The request is handled through the organization's identity provider.
• If Emily's IdP session is still active and the provider's policies permit it, she may be authenticated without entering her credentials again. Otherwise, she completes the required authentication steps.
• The SSO module processes the authentication response and establishes her login session in the wholesale store.

Outcome:

Emily can access the wholesale store using the same corporate identity. The wholesale store maintains its own SSO configuration, and its login session is established through the configured authentication flow.

3. Accessing the Third Store (Regional Store)

Emily subsequently visits the regional store to complete a task specific to that storefront. The administrator has also enabled SSO for this store.

Authentication Flow:

• Emily selects the SSO login option configured for the regional store.
• The regional store initiates authentication through the identity provider using its configured SSO settings.
• If the IdP session remains active and its authentication policies allow it, Emily can complete the flow without re-entering her credentials. Otherwise, she follows the required authentication steps.
• The SSO module processes the authentication response and establishes her login session in the regional store.

Outcome:

Emily can access the regional store using the same corporate identity as the other storefronts. Each store maintains its own SSO configuration, while the identity provider provides a common authentication mechanism.

Key Behavior

• Single set of credentials: Users can authenticate across multiple configured nopCommerce stores using the same identity provider credentials.
• Substore-level configuration: Administrators can manage SSO settings for individual substores.
• Protocol compatibility: Organizations can select the OAuth 2.0 or SAML 2.0 module according to their identity provider's supported protocol.
• Role mapping: Administrators can map identity provider roles to nopCommerce roles and restrict access to specified resources.

Benefits

• Simplified store access: Users can access multiple storefronts without maintaining separate credentials for each store.
• Reduced authentication complexity: A common identity provider can support authentication across the organization's configured storefronts.
• Role-based access restrictions: Role mapping helps administrators align resource access with users' assigned roles.
• Store-specific configuration management: Administrators can configure SSO settings for individual substores.
• Support for business growth: Organizations can extend their multi-store SSO implementation as their storefront requirements evolve.

Result

Implementing multi-store SSO in nopCommerce helps organizations simplify authentication across multiple storefronts while allowing administrators to maintain store-specific SSO configurations.

By integrating the appropriate SSO module with a compatible identity provider and configuring role mappings where required, businesses can provide a more consistent authentication experience and manage access requirements across their nopCommerce environment.

Additional Resources

1. nopCommerce 2FA
2. nopCommerce SAML SSO
3. nopCommerce Oauth SSO

We'll Reach Out to You at the Earliest

Enter your email * Write your Query * Submit

 Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again