Overview

Organizations operating nopCommerce stores may serve employees, customers, suppliers, and business partners who authenticate through different identity providers (IdPs). Requiring every user group to rely on the same identity provider can complicate access management, particularly when external partners and customers already use authentication systems managed by their own organizations.

This use case demonstrates how miniOrange Single Sign-On (SSO) for nopCommerce supports authentication through multiple identity providers within the same store environment. Organizations can configure the appropriate providers for their user groups, accommodate existing identity systems, and map identity provider roles to nopCommerce roles where access restrictions are required.

Prerequisites

The organization operates a nopCommerce store accessed by multiple user groups, such as employees, customers, suppliers, and external business partners. These groups may authenticate through different identity providers.

The organization needs to integrate multiple compatible Identity Providers (IdPs) with its nopCommerce environment using the miniOrange SSO solution. Each IdP must support the authentication protocol used for its integration, such as OAuth 2.0 or SAML 2.0, as supported by the selected miniOrange plugin.

Where access to specific nopCommerce resources depends on a user's role, administrators must also identify the relevant identity provider attributes or roles and configure the corresponding role mappings and resource restrictions.

The Challenge

Business Challenges

• Different authentication requirements: Employees, suppliers, customers, and business partners may already use different identity providers.
• Inconsistent login experiences: Users may struggle to identify the correct login option when the store does not accommodate their existing authentication systems.
• Complex partner access: Providing store access to external organizations can require coordination around their respective identity providers.
• Growing integration requirements: Adding new partners or user groups can increase the number of identity provider integrations that administrators need to configure and maintain.
• Access management overhead: Administrators must account for the roles and resource access requirements associated with users authenticated through different identity providers.

Technical Challenges

• Multiple identity provider integrations: The nopCommerce SSO implementation must support authentication through the required identity providers.
• Protocol compatibility: Each provider must be compatible with the selected SSO module, whether it uses OAuth 2.0 or SAML 2.0.
• Role mapping: Identity provider roles must be mapped to the corresponding nopCommerce roles when access depends on user roles.
• Provider-specific configuration: Each identity provider requires the appropriate configuration for authentication to work with the nopCommerce store.

Our Solution

miniOrange provides OAuth 2.0 and SAML 2.0 SSO modules for nopCommerce, with support for multiple identity providers. Organizations can configure the providers required by their user groups and use role mapping and resource restrictions to align store access with their requirements.

1. Multiple Identity Provider Support

The miniOrange nopCommerce OAuth and SAML SSO plugins support integrations with a range of identity providers. OAuth integrations include Microsoft Entra ID (formerly Azure AD), ADFS, Microsoft Office 365, Google, Okta, Salesforce, Auth0, and Amazon Cognito. The SAML plugin also supports integrations with providers such as Microsoft Entra ID, ADFS, Office 365, Google, Okta, Keycloak, and Auth0.

This capability allows an organization to accommodate user groups that authenticate through different identity systems. For example, employees may use Microsoft Entra ID, while suppliers authenticate through Okta. Each identity provider must be configured with the appropriate SSO module and protocol.

2. Role Mapping and Access Restrictions

Authentication establishes a user's identity, but organizations may also need to control which nopCommerce resources that user can access.

The miniOrange OAuth and SAML SSO modules support mapping identity provider roles to nopCommerce roles and restricting resources to specific roles. Administrators can configure these mappings to align the roles received from an identity provider with the roles used to manage access in nopCommerce.

For example, an organization may map roles assigned to internal employees and external suppliers to their corresponding nopCommerce roles. Resource restrictions can then be configured according to the access each role requires.

The resulting permissions depend on the role mappings and resource restrictions configured for the integration.

User Journey: How Multi-IDP SSO Works in a nopCommerce Store

Consider a business that operates a nopCommerce store accessed by employees, suppliers, and external business partners. Each group uses a different identity provider, and the store has been configured to support the required providers through its SSO integration.

The following examples illustrate how each group can authenticate through its configured identity provider.

1. Employee Login Through Microsoft Entra ID

An employee visits the nopCommerce store and selects the configured Microsoft Entra ID login option.

Authentication Flow:

• The employee initiates SSO using the configured login option.
• The nopCommerce SSO integration directs the authentication request to Microsoft Entra ID.
• The employee authenticates through Microsoft Entra ID according to the identity provider's configured authentication requirements.
• The SSO module processes the authentication response and establishes the employee's nopCommerce login.

Outcome:

The employee can access the nopCommerce store through the configured Microsoft Entra ID integration. If role mapping and resource restrictions are configured, the employee's mapped nopCommerce role determines access to the resources covered by those restrictions.

2. Supplier Login Through Okta

An external supplier needs to access the same nopCommerce store but uses Okta as its identity provider.

Authentication Flow:

• The supplier selects the configured Okta login option.
• The nopCommerce SSO integration directs the authentication request to Okta.
• The supplier authenticates through Okta according to the supplier organization's authentication requirements.
• The SSO module processes the authentication response and establishes the supplier's nopCommerce login.

Outcome:

The supplier can authenticate through the configured Okta integration without requiring the supplier organization to adopt the employee identity provider. If role mapping is configured, the supplier's mapped nopCommerce role can be used to restrict access to specified resources.

3. External Partner Login Through Auth0

An external business partner also needs access to the nopCommerce store but authenticates through Auth0.

Authentication Flow:

• The partner selects the configured Auth0 login option.
• The nopCommerce SSO integration directs the authentication request to Auth0.
• The partner authenticates through Auth0 according to the provider's configured authentication requirements.
• The SSO module processes the authentication response and establishes the partner's nopCommerce login.

Outcome:

The partner can authenticate through the configured Auth0 integration. Any role-based resource restrictions depend on the mappings and access rules configured for the partner's account.

Result

With multi-IDP SSO configured for nopCommerce, organizations can accommodate users who authenticate through different identity providers within the same store environment.

The solution supports:

• Authentication through multiple configured identity providers.
• Integration with compatible OAuth 2.0 or SAML 2.0 identity providers.
• Mapping identity provider roles to nopCommerce roles.
• Restricting access to specified resources based on mapped roles.

This approach helps organizations accommodate different identity systems while managing authentication and role-based resource access within their nopCommerce environment.

Additional Resources

1. nopCommerce 2FA
2. nopCommerce SAML SSO
3. nopCommerce Oauth SSO

We'll Reach Out to You at the Earliest

Enter your email * Write your Query * Submit

 Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again