How to use Shopify as an IDP for single sign-on (SSO)?

Page and Post Restriction for WordPress (WP) banner

Key Features

Single Sign-On (SSO)

Easy and seamless access to all resources. Single Sign-On (SSO) into any SAML2.0, WS-FED or JWT Application using Shopify credentials.

User Attribute Mapping

Allow Service providers to mapped user details directly from Shopify IDP (First Name, Last Name, Phone number, Email id, etc.)

User Groups Mapping

Allows service Providers to map user’s Group from Identity Provider to service provider groups. The user groups are updated on SSO.

Custom Redirect URL

Configure the URL wherever you want to redirect your Single Sign-On users after SSO login or after logout.

Single Logout

When the Shopify IDP session expires, log out the user from all service providers.

Easily Integrate

Easily integrate the login link from your Shopify site using short code for IDP initiated SSO.

SSO is based on a trust relationship between the identity provider and service provider. This secure authentication is based upon a certification that is exchanged between the Shopify identity provider and the service provider you have chosen.

The certificate can be used to sign identity details sent from the Shopify identity provider to the service provider, ensuring that the service provider is receiving it from a reliable source (Shopify IDP). This identity data is stored in Shopify SSO as tokens, which contain identifying details about the user such as an email address or a username, among other things.

Step-by-Step Guide for Configuring Shopify as an Identity Provider (IDP) App

Pre-requisite : Store as IDP- SSO Login Application

To configure SSO into your application with Shopify as IDP, you will need to install the miniOrange Store as IDP- SSO Login Application on your store

Shopify Single Sign-On (SSO) in wordpress oauth provider

Store as IDP- SSO login to Apps

By miniOrange

miniOrange Provides Secure Single Sign-On (SSO) access to your application using Shopify Store as IDP.

Get this application

Step 1: Install and Setup App

Click on Add App in Login with Customer Account application on Shopify App Store.
Click on Install App button at right bottom of screen.
Accept the recurring charges shown by our App. After that you’ll be automatically redirected to the Application home page.
Enter primary domain of your Shopify store in Domain Settings Section of the Application. After that click on Save.

Single Sign-On (SSO)for Shopify (Plus and Non Plus),set your domain

Step 2: Configure Application for enabling Single Sign On

Click on Setup Application in the top left in the navigation bar of Shopify as Identity Provider App. You’ll be redirected to the Add Application menu of miniOrange.

Single Sign-On (SSO)for Shopify (Plus and Non Plus), setup-application

Click on Add Application button.

Single Sign-On (SSO)for Shopify (Plus and Non Plus), configure-apps

Select the protocol which you Application support in which you want to integrate SSO through Shopify as Identity Provider

SAML
OAuth

SAML

Configure Single Sign-On (SSO) Settings for SAML Apps:

Click on the SAML tab and search for your Application. If you can't find your application in the below list then select Custom APP and you can also submit your app request to add the application as a pre-integrated app.

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, Details of SP metadata

Once you select the Custom App option, you will find a window similar to :

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, custom-app

Either you can Copy Paste all the attributes of Service Provider (SP), Or you can directly upload an XML file containing relative information.
To upload the file, follow these steps: Click on Import SP Metadata button

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, import SP metadata

You will get a popup with following options.

Here is the description of what each field means (present on the app configuration window).

SP Entity ID	SP Entity ID is used to identify your app against the SAML request received from SP. Make sure the SP Entity ID or Issuer is in this format: httpss://www.domain-name.com/a/[domain_name]/acs.
ACS URL	Assertion Consumer Service URL defines where the SAML Assertion should be sent after authentication. Make sure the ACS URL is in the format: httpss://www.domain-name.com/a/[domain_name]/acs.
Single Logout URL	Single Logout URL defines where the user should be redirected after receiving the logout request from SP. You can mention your applications logout page URL here. Make sure the Single Logout URL is in the format: httpss://mail.domain-name.com/a/out/tld/?logout.
Audience URI	Audience URI, as the name suggests, specifies the valid audience for SAML Assertion. It is usually the same as SP Entity ID. If Audience URI is not specified separately by SP, leave it blank.
NameID	NameID defines what SP is expecting in the subject element of SAML Assertion. Generally, NameID is Username of Email Address

NameID Format defines the format of subject element content, i.e. NameID. For example, Email Address NameID Format defines that the NameID is in the form of an email address, specifically “addr-spec”. An addr-spec has the form local-part@domain, has no phrase (such as a common name) before it, has no comment (text surrounded in parentheses) after it, and is not surrounded by “<” and “>”. If NameID Format is not externally specified by SP, leave it unspecified.
You can Add Attributes to be sent in SAML Assertion to SP. The attributes include user’s profile attributes such as first name, last name, fullname, username, email, custom profile attributes, and user groups, etc.
The next section on the same window is for adding a policy for your app.

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, add-policy

Select a Group Name as Default for making Shopify as Identity Provider.
Give a policy name for Custom App in Policy Name.
Select the Login Method as Password for using Shopify as Identity Provider
Click on Save button to add a policy for Apps (Single Sign-On).

Configure Service Provider (SP)

From the list of Apps configured, you can locate the app you created, you can see the Metadata option present in front of that specific app.

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, click-on-metadata

Click on the Metadata option, you will get a window similar to:

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, view metdata

If you want to make it quick and easy, click on the Download Metadata button to get XMl file which you can upload while configuring SP.
When you want to make Shopify as the Identity Provider, you have to use different set of URLs listed under "Information required to Authenticate with External IDPs" heading (as shown in the following image)

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, download-metadata

OAuth

Configure Single Sign-On (SSO) Settings for OAuth Apps:

Click on OAuth/OIDC tab. and search for your Application. If you can't find your application in the below list then select Custom OpenID Connect APP and you can also submit your app request to add the application as a pre-integrated app

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, selectapp

You can add any OAuth Client app here to enable Shopify as OAuth Server . Few popular OAuth client apps for single sign-on are Salesforce, WordPress, Joomla, Atlassian, etc.

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, custom-oauth

Enter the Client Name.
Make sure Redirect-URL is in this format https://< mycompany.domain-name.com >.
Add Description if you required.

Single Sign-On (SSO) for Shopify (Plus and Non Plus), SAML SSO, client-id

Click on Save button.

You can edit Application by using the following steps:

Login as a customer from the Admin Console.
Go to Apps >> Manage Apps.
Search for your app and Click on edit in Action menu against your app.
Provide the required settings to your OAuth Client Application in which you want Single Sign On via Shopify As Identity Provider:

Application Name	Enter Application Name
Client Name	Enter Client Name
Client ID	Enter Client ID
OAuth Authorize URL	https://<store.xecurify.com>/moas/broker/login/oauth/<customerid> -Use this endpoint when you want use Shopify as Identity Provider
OAuth Token Endpoint URL	https://<store.xecurify.com>/moas/rest/oauth/token
OAuth User Info Endpoint URL	https://<mycompany.domainname.com>/moas/rest/oauth/getuserinfo

Step 3: Test the Single Sign On

Initiate Single Sign On(SSO) from the configured Application.
It will redirect you to Shopify Store Login Page if user is not already logged in to store .
Enter Your Shopify Store customer credentials .
After Successful authentication you’ll be redirected back to configured Application and you’ll be logged in.