nopCommerce OAuth Single Sign-On (SSO) with Cognito as OAuth Provider

nopCommerce OAuth Single Sign-On (SSO) module gives the ability to enable OAuth Single Sign-On for your nopCommerce store or site. Using Single Sign-On you can use only one password to access your nopCommerce store or site and services. Our module is compatible with all the OAuth-compliant identity providers. Here we will go through a step-by-step guide to configure Single Sign-On (SSO) between nopCommerce and Cognito considering Cognito as OAuth Provider.

Pre-requisites: Download and Installation

• Download the nopCommerce OAuth Single Sign-On (SSO) module.
• To install the plugin, login as admin into your nopCommerce site or store. In the admin dashboard, navigate to Configuration Tab >> Local plugins.
• On the top right corner of the page select the Upload plugin or theme button to upload the downloaded plugin zip. Follow the instructions further to install the plugin.

Steps to configure nopCommerce OAuth Single Sign-On (SSO) using Cognito as OAuth Provider

1. Configure Amazon Cognito as IDP

• Go to Amazon Console and sign up/login in your account to Configure Amazon Cognito.

• Search for Cognito in the AWS Services search bar as shown below.

• Click on Create a user pool to create a new user pool.

• Choose the attributes in your user pool to be used during the sign-in process

• Set up a strong password to configure your security requirements. Go ahead with the ‘No MFA’ option if you want users to only sign in with a single authentication factor. If you wish to enable MFA (Multi-factor authentication) it will require SMS messages which are charged separately by Amazon SNS. Learn more about that here. Click Next.

• Configure attributes that would be required during the user sign-up flow.

• Choose additional attributes if you wish to. Click Next.

• Configure how your user pool sends email messages to users.

• Enter a name for your user pool, Also Under Hosted authentication pages, check ‘Use the Cognito Hosted UI’.

• Now, Under the Domain section choose the domain type as ‘Use a Cognito domain’. Enter a domain name for your Cognito app.

• Under the Initial app client section, Enter a name for your app client and check on Generate a client secret.

• Now enter your Callback/Redirect URL which you will get from your miniOrange plugin present on your Client side and paste it under the Allowed callback URLs text-field. Also refer the following image for choosing the authentication flows for your app.

• Now, Under Advanced app client settings. Select Identity provider as Cognito user pool & Select Authorization code grant under the OAuth 2.0 grant types and also select openid, email and profile checkboxes under the OpenID Connect scopes section (Please refer to the image below). Click on the Next button to save your configurations.

• Now, review your selection of requirements. Click Create user pool to confirm the selection and create a user pool.

• After successfully creating your user pool, Select your pool name from the list of pools to start with user creation.

• Go to the Users tab, and click Create user.

• Enter details such as username, email address & password. Click on Create user to save the details.

• After the successful creation of the user, you will need a copy of the Cognito domain, Client ID, and Client Secret. Go to the 'App Integration' section and copy the complete domain name {your domain name}.auth.{region name}.amazoncognito.com. This should be entered into the endpoints field under in the miniOrange nopCommerce OAuth plugin.

• To get the Client ID and Client Secret, stay on the same 'App Integration' tab and scroll down to the 'App clients and analytics' section. Click on your App client name to see the Client ID and Client Secret.

You have successfully configured Cognito as OAuth Server (identity provider) for achieving SSO login into your nopCommerce store or application.

2. Configure nopCommerce as SP

• Under the Configure OAuth/OIDC tab, select AWS Cognito from the list of identity providers shown below

• When you are done configuring your identity provider, you will get client ID, client secret and all required authentication endpoints.
• Copy the Redirect/Callback URL from the plugin and provide it to your identity provider to configure it on their side.
• Fill the rest acquired details into the corresponding fields shown below:
• Click on Save.
• Note: Please make sure the Enable SSO checkbox is ticked.

• Please refer the below table for configuring the scope & endpoints for Amazon Cognito in the plugin.

  App Name	cognito
  Authorize Endpoint:	https://<cognito-app-domain>/oauth2/authorize
  Access Token Endpoint:	https://<cognito-app-domain>/oauth2/token
  Get User Info Endpoint:	https://<cognito-app-domain>/oauth2/userInfo
  Custom redirect URL after logout:[optional]	https://<cognito-app-domain>/logout?client_id=<Client-ID>&logout_uri=<Sign out URL configured in Cognito Portal>

3. Testing OAuth SSO

• Click on Test Configuration to verify if you have configured the plugin correctly.
• On successful configuration, you will get attributes name and attribute values in the test configuration window.

4. Attribute Mapping

• Under Attribute/Role Mapping tab, map the attribute names provided by your identity provider with your nopcommerce store attributes.
• Click on Save button.

5. Adding SSO link for your nopCommerce store

• Under the Redirection & SSO Link tab, use the URL labelled as Your Store SSO Link in your store to initiate the SSO.

You can even configure the Umbraco SAML Single Sign-On (SSO) module with any identity provider such as ADFS, Azure AD, Bitium, Centrify, G Suite, JBoss Keycloak, Okta, OneLogin, Salesforce, Cognito, OpenAM, Oracle, PingFederate, PingOne, RSA SecureID, Shibboleth-2, Shibboleth-3, SimpleSAML, WSO2 or even with your own custom identity provider. To check other identity providers, click here.

Additional Resources

• nopCommerce OAuth Single Sign-On (SSO)
• Web3 Login & NFT Gating for nopCommerce Applications
• ASP.NET SAML Single Sign-On (SSO)
• ASP.NET OAuth Single Sign-On (SSO)
• DNN OAuth Single Sign-On (SSO)
• DNN REST API Authentication
• Kentico SAML Single Sign-On (SSO)