Overview

Businesses operating nopCommerce stores need to provide convenient access to customers, employees, vendors, and administrators while protecting accounts against unauthorized access. When authentication relies on a single factor, compromised credentials can put store accounts and business resources at risk.

This use case demonstrates how organizations can incorporate Single Sign-On (SSO) and Two-Factor Authentication (2FA) into their nopCommerce authentication strategy. SSO enables users to authenticate through a configured external identity provider, while 2FA adds a second verification step to the login flows it protects. The appropriate configuration depends on the authentication methods in use and where additional verification must be enforced.

Prerequisites

The organization operates a nopCommerce store used for customer access, business operations, or administrative activities. Users authenticate through the store's existing login mechanisms, and the organization wants to strengthen authentication while accommodating its identity infrastructure.

The organization requires SSO through a compatible external identity provider. The organization must also identify which user groups require 2FA, which verification methods they can use, and how the second factor will be enforced for each applicable login method.

These requirements should account for the store's authentication architecture, configured security policies, and available fallback methods.

The Challenge

As a nopCommerce store serves more users and business functions, organizations need to strengthen account security without creating unnecessary barriers to access.

Business Challenges

• Exposure to compromised credentials: Accounts relying on a single authentication factor may be vulnerable when credentials are stolen or exposed.
• Different security requirements: Administrators, vendors, registered customers, and other user groups may require different levels of login verification.
• Authentication complexity: Organizations need to introduce additional verification without making the sign-in process unnecessarily difficult.
• Consistent security policies: As the user base grows, administrators need a manageable approach to applying authentication requirements to the appropriate accounts.
• Account recovery: Users need alternative verification methods when their primary second-factor method is unavailable.

Technical Challenges

• Identity provider integration: The store requires a compatible SSO configuration to authenticate users through an external identity provider.
• Additional identity verification: Login flows covered by the organization's security policy must enforce a second authentication factor.
• Targeted 2FA enforcement: Administrators need to configure 2FA for the intended user groups using the criteria supported by the plugin.
• Verification method support: The implementation must provide the authentication methods required by the organization.
• Enforcement across login flows: The authentication design must establish where 2FA is applied, particularly when users sign in through an external identity provider.

Our Solution

miniOrange provides OAuth 2.0 and SAML 2.0 SSO modules and a separate Two-Factor Authentication plugin for nopCommerce. The SSO modules enable identity provider-based authentication, while the 2FA plugin provides additional verification methods for the login flows it protects.

The organization must configure the appropriate SSO and 2FA components for its authentication requirements and verify how second-factor enforcement applies to each login path.

nopCommerce Single Sign-On

The miniOrange OAuth 2.0 and SAML 2.0 SSO modules allow users to authenticate to nopCommerce through compatible external identity providers. Supported integrations include providers such as Microsoft Entra ID (formerly Azure AD), ADFS, Microsoft Office 365, Google, Okta, and Salesforce. The SAML module also lists providers such as Keycloak.

SSO lets users access the nopCommerce store through the configured identity provider. Both modules also support role mapping, allowing administrators to map identity provider roles to nopCommerce roles and restrict resources to specified roles.

This establishes the identity provider-based login path. Any additional verification required for that path must be enforced through a supported configuration.

nopCommerce Two-Factor Authentication (2FA)

The miniOrange nopCommerce 2FA plugin adds a second verification step to the login flows it protects. It provides several authentication methods that organizations can configure according to their security requirements and the features available in their selected plan.

Supported methods include:

• SMS OTP: Users verify their identity using a one-time passcode delivered by SMS.
• Email OTP: Users verify their identity using a one-time passcode delivered by email.
• Authenticator apps: The plugin supports authenticator options such as Google Authenticator, Microsoft Authenticator, and Duo Authenticator.
• Push notifications: Duo Push is available as an additional verification method.

The plugin also supports role-based 2FA for selected user groups, including administrators, vendors, and registered customers. Domain- and IP-based controls provide additional options for configuring when 2FA is required.

Administrators can customize OTP settings and email or SMS templates. Backup options include email OTP, security questions, and backup codes, depending on the configured features.

These capabilities help organizations tailor additional login verification to their user groups and security requirements. The applicable policies and enforcement points must be configured for the login flows the organization intends to protect.

Flow

The authentication sequence depends on the selected login method and the point at which the organization enforces the second factor. The following steps describe the intended authentication process and the checks required to grant access.

1. User Accesses the nopCommerce Store

The user visits the nopCommerce store and initiates the configured login process.

For an SSO login, the miniOrange OAuth 2.0 or SAML 2.0 module directs the authentication request through the configured identity provider.

2. The User Authenticates Through the Identity Provider

For the federated SSO path, the user authenticates through the configured identity provider according to its authentication policies. The SSO module processes the resulting authentication response and establishes the nopCommerce login.

If the organization requires 2FA for this path, it must ensure that the second-factor requirement is enforced through a supported configuration.

3. The Applicable Second-Factor Check Is Completed

For login flows protected by the miniOrange 2FA plugin, the user completes the configured verification challenge. Depending on the policy and available configuration, this may involve an SMS OTP, email OTP, authenticator app, or supported push notification.

The organization must verify that the required second factor applies to each intended login path rather than assume it is automatically triggered after every external SSO authentication.

4. Access Is Granted After the Required Checks

Once the applicable authentication requirements have been satisfied, the user can proceed through the configured login flow.

Where role mapping and resource restrictions are enabled, access to the specified nopCommerce resources is governed by the configured role mappings and restrictions.

Benefits

• Additional login verification: 2FA adds a second verification step to the login flows covered by the configured policy.
• Multiple verification methods: SMS OTP, email OTP, authenticator apps, and supported push notifications provide options for additional verification.
• Targeted 2FA policies: Role-based controls allow organizations to apply 2FA to selected user groups, including administrators, vendors, and registered customers.
• Configurable authentication experience: Customizable OTP settings and message templates help administrators align verification with their requirements.
• Backup verification options: Supported fallback methods provide alternatives when a user's primary verification method is unavailable.
• Identity provider-based authentication: The OAuth 2.0 and SAML 2.0 SSO modules enable authentication through compatible external identity providers.
• Role-based resource restrictions: Role mapping allows administrators to align identity provider roles with nopCommerce roles and restrict access to specified resources.

Result

By incorporating SSO and 2FA into its nopCommerce authentication strategy, an organization can support identity provider-based login while addressing the need for additional verification on protected login flows.

The miniOrange SSO modules provide authentication through compatible external identity providers, while the separate 2FA plugin offers configurable second-factor methods for the login flows it protects. By defining which users require additional verification and confirming how it is enforced for each login method, organizations can align their nopCommerce authentication design with their security and access requirements.

Additional Resources

1. nopCommerce 2FA
2. nopCommerce SAML SSO
3. nopCommerce Oauth SSO

We'll Reach Out to You at the Earliest

Enter your email * Write your Query * Submit

 Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again