Shopify Single Sign-On (SSO) solution using Shibboleth as Identity Provider (IDP)

Pre-requisite : Single Sign On - SSO Application

To configure SSO with Shibboleth as IDP, you will need to install the miniOrange Single Sign On - SSO Application on your Shopify store:

Shopify Single Sign-On (SSO)

By miniOrange

miniOrange Provides Secure Single Sign-On (SSO) access to your Shopify applications(both plus and Non plus Stores).

Get this application

Step by Step guide for Configuring Single Sign-On (SSO) into Shopify using Shibboleth as an Identity Provider (IDP).

1.  Configuring Shopify as Service Provider (SP) in Shibboleth

• In conf/idpproperties, uncomment and set 'idp.encryption.optionaI' to true.

  eg. idp.encryption.optional = true
  

• In conf/metadata-providers.xml, configure Service Provider like this

     <MetadataProvider xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata" 

       id="miniOrangeInLineEntity" xsi:type="InlineMetadataProvider" sortKey="1"> 

         <samlmd:EntityDescriptor ID="entity" entityID="<SP-EntityID/Issuer from SP info tab in plugin.>" 

         validUntil="2020-09-06T04:13:32Z"> 

         <samlmd:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" 

         protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> 

           <samlmd:NameIDFormat> 

             urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress 

           </samlmd:NameIDFormat> 

         <samlmd:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 

         Location="<ACS (AssertionConsumerService) URL from Step1 of the plugin under IDP Tab.>" 

           index="1" /> 

         </samlmd:SPSSODescriptor> 

         </samlmd:EntityDescriptor> 

     </MetadataProvider>
  

• In conf/saml-nameid.properties, uncomment and set default NameID as Email Address like this

   idp.nameid.saml2.default=urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  

• In conf/saml-nameid-xml, search for shibboleth.SAML2NameIDGenerators. Uncomment the shibboleth.SAML2AttributeSourcedGenerator bean and comment all other ref beans

   <!-- SAML 2 NameID Generation --> 

   <util:list id="shibboleth.SAML2NameIDGenerators">  

     <!--<ref bean="shibboleth.SAML2TransientGenerator" /> --> 

     <!-->ref bean="shibboleth.SAML2PersistentGenerator" /> -->  

     <bean parent="shibboleth.SAML2AttributeSourcedGenerator"    

     p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"  

     p:attributeSourceIds="#{ {'email'} }" /> 

   </util:list>
  

• Make sure you have defined AttributeDefinition in conf/attribute-resolver.xml.

   <!-- Note: AttributeDefinitionid must be same as what you provided in attributeSourceIds in conf/saml-nameid.xml --> 

   <resolver:AttributeDefinitionxsi:type="ad:Simple" id="email" sourceAttributeID="mail"> 

     <resolver:Dependency ref="ldapConnector" /> 

     <resolver:AttributeEncoderxsi:type="enc:SAML2String" name="email"  friendlyName="email" /> 

   </resolver:AttributeDefinition > 


                          
   <resolver:DataConnector id="ldapConnector" xsi:type="dc:LDAPDirectory" ldapURL="%{idp.authn.LDAP.ldapURL}" 

     baseDN="%{idp.authn.LDAP.baseDN}" principal="%{idp.authn.LDAP.bindDN}" 

     principalCredential="%{idp.authn.LDAP.bindDNCredential}">  

                          
     <dc:FilterTemplate> 

       <!-- Define you User Search Filter here -->  

       <![CDATA[   (&(objectclass=*)(cn=$requestContext.principalName))   ]]> 

     </dc:FilterTemplate> 
 

                          
     <dc:ReturnAttributes>*</dc:ReturnAttributes> 

   </resolver:DataConnector>
  

• Make sure you have AttributeFilterPolicy defined in conf/attribute-filter.xml.

   <afp:AttributeFilterPolicy id="ldapAttributes"> 

   <afp:PolicyRequirementRulexsi:type="basic:ANY"/> 

     <afp:AttributeRuleattributeID="email"> 

       <afp:PermitValueRulexsi:type="basic:ANY"/> 

     </afp:AttributeRule> 

   </afp:AttributeFilterPolicy> 

  

• Restart the Shibboleth Server.

2.  Configure Shibboleth as an Identity Provider (IDP) in Shopify

• Navigate back to the miniOrange Single Sign On-SSO application and click on Add identity Provider button.

• Select SAML protocol.

• From the list of IDPs, select Shiboleth.

• Click on the Import IDP Metadata button.

• Select the upload method as Metadata Link. Paste the copied XML file link from Step 1 and Click on Import.

• You can also provide the details manually. You need to configure following endpoints:

IDP Entity ID	https://<your_domain>/idp/shibboleth
Single Login URL	https://<your_domain>/idp/profile/SAML2/Redirect/SSO
Single Logout URL	https://<your_domain>/idp/shibboleth
X.509 Certificate	The public key certificate of your Shibboleth server.

• Add the appropriate IDP Name and click on Save.

3.   Test Connection

• After saving the IDP configuration, you will be redirected to Test Connection step.
  Please perform Test Connection before mapping or fetching attributes, test connection ensures that your IDP configuration is correct.
• Click on the Test Connection button.

• On entering valid Okta credentials you will see a pop-up window which is shown in the below screen.

• Click on the Fetch Attributes button to fetch IDP attribute.

4.   Attribute Mapping

• Click on the + Attribute Mapping button to map attributes between Shopify and Shibboleth.

• Map the attributes by refering the table below:


Attribute Name in Shopify	Choose the attribute from the list of predefined attributes
Attribute Type	IDP Attribute
Attribute Value	Select the attribute value you have fetched from your IDP

• Click on Save.

• Navigate to the application home page. Go to More actions against the IDP you have configured and click on Make Default button to make the IDP default.

5.   Testing SSO

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You’ll be redirected to the login page of the IDP you configured in previous step. Log in with your IDP account credentials.
• You’ll be successfully logged in to your Shopify store.

Troubleshooting

If your error or query is not listed here, click here to see others.

Frequently Asked Questions (FAQs)

Choose your preferred Identity Provider and start setting up SSO for Shopify right away

If you are looking for anything which you cannot find, please drop us an email on shopifysupport@xecurify.com.