SAML Single Sign-On (SSO) For Shopify Using Duo as Identity Provider

Overview

miniOrange allows Duo to act as an IDP (Identity Provider), which allows users to Single Sign-On (SSO) into Shopify using Duo Credentials. Our application is compatible with all the SAML / OAuth compliant Identity Providers. We will go through a step-by-step guide to configure Single Sign-On (SSO) into Shopify using Duo as IdP (Identity Provider) and Shopify store as SP (Service Provider).

Download Plugin Pricing Plans

Pre-requisites: Single Sign On - SSO Login Application

To configure SSO into Shopify with Duo as IDP (SAML), you will need to install the miniOrange Shopify Single Sign On - SSO Login Application on your store.

Configuration Steps

Step by Step guide for Configuring Duo as IDP for SSO into Shopify

1.  Configure Shopify as Service Provider (SP) in Duo

• Log in to Duo Administration Console.

• Select Applications tab from left menu pane, then click on Protect an Application.

• Search for Generic Service Provider .
• Then, select Single Sign-On application and click on Protect button.

• Select Single Sign-On tab from the left menu pane and click on Add Source button.

• Select Authentication Source as SAML Identity Provider and click on Add SAML Identity Provider button.
  

• For the above SAML configuration, you need to get the Entity ID and ACS URL from Shopify
• Now go to your Shopify store and navigate to the App section and click on Single Sign On - SSO login application.

• Click on the Add identity Provider button to add your IDP.

• Select SAML protocol.

• Now choose Custom IDP from the list of IDPs.


• Click on the Get metadata button as shown in the below screen to get the service provider metadata.

• Navigate to SP Initiated Metadata section and copy down the ACS URL, Entity ID or Issuer and X.509 Certificate.

• To Configure SAML Identity Provider in Duo, navigate to Configure Single Sign-On tab and provide the following values:

  Display Name	Provide a Service Provider name
  Entity ID	Entity ID or Issuer
  Single Sign-On URL	ACS URL
  Existing Certificate	X.509 Certificate


• Click on Save to save your configuration.
• Now navigate to Configure SAML Identity Provider tab to download the XML metadata file, this will be required to configure the plugin.

2.   Configure Duo as IDP in Shopify

• Navigate back to the miniOrange Single Sign On-SSO application and click on Add identity Provider button.

• Select SAML protocol.

• From the list of IDPs, select Custom IDP.

• Click on the Import IDP Metadata button.

• Select the upload method as Metadata Link. Paste the copied XML file link from Step 1 and Click on Import.

• Add the appropriate IDP Name and click on Save.

Step 3: Test Connections

• After saving the IDP configuration, you will be redirected to Test Connection step.
• Please perform Test Connection before mapping or fetching attributes, test connection ensures that your IDP configuration is correct.
• Click on the Test Connection button.



• On entering valid Duo credentials you will see a pop-up window which is shown in the below screen.



• Click on the Fetch Attributes button to fetch IDP attribute.

Step 4: Attribute Mapping

• Click on the + Attribute Mapping button to map attributes between Shopify and Duo.



• Map the attributes by refering the table below:




Attribute Name in Shopify	Choose the attribute from the list of predefined attributes
Attribute Type	IDP Attribute
Attribute Value	Select the attribute value you have fetched from your IDP



• Click on Save.

Step 5: Enable & Test SSO Configurations

Select Shopify Store Type:

• Non-Plus Store
• Plus Store

SSO Configuration in Non-Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

• Customer Accounts
• Legacy Customer Accounts

• Go to the application dashboard, enable the customer accounts extension as shown in the below image.

• Enable the New Customer Accounts extension and click on Save.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store.(https://<your-shopify-storedomain>)
• Click on the User login icon.

• You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.
• Next, enter the six-digit OTP that will be sent to your registered email address. (This is a one-time process)

• You’ll be successfully logged in to your Shopify store.

• Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

• If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
• Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.

• After login, if you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.

SSO Configuration in Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

• Customer Accounts
• Legacy Customer Accounts

• Go back to the SSO application, and navigate to Connect Store tab. Copy the Client ID, Client Secret, Post-Logout Redirect URL and Discovery Endpoint URL and keep them handy.

• Click on the Customer Accounts link as shown in the below image.

• Select the Customer accounts option recommended by Shopify & look for the Identity Provider option, if not present please reach out to shopifysupport@xecurify.com.

• If the identity provider is present, click on Manage.

• Click on Connect to Provider button.

• Add the Identity Provider name and fill in the details such as Discovery endpoint URL, Client ID, Client secret, Additional Scopes, Post-logout redirect URI parameter that you copied from above step. Click on Save.

• Once the Identity Provider has been added, do the Test Connection.

• After verifying the flow make the identity provider as Active.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store.(https://<your-shopify-storedomain>)
• Click on the User login icon.

• You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.

• You’ll be successfully logged in to your Shopify store.

• Now, click on the Setup Guide button and follow the steps mentioned to get multipass token.

• Enable the Multipass Token option. Refer to this Faq to get the Multipass token value and paste it in the below field.

• Click on Save.

• Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

• If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
• Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.

• If you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.

• You’ll be successfully logged in to your Shopify store.

Additional Resources

• Shopify Security Solutions
• Shopify Single Sign-On (SSO)
• Shopify Content restriction
• Shopify Subscription
• Shopify – Okta SCIM Provisioning And Deprovisioning

Get in Touch

Please reach out to us at shopifysupport@xecurify.com, and our team will assist you with setting up the Shopify SSO application. Our team will help you to select the best suitable solution/plan as per your requirement.