SAML Single Sign-On (SSO) For Shopify Using ADFS as Identity Provider

Overview

miniOrange allows ADFS to act as an identity provider (IDP), which allows users to Single Sign-On (SSO) into Shopify using ADFS credentials. Our application is compatible with all the SAML / OAuth-compliant Identity Providers. We will go through a step-by-step guide to configure Single Sign-On (SSO) into Shopify using ADFS as an identity provider (IDP) and Shopify store as service provider (SP).

Download Application Pricing Plans

Pre-requisites: Single Sign-On - SSO Login Application

To configure SSO into Shopify using ADFS as an identity provider (IDP), you will need to install the miniOrange Shopify Single Sign-On - SSO Login Application on your store.

Configuration Steps

Follow the step-by-step guide to configure Single Sign-On in Shopify store using ADFS as an identity provider.

Step 1: Configure Shopify as Service Provider in ADFS

• On ADFS, search for the ADFS Management application.



• After opening the ADFS Management, select Relying Party Trust and then click on Add Relying Party Trust.



• Select Claims Aware from the Relying Party Trust Wizard and click on the Start button.




Select Data Source

• In Select Data Source, select the data source for adding a relying party trust.
• Now go to your Shopify store and navigate to the App section and click on Single Sign On - SSO login application.



• Click on the Add identity Provider button to add your IDP.



• Select SAML protocol.



• Now choose ADFS from the list of identity providers (IDPs).



• Click on the Get metadata button as shown in the below screen to get the service provider metadata.



• Navigate to SP Initiated Metadata section and copy the SP Initiated Metadata URL. Keep it handly as it will be used in furthur steps.



• Select Import data about the relying party published online or on the local network option and add the Metadata URL copied from above in the Federation metadata address.
• Click on Next.

Note: In the next step enter the desired Display Name and click Next.

Step 2: Configure ADFS as Identity Provider in Shopify

• Navigate back to the miniOrange Single Sign On-SSO application and click on Add identity Provider button.



• Select SAML protocol.



• Now choose ADFS from the list of identity providers (IDPs).



• Get the ADFS Federation Metadata URL by using this URL:
  https://< ADFS_Server_Name >/federationmetadata/2007-06/federationmetadata.xml.
• Click on the Import IDP Metadata button.



• Select the upload method as Metadata Link. Paste the copied XML file link from above and Click on Import.



• Add the appropriate IDP Name and click on Save.



• Click on Save.

Choose Access Control Policy

• Select Permit everyone as an Access Control Policy & click on Next.

Ready to Add Trust

• In Ready to Add Trust, click on Next and then Close.

Edit Claim Issuance Policy

• In the list of Relying Party Trust, select the application you created and click on Edit Claim Issuance Policy.



• In the Issuance Transform Rule tab, click on Add Rule >> OK button.

Choose Rule Type

• Select Send LDAP Attributes as Claims and click on Next.

Configure Claim Rule

• Enter the following details & click on Finish.

Claim rule name:	Attributes
Attribute Store:	Active Directory
LDAP Attribute:	E-Mail-Addresses
Outgoing Claim Type:	Name ID

You have successfully completed the ADFS side configurations.

Step 3: Test Connections

• After saving the IDP configuration, you will be redirected to Test Connection step.
• Please perform Test Connection before mapping or fetching attributes, test connection ensures that your IDP configuration is correct.
• Click on the Test Connection button.



• On entering valid ADFS credentials you will see a pop-up window which is shown in the below screen.



• Click on the Fetch Attributes button to fetch IDP attribute.

Step 4: Attribute Mapping

• Click on the + Attribute Mapping button to map attributes between Shopify and ADFS.



• Map the attributes by refering the table below:




Attribute Name in Shopify	Choose the attribute from the list of predefined attributes
Attribute Type	IDP Attribute
Attribute Value	Select the attribute value you have fetched from your IDP



• Click on Save.

Step 5: Enable & Test SSO Configurations

Select Shopify Store Type:

• Non-Plus Store
• Plus Store

SSO Configuration in Non-Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

• Customer Accounts
• Legacy Customer Accounts

• Go to the application dashboard, enable the customer accounts extension as shown in the below image.

• Enable the New Customer Accounts extension and click on Save.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store.(https://<your-shopify-storedomain>)
• Click on the User login icon.

• You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.
• Next, enter the six-digit OTP that will be sent to your registered email address. (This is a one-time process)

• You’ll be successfully logged in to your Shopify store.

• Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

• If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
• Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.

• After login, if you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.

SSO Configuration in Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

• Customer Accounts
• Legacy Customer Accounts

• Go back to the SSO application, and navigate to Connect Store tab. Copy the Client ID, Client Secret, Post-Logout Redirect URL and Discovery Endpoint URL and keep them handy.

• Click on the Customer Accounts link as shown in the below image.

• Select the Customer accounts option recommended by Shopify & look for the Identity Provider option, if not present please reach out to shopifysupport@xecurify.com.

• If the identity provider is present, click on Manage.

• Click on Connect to Provider button.

• Add the Identity Provider name and fill in the details such as Discovery endpoint URL, Client ID, Client secret, Additional Scopes, Post-logout redirect URI parameter that you copied from above step. Click on Save.

• Once the Identity Provider has been added, do the Test Connection.

• After verifying the flow make the identity provider as Active.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store.(https://<your-shopify-storedomain>)
• Click on the User login icon.

• You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.

• You’ll be successfully logged in to your Shopify store.

• Now, click on the Setup Guide button and follow the steps mentioned to get multipass token.

• Enable the Multipass Token option. Refer to this Faq to get the Multipass token value and paste it in the below field.

• Click on Save.

• Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.

• Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.

• If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
• Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.

Testing Single Sign-On (SSO) for your Shopify store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.

• If you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.

• You’ll be successfully logged in to your Shopify store.

Additional Resources

• Shopify Security Solutions
• Shopify Single Sign-On (SSO)
• Shopify Content restriction
• Shopify Subscription
• Shopify – Okta SCIM Provisioning And Deprovisioning

Get in Touch

Please reach out to us at shopifysupport@xecurify.com, and our team will assist you with setting up the Shopify SSO application. Our team will help you to select the best suitable solution/plan as per your requirement.