Single Sign-On (SSO) For Shopify Using AWS Cognito as Userstore


Configure AWS Cognito as Userstore for your Shopify Store. miniOrange provides a ready to use solution which ensures that you are ready to roll out secure access to Shopify Store using AWS Cognito within minutes.

Pre-requisite : Single Sign On - SSO Application

To configure SSO into Shopify with AWS Cognito as Userstore, you will need to install the miniOrange Single Sign On - SSO Login Application on your Shopify store:

miniOrange Provides Secure Single Sign-On (SSO) access to your Shopify stores (both plus and Non plus Stores).

Step by Step guide for Single Sign-On in Shopify Store Using AWS Cognito as Userstore

Step 1: Step to get the Redirect URI for OAuth Server

  • Go to your Shopify store, click on the Apps tab and select the Single Sign On - SSO Login application.
  • shopify app section - single sign on application
  • Click on the Setup IDP button in the top left in the navigation bar.
  • Single Sign-On (SSO)for Shopify (Plus and Non Plus), Configure IDP for enabling Single Sign-On (SSO)
  • From the left navigation bar select Configure SSO and click on Add Identity provider button.
  • Shopify - miniorange sso application - choose OAuth 2.0
  • You can find the OAuth Callback URL/ Redirect URI in the OAuth 2.0 section. Keep the OAuth callback URL handy as you will need it later.
  • Shopify - miniorange sso application - choose OAuth 2.0

2.  Configurations for AWS Cognito

    A] Steps to Configure User Pool

    • Sign in to AWS Amazon.
    • Now enter “Cognito” in search textbox & select Cognito from dropdown.

    •  Shopify OAuth Single Sign On (SSO), AWS cognito SSO Login Cognito
    • Go to “Manage your user pools”.
    • OAuth Single Sign On (SSO), AWS cognito SSO Login Manage user pools
    • Click on “Create a user pool”.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create a user pool
    • Add pool name and select “Review Defaults”.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Review Defaults
    • Click on Edit icon as shown in the below image.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Add app client
    • Now, Enable the Email Address and Phone Number option and click on Next step button.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Add app client
      OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Add app client
    • Click on “Add app client” & then click on Add an app client.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Add app client
    • Enter App client name & Disable Generate Client Secret option. Enable the Username Password based authentication option,then Click on “Create app client”.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create app client
      OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create app client
    • Click on Return to Pool Details to come back to your configuration.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create app client
    • Click on Create Pool button to save your settings and create a user pool.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create app client
    • In the navigation bar present on the left side, click on the App Client Settings option under the App Integration menu.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create app client
    • Go to the Cognito dashboard and select “Cognito User Pool”, add callback URL which you have copied from Pre-requisite.
    • Add application home page URL has to Sign out URL.
    • Also, select Authorization code grant as “Allowed OAuth Flows” & select email, OpenID, Profile as “Allowed OAuth Scopes”.
    • After selecting all details click on Save changes button.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Save changes
    • Go to “App client” and click on “Show details” to get a client ID. (Keep client ID handy as you will need it later.)

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login App client
    • Go to domain name and enter a domain name for your app. After adding domain name you can check its availability by clicking on “Check availability” button. After entering valid domain name click ”Save changes” button.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login domain name
    • Complete domain name: The complete domain name that you need to enter in miniOrange dashboard is {your domain name}.auth.{region name}.amazoncognito.com
    • Add Users / Groups to Cognito App : Go to Users and groups and then click on Users. After this click on Create user.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Add Users / Groups
    • Fill all required informations and click on Create user.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create user
    • Click on Groups and then click on Create group.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Groups
    • Fill all required informations and click on Create group.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create group

    B] Steps to Configure Identity Pool.

    • Go to Federated Identities and click on Create new Identity pool button.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create group
    • Enter Identity pool name and enable Unauthenticated identities and Authentication flow settings, then click on Create pool button.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create group
    • Click on Allow button and You will get the Identity Pool Id.

    • OAuth/OpenID/OIDC Single Sign On (SSO), AWS cognito SSO Login Create group

You have successfully completed AWS Cognito side configuration.

3.  Configure Shopify as SP (Service Provider)

  • Again, go to your Shopify store, click on the Apps tab and select the Single Sign On - SSO Login application.
  • shopify app section - single sign on application
  • Click on the Setup IDP button in the top left in the navigation bar.
  • Single Sign-On (SSO)for Shopify (Plus and Non Plus), Configure IDP for enabling Single Sign-On (SSO)
  • From the left navigation bar select User Store and Click on Add User Store button.

  • Add user store - azure ad saml Apps
  • Select AWS Cognito.

  • enter configuration data - azure ad saml Apps
  • Enter the following values.
  • AWS Cognito Identifier Provider Name
    AWS Cognito Region Get Cognito region from user pool(eg.us-east-2)
    User Pool ID From step A
    Client ID From step A
    Identity Pool ID From step B
  • Now you can click on Save.
You have successfully completed Shopify side configuration.

4.   Testing SSO for your Shopify Store

  • Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
  • Click on the login button you customized earlier.
  • select project google oauth provider
  • You’ll be redirected to the login page of the IDP you configured in previous step. Log in with your IDP account credentials.
  • You’ll be successfully logged in to your Shopify store.
Hence your configuration of AWS Cognito as Userstore in Shopify is sucesssfully completed.

Choose your preferred Identity Provider and start setting up SSO for Shopify right away


Additional Resources


If you are looking for anything which you cannot find, please drop us an email on shopifysupport@xecurify.com

Hello there!

Need Help? We are right here!

support
Contact miniOrange Support
success

Thanks for your inquiry.

If you dont hear from us within 24 hours, please feel free to send a follow up email to info@xecurify.com