Single Sign-On (SSO) into Shopify Using Keycloak as IDP (OAuth)

Pre-requisite : Single Sign On - SSO Application

To configure SSO into Shopify using Keycloak (OAuth) as IDP, you will need to install the miniOrange Single Sign On - SSO Application on your Shopify store:

Step by Step guide to setup (OAuth) Single Sign-On in Shopify Store Using Keycloak as IDP

1.  Get Redirect URI from Shopify SSO Application

• Go to your Shopify store, click on the Apps tab, and select the Single Sign On - SSO Login application.

• Click on the Setup IDP button in the top left of the navigation bar.

• From the left navigation bar select Configure SSO and click on Add Identity provider button.

• You can find the OAuth Callback URL/ Redirect URI in the OAuth 2.0 section. Keep the OAuth callback URL handy as you will need it later.

2.  Configure Shopify as SP (Service Provider) in Keycloak

• First of all, Download Keycloak and install it.
• Start the keycloak server based on your keycloak version. (See table below)

For the Keycloak Version 16 and below	Go to the Root Directory of keycloak bin standalone.sh
For the Keycloak Version 17 and above	Go to the Root Directory of keycloak bin kc.bat and run the below commands. 1. kc.bat build 2. kc.bat start-dev

• Version 18 and below
• Version 19 and above

• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Add Realm option.

• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

• Create OpenID client: Click on the Clients and choose create to create a new client. Enter Client ID and select client protocol openeid-connect and select Save. Keep this value handy as this will be used in furthur steps.

• Change Access type: After client is created change its access type to confidential.

• Enter Valid Redirect URIs: Paste the copied Callback URL from Step 1 and then click on SAVE.

• Get Client Secret: Now we need to get client secret. So select Clients and select credentials and copy your secret from here. Keep the Client Secret value handy as this will be used in furthur step.

• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and choose to Add a new User.

• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.



NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles and clicking on add selected.

• Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Add Role.


Step 1.1: Steps to fetch Keycloak Groups [Premium]

• Create groups: Click on the Groups and choose New to create a new group.

• Assign user to group: Select the user whom you want to add in group. Choose Groups option from tab and then select the group-name and click on join.

• Keycloak Group Mapper: Now to get group details we need to perform its client mapping with group membership else group details will not be fetched. So in Client section, select your client and then click on mapper->create.

• Now, select mapper type as Group Membership and enter the name and token claim name i.e the attribute name corresponding to which groups will be fetched. Turn Off the full group path, Add to ID token and Add to access token options, and click on Save.


Note: -- If full path is on group path will be fetched else group name will be fetched.

Step 1.2: Steps to fetch Keycloak Roles [Premium]

• Keycloak Role Mapper: Now to get role details for a successful Keycloak Single Sign-On (SSO) we need to perform its client mapping with role membership else role details will not be fetched. So in Client section, select your client and then click on mapper->create.

• Now, select mapper type as user realm Role Membership and enter the name. and token claim name i.e the attribute name corresponding to which groups will be fetched. Add to ID token and Add to access token options, and click on Save.

• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.

• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

• Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client ID and select client protocol openid-connect and click Next. Keep this value handy as it will me used in furthur steps.

• Enable the Client Authentication and Authorization toggle.

• Scroll down to the Access settings and paste the copied Callback/Redirect URL from Step 1.

• Go to the Credentials tab, copy the Client Secret and keep it handy as we will require it later while configuring Shopify Single Sign-On application.

• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.

• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.



NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.

• Create ROLE: The Role will be used by your applications to define which users will be authorised to access the application. Click on the Roles and choose Create Role.

Step 1.1: Steps to fetch Keycloak Groups [Premium]

• Click on Client Scopes and select the Profile scope from the list.

• In the Mappers tab, choose From predefined mappers option from the Add mapper dropdown.

• Check the Group mapping from the list.

• Now, go to the Realm roles tab , click on Create role button.

• Enter the Role name and click on Save button.

• Now, go to the Users tab from the left section and select the user you want to assign groups. Under the Role mapping tab click on Assign role button.

• Select the Groups you want to assign to a user and click on Assign button.

In conclusion, you have successfully configured Keycloak as OAuth Provider, for achieving SSO into Shopify for user authentication.

3.  Scope and Endpoints

Please refer the below table for configuring the scope & endpoints for Keycloak Version 18 and above in the plugin.

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout: [optional]	https://{keycloak domain}/realms/{realm-name}/protocol/openid-connect/logout?post_logout_redirect_uri={encodedRedirectUri}&id_token_hint=##id_token##




Please refer the below table for configuring the scope & endpoints for Keycloak Version 17 and below in the plugin.

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout: [optional]	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri

4.  Configure Keycloak as IDP in Shopify

• Go to your Shopify store, click on the Apps tab and select the Single Sign On - SSO Login application.

• Click on the Setup IDP button in the top left in the navigation bar.

• From the left navigation bar select Configure SSO and click on Add Identity provider button.

• Go to the OAuth 2.0 tab and select the IDP name as a Custom Provider from the dropdown.

• Now, fill in the required details like Client ID, Client Secret, Endpoints, and Scope.
• Please refer to the below table for configuring the values.

IdP Name	Keycloak
IdP Display Name	Choose the appropriate name
Client ID	from Step 2
Client secret	from Step 2
Scope and Endpoint	from Step 3

• Click on Save button.

In conclusion, you have successfully configured Shopify as service provider, for achieving SSO into Shopify using Keycloak as IDP for user authentication.

5.  Test Connection

• Go to Identity Providers tab.
• Click on Select >> Test Connection option against the Identity Provider you configured.


• On entering valid Keycloak credentials you will see a pop-up window which as shown in below screen.

• Hence your configuration of Keycloak as IDP in Shopify is sucesssfully completed.

6.   Testing SSO for your Shopify Store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You’ll be redirected to the Keycloak login page. Log in with your Keycloak account credentials.
• You’ll be successfully logged in to your Shopify store.

Hence your configuration of Keycloak as IDP in Shopify is sucesssfully completed.

Troubleshooting

If your error or query is not listed here, click here to see others.

Frequently Asked Questions (FAQs)

Choose your preferred Identity Provider and start setting up SSO for Shopify right away

If you are looking for anything which you cannot find, please drop us an email on shopifysupport@xecurify.com