Single Sign-On (SSO) into Shopify Using Keycloak as IDP (OAuth)

Pre-requisite : Single Sign On - SSO Application

To configure SSO into Shopify using Keycloak (OAuth) as IDP, you will need to install the miniOrange Single Sign On - SSO Application on your Shopify store:

Step by Step guide to setup (OAuth) Single Sign-On in Shopify Store Using Keycloak as IDP

1.  Get Redirect URI from Shopify SSO Application

• Go to your Shopify store and navigate to the App section and click on Single Sign On - SSO login application.

• Click on the Add identity Provider button to add your IDP.

• Select OAuth 2.0 protocol.

• Now choose Keycloak from the list of IDPs.

• Copy the OAuth Callback URL and kepp it handy as it will be used in furthur step.

2.  Configure Shopify as SP (Service Provider) in Keycloak

• First of all, Download Keycloak and install it.
• Start the keycloak server based on your keycloak version. (See table below)

For the Keycloak Version 16 and below	Go to the Root Directory of keycloak bin standalone.sh
For the Keycloak Version 17 and above	Go to the Root Directory of keycloak bin kc.bat and run the below commands. 1. kc.bat build 2. kc.bat start-dev

• Version 18 and below
• Version 19 and above

• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Add Realm option.

• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

• Create OpenID client: Click on the Clients and choose create to create a new client. Enter Client ID and select client protocol openeid-connect and select Save. Keep this value handy as this will be used in furthur steps.

• Change Access type: After client is created change its access type to confidential.

• Enter Valid Redirect URIs: Paste the copied Callback URL from Step 1 and then click on SAVE.

• Get Client Secret: Now we need to get client secret. So select Clients and select credentials and copy your secret from here. Keep the Client Secret value handy as this will be used in furthur step.

• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and choose to Add a new User.

• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.



NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles and clicking on add selected.

• Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Add Role.


Step 1.1: Steps to fetch Keycloak Groups [Premium]

• Create groups: Click on the Groups and choose New to create a new group.

• Assign user to group: Select the user whom you want to add in group. Choose Groups option from tab and then select the group-name and click on join.

• Keycloak Group Mapper: Now to get group details we need to perform its client mapping with group membership else group details will not be fetched. So in Client section, select your client and then click on mapper->create.

• Now, select mapper type as Group Membership and enter the name and token claim name i.e the attribute name corresponding to which groups will be fetched. Turn Off the full group path, Add to ID token and Add to access token options, and click on Save.


Note: -- If full path is on group path will be fetched else group name will be fetched.

Step 1.2: Steps to fetch Keycloak Roles [Premium]

• Keycloak Role Mapper: Now to get role details for a successful Keycloak Single Sign-On (SSO) we need to perform its client mapping with role membership else role details will not be fetched. So in Client section, select your client and then click on mapper->create.

• Now, select mapper type as user realm Role Membership and enter the name. and token claim name i.e the attribute name corresponding to which groups will be fetched. Add to ID token and Add to access token options, and click on Save.

• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.

• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

• Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client ID and select client protocol openid-connect and click Next. Keep this value handy as it will me used in furthur steps.

• Enable the Client Authentication and Authorization toggle.

• Scroll down to the Access settings and paste the copied Callback/Redirect URL from Step 1.

• Go to the Credentials tab, copy the Client Secret and keep it handy as we will require it later while configuring Shopify Single Sign-On application.

• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.

• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.



NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.

• Create ROLE: The Role will be used by your applications to define which users will be authorised to access the application. Click on the Roles and choose Create Role.

Step 1.1: Steps to fetch Keycloak Groups [Premium]

• Click on Client Scopes and select the Profile scope from the list.

• In the Mappers tab, choose From predefined mappers option from the Add mapper dropdown.

• Check the Group mapping from the list.

• Now, go to the Realm roles tab , click on Create role button.

• Enter the Role name and click on Save button.

• Now, go to the Users tab from the left section and select the user you want to assign groups. Under the Role mapping tab click on Assign role button.

• Select the Groups you want to assign to a user and click on Assign button.

In conclusion, you have successfully configured Keycloak as OAuth Provider, for achieving SSO into Shopify for user authentication.

3.  Scope and Endpoints

Please refer the below table for configuring the scope & endpoints for Keycloak Version 18 and above in the plugin.

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout: [optional]	https://{keycloak domain}/realms/{realm-name}/protocol/openid-connect/logout?post_logout_redirect_uri={encodedRedirectUri}&id_token_hint=##id_token##




Please refer the below table for configuring the scope & endpoints for Keycloak Version 17 and below in the plugin.

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout: [optional]	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri

4.  Configure Keycloak as IDP in Shopify

• Navigate back to the miniOrange Single Sign On-SSO application and click on Add identity Provider button.

• Select OAuth 2.0 protocol.

• From the list of IDPs, select Keycloak.

• Fill out the following fields by referring the below table.


IDP Display Name	Keycloak
Client ID	from Step 2
Client secret	from Step 2
Scope and Endpoint	from Step 3

In conclusion, you have configured Shopify as service provider, for achieving SSO into Shopify using Keycloak as IDP for user authentication.

5.   Test Connection

• After saving the IDP configuration, you will be redirected to Test Connection step.
  Please perform Test Connection before mapping or fetching attributes, test connection ensures that your IDP configuration is correct.
• Click on the Test Connection button.

• On entering valid Keycloak account credentials you will see a pop-up window which is shown in the below screen.

• Click on the Fetch Attributes button to fetch IDP attribute.

6.   Attribute Mapping

• Click on the + Attribute Mapping button to map attributes between Shopify and Azure B2C .

• Map the attributes by refering the table below:


Attribute Name in Shopify	Choose the attribute from the list of predefined attributes
Attribute Type	IDP Attribute
Attribute Value	Select the attribute value you have fetched from your IDP

• Click on Save.

• Navigate to the application home page. Go to More actions against the IDP you have configured and click on Make Default button to make the IDP default.

7.   Testing Single Sign-On (SSO) for your Shopify Store

• Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
• Click on the login button you customized earlier.

• You’ll be redirected to the login page of the IDP you configured in previous step. Log in with your IDP account credentials.
• You’ll be successfully logged in to your Shopify store.

Hence you have successfully configured Shopify Single Sign-On (SSO) using Keycloak (OAuth) as IDP and Shopify as SP using miniOrange Single Sign-On (SSO) login application. This solution ensures that you are ready to roll out secure access to your Shopify store using Keycloak login credentials within minutes.

Troubleshooting

If your error or query is not listed here, click here to see others.

Frequently Asked Questions (FAQs)

Choose your preferred Identity Provider and start setting up SSO for Shopify right away

If you are looking for anything which you cannot find, please drop us an email on shopifysupport@xecurify.com