We created a centralized authentication service, called Identity, by building upon functionality from the OpenID Connect (OIDC) specification.
Overview
This article outlines the implementation of a secure Central Authentication Service at Shopify, detailing the challenges faced when managing multiple stores and the solution developed using the OpenID Connect specification. It provides a step-by-step guide to transitioning from legacy accounts to a unified Identity account system, enhancing user experience through single sign-on capabilities.
What You'll Learn
1
How to implement a centralized authentication service using OpenID Connect
2
Why transitioning from legacy accounts to Identity accounts improves user experience
3
When to prompt users for account merging and 2FA setup
4
How to synchronize user data effectively between legacy and central systems
Prerequisites & Requirements
- Understanding of OpenID Connect and authentication concepts
- Familiarity with Ruby and ActiveOperation library(optional)
Key Questions Answered
How does Shopify handle user authentication across multiple stores?
Shopify addresses user authentication by implementing a centralized Identity service based on the OpenID Connect specification, allowing users to combine their accounts for single sign-on capabilities. This eliminates the need for users to manage multiple accounts across different stores, streamlining the authentication process.
What are the steps to combine multiple legacy accounts into a single Identity account?
The steps include synchronizing data from existing user accounts, routing all authentication through the Identity service, prompting users to combine accounts, enabling two-factor authentication, creating the combined Identity account, and preventing new legacy accounts from being created. These steps ensure a secure and seamless transition to a unified account system.
What challenges arise when managing multiple Shopify stores?
The primary challenge is the administrative overhead for users who must manage separate accounts for each store, leading to inefficiencies and potential security risks. The lack of single sign-on capabilities complicates user access and increases the likelihood of account management issues.
Why is two-factor authentication important in account management?
Two-factor authentication (2FA) adds an extra layer of security by requiring users to provide a second form of verification, reducing the risk of unauthorized access. This is particularly crucial when merging accounts, as it helps ensure that only legitimate users can access their combined account.
Key Statistics & Figures
Percentage of active user accounts upgraded to Identity accounts
over 75%
This statistic highlights the success of the migration process and the effectiveness of the new Identity service.
Technologies & Tools
Authentication
Openid Connect
Used for delegating authentication from Shopify stores to the centralized Identity service.
Backend Framework
Activeoperation
Facilitates the isolation and modeling of business logic within the application.
Security
Web Authentication (webauthn)
Allows users to use physical security keys as a second factor for account security.
Key Actionable Insights
1Implement a centralized authentication system to reduce user friction and improve security.By transitioning to a centralized Identity service, organizations can streamline user access across multiple platforms, enhancing user experience and reducing the administrative burden on staff.
2Encourage users to enable two-factor authentication during account merging.This not only secures their newly combined account but also educates users on the importance of account security, fostering a culture of security awareness.
3Utilize the OpenID Connect specification for delegating authentication.This approach allows for a standardized method of authentication that can be integrated across various services, ensuring a consistent user experience.
4Regularly synchronize user data between legacy systems and the new Identity service.This ensures that user profiles are up-to-date and minimizes the risk of data discrepancies during the transition process.
Common Pitfalls
1
Failing to verify user email addresses during account creation can lead to complications in account management.
Without email verification, users may create accounts with inaccessible email addresses, complicating the process of merging accounts later.
2
Not synchronizing user data effectively can result in data inconsistencies.
If user data is not kept up-to-date during the transition, it can lead to confusion and security vulnerabilities as users may access outdated information.
Related Concepts
Single Sign-on (sso)
User Identity Management
Account Security Best Practices
Openid Connect Specification