TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

Centralized Authentication Service (Identity)

2 posts · Dec 2019 – Mar 2023

What this trail covers

Shopify has developed a centralized authentication service called Identity, built on the OpenID Connect (OIDC) specification, to manage user identities and enable single sign-on (SSO) across multiple stores. This involved synchronizing user data, migrating legacy accounts to Identity accounts, prompting users to combine accounts, and enforcing two-factor authentication (2FA). The system handles account merging, password updates, and prevents the creation of new legacy accounts, significantly reducing administrative friction and improving user experience.

All Shopify trails
  1. Supporting Passkeys in Shop's Authentication Flows - ShopifyThis post details the integration of Passkeys into Shopify's existing authentication flows for Shop Pay and the Shop app. It explains the technical implementation of Passkey registration and login using the `webauthn-ruby` gem, including the use of `WebAuthn::Credential.options_for_create` and `WebAuthn::RelyingParty.verify_registration` for registration, and `WebAuthn::RelyingParty.verify_authentication` for login. Key learnings include subdomain handling, specifying `authenticator_selection` and `require_resident_key`, and challenge verification for replay attack protection. The post also discusses the future potential of Conditional UI for Passkeys.
  2. How to Implement a Secure Central Authentication Service in Six Steps - ShopifyThis post details the six-step process for implementing the centralized authentication service (Identity) at Shopify. It covers synchronizing data from existing user accounts into the Identity service, routing all authentication through the Identity service via OpenID Connect (OIDC), prompting users to combine their multiple legacy accounts into a single Identity account, encouraging users to enable two-factor authentication (2FA), creating the combined Identity account within a single database transaction, and preventing the creation of new legacy accounts. It also elaborates on the user experience and technical challenges of account merging, including handling unverified email addresses and 2FA requirements.