TechPrufer
Sign inGet started

Blogs›Shopify›Centralized Authentication Service (Identity)

Centralized Authentication Service (Identity)

Centralized Authentication Service (Identity)

2
posts
2019–2023

Shopify developed a centralized authentication service called Identity, built on the OpenID Connect (OIDC) specification, to manage user identities and enable single sign-on (SSO) across multiple stores. This involved synchronizing user data, migrating legacy accounts to Identity accounts, prompting users to combine accounts, and enforcing two-factor authentication (2FA). The system handles account merging, password updates, and prevents the creation of new legacy accounts, significantly reducing security risks. The Shop team has now integrated Passkeys into Shop's authentication flows on the web and in the native app to replace email and SMS verification, leveraging the webauthn-ruby gem for registration and login flows, and exploring Conditional UI for a more seamless user experience.

2023

Supporting Passkeys in Shop's Authentication Flows - Shopify

3/24/2023

This post details the integration of Passkeys into Shopify's authentication flows for Shop and Shop Pay. It explains the technical implementation of Passkey registration and login using the webauthn-ruby gem, including the use of `WebAuthn::Credential.options_for_create` and `WebAuthn::RelyingParty.verify_registration` for registration, and `WebAuthn::RelyingParty.verify_authentication` for login. Key learnings include handling subdomains, specifying authenticator selection and discoverable credentials, and protecting against replay attacks by saving and verifying challenges. The post also discusses the potential of Conditional UI for passkeys.

2019

How to Implement a Secure Central Authentication Service in Six Steps - Shopify

12/26/2019

This post details the six-step process for implementing Shopify's central authentication service, Identity. It covers synchronizing user data from existing accounts, routing all authentication through OIDC, prompting users to combine legacy accounts into a single Identity account, encouraging 2FA adoption, creating the combined Identity account within a database transaction, and preventing the creation of new legacy accounts. It also explains the modeling of Identity and Legacy accounts, the MergeSession object for account combining, and the handling of 2FA requirements during the merge process.