Loading…
How to Implement a Secure Central Authentication Service in Six Steps
2023-10-18
- Source
- Shopify
- Published
- Added to Yomu
Summary
Shopify built Identity to reduce the overhead of managing separate staff accounts across multiple stores, where each Shop isolated user data and lacked single sign-on. The service uses OpenID Connect (OIDC) to centralize authentication while retaining destination-specific authorization, and it models legacy one-store accounts separately from Identity accounts that can access multiple destinations. Migration begins by synchronizing profile and security data, routing authentication through Identity, and prompting eligible users to verify email ownership, combine accounts, and provide required 2FA credentials. Single legacy accounts can be auto-upgraded without changing their UUID, while multi-account merges use a MergeSession and operations implemented with ActiveOperation; WebAuthn also supports physical security keys as a second factor. Finally, Shopify changed store signup and staff invitations to prevent new legacy accounts, reporting that more than 75% of active accounts had been upgraded or combined at the time of writing.
Context
Shopify merchants expanding across multiple stores faced administrative overhead because staff users needed separate accounts, passwords, profiles, and two-step authentication for each Shop. The Shop data model isolated users by store, preventing single sign-on across destinations.
Approach / What changed
Shopify created the Identity service around OpenID Connect, synchronized existing profile and security data into it, migrated legacy accounts through automatic upgrades or authenticated merges, added email ownership and 2FA checks, and changed signup and invitation flows to stop creating new legacy accounts.
Takeaways
- Legacy accounts are limited to one store, while Identity accounts can access multiple destinations such as stores, the Partners dashboard, or Community forums.
- Multi-account combining uses a MergeSession tied to an OIDC AuthRequest; required email ownership verification and valid 2FA codes protect access to accounts being combined.
- Shopify used ActiveOperation to isolate complex account-combining business logic into testable operation classes, and added WebAuthn support for physical security keys.