With Single Sign-On (SSO), customers can log in to your online store using their existing company account. This guide applies to SAML 2.0 for customer login, not for store administrators' login. SSO is offered as an add-on in Abicart Pro and needs to be activated by Abicart Support. Ask support to confirm the service's price and scope for your store.
Check for Abicart Pro and confirmed SSO activation. Have an administrator from your identity provider on hand.
Create the connection in Abicart, exchange metadata with the identity provider, and save the attribute mapping.
Test the correct store, new and existing customers, and their customer groups before SSO is required for everyone.
Then, choose whether to keep standard password login. Automatic redirection and blocking other login methods are two different settings.
Choose the right type of connection
SAML 2.0 uses metadata and attribute mapping as described in “Configure SSO in four steps”. OAuth2 and OpenID Connect (OIDC) use different settings. If you want to reuse an existing login from another website, support must first confirm which connection is suitable; do not paste SAML metadata as a solution for an OIDC flow.
See the SSO add-on for Abicart Pro for the service's commercial information. The steps on this page apply to the SAML connection.
What you'll need
Have the following ready before you start:
Access to the administration panel of your identity provider, such as Azure AD, Google Workspace, or Okta
SAML metadata as XML or a URL from the identity provider
SSO activated on your Abicart account by Abicart Support
Administrator permissions in Abicart Admin
Configure SSO in four steps
1 Create your SSO configuration in Abicart Admin
Go to Settings > Single-Sign-On in Abicart Admin and add a new configuration. Give it a name, for example, your company's name, and save.
When you save, Abicart's metadata URL for the configuration is created. You can find it on the same page under URL to Abicart metadata. Copy the URL directly. You don't need to type anything or fill in any IDs manually.
✓
Tip Keep this page open in a tab. In step 3, you will return here and paste the metadata from the identity provider.
2 Create a SAML application with the identity provider
Create a new SAML application for the online store with your identity provider, for example, Microsoft Azure AD. Then paste the Abicart metadata URL that you copied in step 1.
✓
Tip In Azure AD, the identity provider's metadata URL, which you need in step 3, usually looks something like this:
https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml?appid={app-id}
3 Enter the identity provider's metadata in Abicart
Go back to the SSO configuration from step 1 and fill in the following:
Identity provider's metadata (XML or URL)
Metadata as XML or a URL from the identity provider in step 2.
Mapping
Attribute mapping in JSON format. See the default mapping below.
Default mapping for Microsoft Azure AD:
{
"sub": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
"name": "http://schemas.microsoft.com/identity/claims/displayname",
"family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
"given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
}Check which customer account the login opens. The value in sub identifies the customer account. Verify that the value is unique to the correct person and comes from the trusted identity provider. Do not change the mapping for existing customers without first checking how their accounts should be linked. A successful login is not enough: check the correct customer account, order history, and permissions for both new and existing customers.
The most important settings:
Active: Must be enabled. Otherwise, the configuration will not work.
Create missing customer on login: Enable this setting if a customer account should be created automatically when the customer logs in for the first time.
Update existing customer on login: Enable this setting if the customer details should be updated from the identity provider on login.
No other login methods allowed: Leave this setting disabled if standard password login should still be possible. More information is available below.
4 Save and test
Click Update to save and then on Test to try the login flow. First, test with a designated test account. Check a new and an existing customer, the correct customer group, and which store the customer ends up in. If it doesn't work, compare the metadata URLs and attribute mapping with what the identity provider actually sends. Keep an agreed-upon fallback path for customer login until the tests are complete.
Using SSO in a multi-store
Each online store has its own SSO configuration. This means that different online stores within the same multi-store can have different login solutions.
Store A can require SSO for all users.
Store B can offer both SSO and standard login with a password.
Store C can continue to use only standard password login.
SSO configuration and automatic redirection are set per online store. Other stores keep their own login settings. However, customer accounts can be shared with the main store. If the setting Update existing customer on login is enabled, the name and email address on the shared customer account can be updated upon SSO login in a sub-store. Therefore, also check how the update affects the same customer account in the other stores where it is used. Separate SSO settings do not automatically mean separate customer registries.
Choose how customers log in
The login can be configured in three different ways, from the most flexible option to the most restrictive. Choose the solution that best matches how your customers should log in.
1. SSO as the primary login method
Customers log in via the identity provider. This option is suitable when SSO is to be the primary login method, but customers do not need to be automatically redirected as soon as they visit the store.
Can be configured in Admin: configure and test the SSO connection directly in Abicart Admin.
2. SSO and standard login are displayed together
Customers see both options on the login page and can choose between SSO and standard login with an email address and password. The login page needs to be configured to display both options.
Requires help from Abicart Support: contact support to configure a login page that offers both options.
3. SSO is required for everyone, with no standard login alternative
Customers who are not already logged in are automatically redirected to SSO as soon as they visit the store, before they reach the standard login page. Therefore, it is not possible to use password login as a fallback solution.
Requires help from Abicart Support: contact support to add automatic SSO redirection to the active theme.
!
Only choose this option if all customers should log in via the identity provider. The automatic redirection prevents customers from reaching the standard login page.
i
About the “No other login methods allowed” setting This setting is separate from the automatic redirection. Enable it only if other login methods should be completely blocked, even via a direct link to the standard login page.
Customer groups based on SSO configuration
If multiple SSO configurations are linked to the same online store, each configuration can automatically place customers in its own customer group. This makes it easier for multiple companies to use the same online store and at the same time get different prices, product ranges, or other customer group-specific settings.
Example:
Customers who log in via the SSO configuration for Company A can be placed in the customer group A Staff.
Customers who log in via the SSO configuration for Company B can be placed in the customer group B Staff.
Customers who log in via the SSO configuration for Company C can be placed in the customer group C Staff. The connection is made per SSO configuration, not by having any email domain automatically select the customer group.
The customer group is assigned when the customer logs in through the relevant SSO configuration, for both new and existing customer accounts. The assignment adds the selected group; it does not mean that the customer's other groups are removed. Therefore, check the customer's combined groups and what prices and product ranges they provide access to.
Available in Admin: each SSO configuration can be linked to its own customer group via the setting Assign to customer group.
Important URLs
Abicart's SSO metadata
https://saml.abicart.com/{SHOP_ID}/{SSO_ID}/meta
URL for testing and SSO login
https://saml.abicart.com/{SHOP_ID}/{SSO_ID}
SSO settings in Admin
Abicart Admin > Settings > Single-Sign-On. Check the correct store and the names of existing configurations if you cannot find the connection you are looking for.
Need help?
Whether you are configuring your first SSO connection, using multiple identity providers, or planning a solution for a multi-store, we are happy to help.
Contact Abicart Support, and we will help you with the configuration.
Troubleshoot the login
Symptom | Check and next steps |
The SSO configuration cannot be found | Check the selected store, permissions, and the configuration's name. A missing menu item does not prove that an existing SSO connection is disabled. Contact support if you still cannot find it. |
The identity provider rejects the login | Ask your IT administrator to check the assigned user, current metadata, certificate, Identifier/Entity ID, and Reply URL/ACS against Abicart's metadata. Do not use example addresses from another application. |
Login works but the customer gets the wrong group or product range | Check which SSO configuration the customer used, its setting Assign to customer group and the customer's existing groups. Log in again after making a correction and check the result in the correct store. |
Standard login cannot be reached | Check both the automatic redirection in the theme and No other login methods allowed. Get help from support and your IT administrator before enabling more restrictions. |
When contacting support: provide the store, configuration name, time, error message, and whether the error occurs with the identity provider or in Abicart. Do not send passwords, login tickets, or an unedited SAML response with customer data in a regular support request.