Book a Meeting
Book a Meeting

Single Sign-On (SSO) Plugin for nopCommerce

New
81% Off
Picture of Single Sign-On (SSO) Plugin for nopCommerce
*
*
Old price: $99.00
$19.00
Create ticket
Simplify store access with nopStation's Single Sign-On Plugin for nopCommerce. Let employees and B2B customers log in using their existing work accounts, automatically manage roles and price tiers, and improve security with Microsoft, Google, Okta and other identity providers.
Product tags
Documentation

nopStation Enterprise Single Sign-On

Enterprise Single Sign-On for nopCommerce

Let employees, wholesale buyers and partners sign in to your store with the Microsoft, Okta, Google or other work account they already use. Customer roles and price tiers follow your directory—and sign-in runs directly between your store and your identity provider, with no third-party broker.

  • SAML 2.0 & OpenID Connect
  • 9 IdP presets + Generic
  • Group-to-role & price-tier mapping
  • Optional SCIM 2.0 provisioning
Book a Demo Documentation

Runs inside your nopCommerce store · IIS, Linux or Docker · Multi-store ready

nopCommerceSSO Gateway Microsoft EntraAzure AD / M365 OktaWorkforce Identity Microsoft ADFSOn-Premises (SAML) JumpCloudCloud Directory Google WorkspaceWorkspace Domains Auth0OIDC Applications KeycloakOpen-Source IAM Ping IdentityPingFederate / PingOne OneLoginCloud IAM Custom SAML & OIDCAny SAML / OIDC IdP
nopCommerce GatewayEnterprise SSO Hub
SAML + OIDCMicrosoft EntraAzure AD / M365 SAML + OIDCOktaWorkforce Identity SAML + OIDCGoogle WorkspaceWorkspace Domains SAMLMicrosoft ADFSOn-Premises (SAML) OIDCAuth0OIDC Applications SAML + OIDCKeycloakOpen-Source IAM SAML + OIDCPing IdentityPingFederate / PingOne SAMLJumpCloudCloud Directory SAML + OIDCOneLoginCloud IAM SAML + OIDCCustom SAML & OIDCAny SAML / OIDC IdP

Direct sign-in · No third-party broker

The Problem

Store logins weren’t built for organizations

The moment you sell to businesses or run a staff store, separate store passwords create extra work for your team and extra risk for your customers.

Yet another password

Staff and buyers juggle one more login, forget it, and open support tickets. Weak or reused passwords become your security problem.

Manual approvals and roles

Someone has to verify each new B2B account and assign the right customer role or price tier by hand—slowly, and not always correctly.

Access that outlives the job

When someone leaves their company, their store account keeps working until somebody remembers to disable it.

nopStation SSO hands sign-in to the directory your customers’ organizations already manage. Access and roles follow it at every sign-in, and optional SCIM deactivates accounts as soon as someone leaves.

What You Get

Enterprise SSO for nopCommerce—without a broker

A plugin that lives inside your store, speaks SAML 2.0 and OpenID Connect, and keeps control, data and sign-in traffic on your own infrastructure.

Works with your identity provider

Guided presets for the major providers, plus Generic for any other SAML 2.0 or OIDC directory. Connect several at once.

  • Metadata & discovery import
  • Several IdPs active at once
  • Scoped per store

Secure by default

Untrusted issuers, invalid certificates, blocked domains and risky email matches are rejected or held for review—so mistakes fail closed.

  • Issuer, signature & certificate checks
  • Domain and claim policies
  • Approval queue for email collisions

Roles that match the business

Directory groups become nopCommerce customer roles at every sign-in. Add SCIM to keep accounts aligned as people join or leave.

  • Role sync and revocation
  • B2B price-tier mapping
  • Optional SCIM 2.0 lifecycle

You stay in control

No SaaS broker in the middle. Deploy with your store on IIS, Linux or Docker, and keep an emergency admin login if the IdP is down.

  • Direct browser ↔ IdP ↔ store flow
  • Audit log stored with your data
  • Break-glass admin access

Supported identity platforms

Presets fill in the right endpoints and claim names for major providers. Generic covers any other standards-based SAML 2.0 or OpenID Connect directory.

  • Microsoft Entra ID / Microsoft 365
  • Okta
  • Google Workspace
  • Keycloak
  • Auth0
  • OneLogin
  • Ping Identity
  • Microsoft ADFS (SAML)
  • JumpCloud
  • Generic SAML 2.0 / OIDC

Generic is designed for providers such as Shibboleth, Salesforce, ForgeRock, CyberArk and SiteMinder—check claim and role mapping in the built-in simulator before go-live. WS-Federation is not supported; use SAML 2.0 or OIDC instead.

How It Works

Live in three steps

Setup happens in nopCommerce Admin—no custom code.

  1. Connect your identity provider

    Choose a preset or Generic, import the metadata or discovery URL, and copy the store’s redirect / ACS URL into your IdP.

  2. Map roles and set policies

    Map directory groups to customer roles and price tiers, choose how existing accounts are linked, and test it all in the simulator.

  3. Go live and stay audited

    Staff and buyers sign in with their work account. Every sign-in, role change and rejection is recorded in the audit log.

For Store Operators

Run SSO from nopCommerce Admin

Configure providers, approve risky links and see why a sign-in was blocked—without leaving your store’s admin area.

Manage

Provider setup in Admin

Basic and Advanced setup modes, metadata import, and a simulator to check claim and role mapping before go-live.

Govern

Links, approvals & rejections

See which customers are linked to which IdP, approve email collisions, and see exactly why a sign-in was blocked.

Prove

Audit trail in your store

Searchable history of sign-ins, role changes and configuration updates, kept with your nopCommerce data.

Recover

Emergency admin login

Administrators can still reach Admin if the identity provider is unavailable or storefront password login is turned off.

Use Cases

Built for the stores that need SSO most

B2B wholesale portals

Verified buyers land in the right customer role and contract price tier automatically—far fewer manual account approvals.

Tiered access

Employee & staff stores

Staff sign in with their work account, and company-domain rules decide who can buy.

Workforce access

Multi-store brands

Point each storefront at the right identity provider while customers and providers stay scoped per store.

Store isolation

Higher-assurance retail

Signed federation, dual-certificate support and an in-store audit trail for teams that face strict security reviews.

Audit-ready

For IT & Security Teams

Technical specifications

  • ProtocolsSAML 2.0 (incl. signed AuthnRequests) · OpenID Connect with PKCE
  • Identity providersPresets for 9 providers · Generic for other SAML / OIDC IdPs
  • Role mappingDirectory groups → customer roles and B2B price tiers at every sign-in
  • ProvisioningOptional SCIM 2.0 create, update and deactivate
  • Account linkingAutomatic, email-verified, or admin approval queue
  • Security checksIssuer, signature and certificate validation · domain and claim policies
  • Multi-storeEach provider available to all stores or selected stores
  • HostingRuns inside your nopCommerce app on IIS, Linux or Docker
  • Audit & recoveryIn-store audit log · break-glass admin login
  • Not supportedWS-Federation (use SAML 2.0 or OIDC instead)

Answers

Frequently asked questions

Do we need a third-party SSO broker or extra servers?
No. The plugin runs inside your nopCommerce application (.NET). Sign-in goes directly between the user’s browser, your identity provider and your store—there is no extra broker service in between, so no additional vendor processes your users’ sign-in data.
Can we connect several identity providers at the same time?
Yes. Run as many providers as you need side by side—for example Microsoft Entra ID for staff, Okta for wholesale distributors and Google Workspace for partners. Each provider has its own claim and role mapping and can be limited to specific stores.
What happens when an existing customer signs in with SSO using the same email?
You choose the policy: link automatically, require email verification first, or send the request to the Pending Link Approvals queue for an administrator. That way accounts are linked safely, without duplicate profiles or silent takeovers.
Does it support nopCommerce multi-store?
Yes. Each identity provider can be available to all stores or restricted to specific ones, so regional brands and subsidiaries can keep separate sign-in setups on one installation.
Which identity providers are supported?
Presets cover Microsoft Entra ID / Microsoft 365, Okta, Google Workspace, Keycloak, Auth0, OneLogin, Ping Identity, Microsoft ADFS (SAML) and JumpCloud. Generic connects other SAML 2.0 and OpenID Connect providers. WS-Federation is not supported. See Supported identity platforms.
What if our identity provider goes down?
Administrators keep an emergency (break-glass) login to nopCommerce Admin, so you can still run the store and adjust SSO settings while the identity provider is unavailable—even if storefront password login is turned off.
Do we need SCIM?
No—SCIM is optional. Roles already update every time someone signs in. Add SCIM 2.0 when you want accounts created, updated and deactivated as soon as changes happen in your directory, before the person signs in again.

Talk to nopStation

Ready to bring single sign-on to your store?

Book a call with our team to walk through your identity provider, store setup and role-mapping needs.

Book a Consultation See Our Other Products
Only registered users can write reviews

Have any questions or
need help?

  Secure Payments Via trusted payment channels/ Gateways.
  High Quality Products Professionals with 12+ years of work experience.
  100% Satisfaction Quality product with guaranteed satisfaction.
  24/7 Customer service Ready to help you at any time zone.
Information
Customer service
© 2026 nopStation by Brain Station 23. All rights reserved.
Powered by nopCommerce
Pay With : Supported Payment Methods
Alternate Text

Never Miss a nopStation Update

Enable notifications for new plugins, updates, and exclusive offers from nopStation.

Book a Meeting