PingOne

Provisioning Shopify with PingOne

Shopify is a commerce platform that supports System for Cross-domain Identity Management (SCIM) 2.0 provisioning for Shopify Plus organizations. By using the Shopify connection in PingOne, you can provision users and selected role or membership assignments from PingOne to Shopify.

The Shopify connection is outbound only. Changes made directly in Shopify are not synchronized back to PingOne.

Resource Capability Description Inbound Outbound

User

Create

Creates a Shopify SCIM user.

No

Yes

Read

Reads users and their current state.

No

Yes

Update

Limited support. Users can be activated or deactivated, but attributes such as username and email cannot be updated.

No

Limited

Deactivate or reactivate

Changes the SCIM active state.

No

Yes

Delete

Deletes a user when the selected remove action and Shopify behavior allow it.

No

Yes

Group or role

Create, rename, or delete

Group and role objects are not managed by this connector.

No

No

Membership

Add or change

Creations and updates are fully supported.

No

Yes

Remove

Membership removal is supported only by deactivating the user.

No

No

Configure Shopify provisioning to synchronize users and selected membership assignments from PingOne to a Shopify Plus organization.

Before you begin

Make sure you have:

  • A Shopify Plus organization with SCIM provisioning enabled.

  • The Shopify SCIM service URL for the organization. The tested endpoint is https://shopifyscim.com/scim/v2.

  • A Shopify SCIM API token. Treat the token as a secret.

  • A PingOne population or group containing the users that you want to provision.

  • Shopify groups or roles created before membership provisioning in Shopify tenant. The Shopify connection cannot create, rename, or delete these objects.

  • Matching group names and casing in PingOne and Shopify. Shopify uses the mapped group name as the role value.

Steps

Create a Shopify connection by completing the following:

  1. In the PingOne admin console, go to Integrations > Provisioning.

  2. Click and then click New Connection.

  3. Click Select for Identity Store.

  4. On the Shopify tile, click Select. Click Next.

  5. Enter a Name and Description for this provisioning connection.

  6. Click Next

  7. In the Configure Authentication section, select Token Authentication and enter the following Shopify connection values:

    Field Value

    Service URL

    The Shopify SCIM service URL

    For example: https://shopifyscim.com/scim/v2

    Authentication method

    TOKEN

    SCIM token

    The Shopify SCIM API token

    For example: ptkn_85c565975636f55b648fe9b0df6a97802263e63…​

  8. Click Test connection to verify that PingOne can establish a connection to Shopify.

  9. In User Actions, configure the lifecycle actions that you need:

    • Create users

    • Update users, with the limitations described in this document

    • Disable users

    • Deprovision users

    • Deprovision users on rule deletion

    • Remove action: choose Disable for reversible deprovisioning or Delete when permanent deletion is intended and supported by your policy

  10. Click Save.

  11. Enable the connection using the toggle in the details panel.

Create an outbound provisioning rule by completing the following:

  1. Create an outbound rule and select the Shopify connection as the target.

  2. Select the PingOne population or group whose users should be provisioned.

  3. Add attribute mappings for the fields that you want to synchronize.

  4. Configure membership mapping only after the corresponding Shopify groups or roles exist.

  5. Click Save and enable the rule.

Shopify attribute mapping

Use the following outbound mapping examples for the Shopify connection:

PingOne Directory Shopify connector attribute Purpose

Email Address

email

Primary email address and source for the Shopify SCIM userName

Given Name

firstname

User’s first name

Family Name

lastName

User’s last name

Enabled

active

Controls the user’s active state

Group names

roles

Assigns a Shopify role or group name

The Shopify implementation derives the target SCIM userName from the synced email. There is no separate username mapping in the connection. Keep the email and username values stable after creation whenever possible.

For membership provisioning, map Group Names to roles. The Shopify group name must already exist and must match the PingOne group name and casing. A group can contain multiple users, but rights to a user’s Shopify roles have the limitations described in membership provisioning behavior.

Limitations

The following limitations apply to the Shopify provisioning:

User profile updates

  • Users can be created successfully, but their first name, last name, email address, and username cannot be reliably changed afterward. The update might appear successful, but the old values remain.

  • Deactivating or reactivating a user works when performed by itself. However, if it is done together with other profile changes, the status change might not take effect.

Group and role management

  • The connection cannot create, rename, or delete Shopify groups or roles because Group sync support is not present.

  • One user can only have one membership in Shopify but multiple users can be part of one group.

  • Removing a membership in PingOne doesn’t remove it from Shopify. To remove the membership, the user needs to be deactivated.

  • If a Shopify group associated with a user is deleted directly in Shopify, the next synchronization will fail instead of simply removing the membership.

Provisioning direction

  • The connection supports outbound provisioning only, from PingOne to Shopify.

  • Changes made directly in Shopify are not synchronized back to PingOne.

  • Two-way synchronization is not supported.

Duplicate users

  • If a user with the same username or email already exists, Shopify returns the existing user instead of creating a new one.

  • The operation might still appear successful, so it can be difficult to determine whether a new user was created or an existing user was reused.