Single sign-on (OAuth2)

Single sign-on (SSO) lets your storefront customers log in using their existing accounts from external identity providers instead of creating a separate PrintNow username and password. The integration uses the OAuth 2.0 protocol and supports three built-in providers (Facebook, Google, Microsoft) as well as fully custom OAuth2/OpenID Connect providers.

SSO is configured per-storefront. When a provider is active, a login button for that provider appears on the storefront login page beneath the standard username/password form. On first login, PrintNow automatically creates a customer account linked to the external identity. On subsequent logins, the customer is matched by email address and authenticated without a password.

View Providers

1. From your Unified Admin, go to Partner Integration > Single sign-on (OAuth2).
2. The provider list shows all configured OAuth2 providers for the current storefront in an AG Grid table.
3. Use the Action menu on any row to Toggle State (activate/deactivate) or Delete a provider.

Provider List Columns

Add a Built-in Provider

Built-in providers (Facebook, Google, Microsoft) come with pre-configured OAuth2 endpoints, scopes, and user info key mappings. You only need to supply the Client ID and Client Secret from the provider's developer console.

1. Click Add Provider in the header.
2. From the Providers dropdown, select Facebook, Google, or Microsoft.
3. Enter the Client Id and Client Secret obtained from the provider's developer portal.
4. Click Save.

Each built-in provider can only be added once per storefront. Attempting to add a duplicate throws an error.

Where to Get Credentials

Add a Custom Provider

Custom providers allow you to configure any OAuth2-compliant identity provider with full control over endpoints and user info field mappings.

1. Click Add Provider in the header.
2. From the Providers dropdown, select Custom.
3. Fill in the configuration fields (see table below).
4. Click Save.

Custom Provider Fields

The custom provider form is split into two columns:

Manage Providers

Toggle Active State

From the provider list, click the Action menu on any row and select Toggle State. Active providers show a login button on the storefront. Deactivated providers remain configured but are hidden from the login page.

Delete a Provider

From the provider list, click the Action menu and select Delete. A confirmation dialog appears. Deleted providers are soft-deleted (marked as deleted in the database) and no longer appear in the list. Existing customer accounts linked to the deleted provider are not affected — those customers can still log in with their PrintNow username and password.

Authentication Flow

When a customer clicks an SSO login button on the storefront, the following happens:

1. The customer is redirected to the provider's authorization endpoint with the configured scopes and a callback URL of /oauth2 on your storefront domain.
2. After the customer authenticates with the provider, they are redirected back to your storefront with an authorization code.
3. PrintNow exchanges the code for an access token at the provider's token endpoint.
4. PrintNow calls the user information endpoint to retrieve the customer's email, name, and ID.
5. PrintNow looks up an existing customer account by email address. If no match is found, a new customer account is created automatically with a randomly generated password.
6. The customer is logged in via a forms authentication cookie and redirected to their original destination.

If offline access is enabled and the provider returns a refresh token, PrintNow stores the OAuth2 credentials and automatically refreshes expired tokens on subsequent requests.

Associations

Print Store

Related Pages

• Users — manage customer accounts created through SSO login
• Settings — configure storefront settings including authentication options