Multi-Factor Authentication (2FA/MFA) for OpenCart

Last updated on October 16, 2024

Overview of MFA for OpenCart

The purpose of this document is to enable Rublon Two-Factor Authentication (2FA) for users logging in to OpenCart. In order to achieve that, you have to use Rublon Access Gateway. All required steps will be described in this document.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
WebAuthn/U2F Security Key	✔	N/A
Passcode	✔	N/A
SMS Passcode	✔	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	✔	N/A
Email Link	✔	N/A
YubiKey OTP Security Key	✔	N/A

Before you start

You need to install and configure Rublon Access Gateway itself before configuring OpenCart to work with it. Please read the Rublon Access Gateway documentation and follow the steps in the Installation and Configuration sections. Afterward, follow the appropriate Configuration section in this document.

Configuration of MFA for OpenCart

Follow these steps to enable Rublon 2FA in OpenCart.

OpenCart

1. Download the SAML 2.0 Single Sign On plugin.

2. Log in to the OpenCart admin panel.

3. Go to Extensions → Installer.

4. Click the Upload button and select the previously downloaded plugin zip file.

5. If you have added the plugin correctly, you should see the following info: Success: You have modified extensions!.

6. Go to Extensions → Extensions.

7. Select Modules in the extension type dropdown.

8. MiniOrange SAML SP will appear on the modules list. Click the + (plus) button to start the installation.

9. After a successful installation, click the Edit (pen) button.

10. Enter a name for your application, e.g. Rublon. This name is displayed when logging in to OpenCart.

11. Set Status to Enabled.

Note

Write down the values of SP Entity ID and ACS Url from the Service Provider Metadata tab. You are going to need these values later.

12. Select the Identity Provider Setup tab and fill in the form. Refer to the following image and table.

Entity ID	Enter the value of Entity ID from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
Single Login URL	Enter the value of SSO URL from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
SAML x509 Certificate	The certificate you have downloaded from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE). Open the downloaded certificate in a text editor. Copy the entire contents and paste it into the text field.

13. Select the Attributes Mapping tab.

14. If you have a custom First name and Last name, define them. Otherwise, leave the fields blank.

15. Click the Save button in the upper right corner to save the changes.

16. Go to Design → Layouts.

17. Edit the Account layout.

18. You have to add MiniOrange SAML SP module to your view layout by choosing store ID and position. Select MiniOrange SP in the dropdown and click the + button to the right.

19. Click the Save button in the upper right corner to save the changes.

Rublon Access Gateway

1. Log in to Rublon Access Gateway.

2. Go to Applications → Add application.

3. Fill in the form and click SAVE to add a new application. Refer to the following image and table.

Application name	Enter a name for the application, e.g. OpenCart. The name will be displayed during Rublon 2FA.
Entity ID	Enter the SP Entity ID from the Service Provider Metadata tab in OpenCart. This is one of the values you have written down before.
Assertion Consumer Service	Enter the ACS Url from the Service Provider Metadata tab in OpenCart. This is one of the values you have written down before.
Single Logout Service	Unfortunately, the SAML 2.0 Single Sign On plugin does not support SLO. The field is required, so enter, e.g. the address of OpenCart domain.
NameID format	Set to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
NameID attribute	mail
Send Attributes	Select NameID.
Signature algorithm	Select sha512.
Validate AuthnRequest	Uncheck.
Sign response	Check.
Sign assertion	Check.
Certificate for signing	Select the certificate you have downloaded from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE.
Certificate for encryption	Select the certificate you have downloaded from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE.
Map attributes	If users’ email addresses are defined in a field other than mail, then the attribute has to be mapped to mail. Otherwise, leave blank.

4. Your configuration is complete. You should now test your setup by logging in to OpenCart.

Testing MFA for OpenCart

1. Go to My Account → Register. You should see an additional login button. The name of this button depends on the application name you set in Step 10 of the OpenCard section.

2. Go to My Account → Login. The same login button should be visible.

3. Click the Login with Rublon button to initiate Rublon 2FA. You will be redirected to Rublon Access Gateway login page.

4. Provide your username and password. Click SIGN IN. A window should appear with a selection of various 2FA options from Rublon. Let’s choose Mobile Push.