WeChat ID
aaronpk_tv
Monday, June 3, 2019
-
-
-
📷 PhotoJoseph 🎥
https://twitter.com/photojoseph
•
Jun 3
DIRECT IMPORT INTO LIGHTROOM ON iPadOS!!!!!! Finally. Fi. Na. Lly.
I definitely thought of you when they announced that! -
Initial test of the "Sign in with Apple" API:
• It's more or less based on OAuth + OIDC
• Their documentation is missing a lot of key info to use it right now, I had to guess at a lot of things
• The `sub` claim includes some sort of unique user identifier, not an email -
Aaron Parecki
https://aaronparecki.com/
•
Jun 3
Initial test of the "Sign in with Apple" API:
• It's more or less based on OAuth + OIDC
• Their documentation is missing a lot of key info to use it right now, I had to guess at a lot of things
• The `sub` claim includes some sort of unique user identifier, not an email
weirdnesses:
• Their token endpoint requires setting a User-Agent header, otherwise responds with an HTML error
• Client secrets are a signed JWT using ECDSA + SHA256
• An email address isn't returned even when requesting the `email` scope -
Marc Köhlbrugge
https://twitter.com/marckohlbrugge
•
Jun 3
Some ppl pointed out this is probably “just” an implementation of OAuth w/ email forwarding on top.
That’s probably correct. However, what sets Apple apart from the other major OAuth providers (mainly Facebook & Google) is that Apple is not in the business of selling your data.
I just tried it out and it's OAuth + OpenID Connect with a little bit of Apple uniqueness sprinkled in. -
They have some docs here https://developer.apple.com/sign-in-with-apple/get-started/ but their docs are missing quite a bit right now. I had to guess at some endpoints and things.
-
@fluffy
https://queer.party/@fluffy
•
Jun 3
@aaronpk I wonder what the underlying protocol is and if anyone can join in as an identity provider. I'm not any more enamored with Apple as identity service as with Twitter or Facebook.
It's OAuth + OIDC, and they are becoming an identity provider with this. I do think they're better for this than Twitter/Facebook since they aren't in the business of selling user data. -
Aaron Parecki
https://aaronparecki.com/
•
Jun 3
weirdnesses:
• Their token endpoint requires setting a User-Agent header, otherwise responds with an HTML error
• Client secrets are a signed JWT using ECDSA + SHA256
• An email address isn't returned even when requesting the `email` scope
If you're interested, here is my sample code I was able to use to get an access token and ID token from Apple
https://github.com/aaronpk/sign-in-with-apple-example -
@fluffy
https://queer.party/@fluffy
•
Jun 3
@aaronpk Cool that they're using an open protocol! I still wish it were one with a better federation story though. Anyone should be able to provide any identity to anyone, rather than being beholden to the handful that any given website decides to support.
I totally agree! https://indieauth.net/ -
So far there is no indication that'll be possible.
-
So far there's no docs on what you can do with the access token. I suspect using it may require also including the client_secret which is a signed JWT, or who knows. Here's the working code: https://github.com/aaronpk/sign-in-with-apple-example
-
Not that I've been able to find! Also can't find their userinfo or introspection endpoints. I also had to guess their authorization endpoint because it's not in their docs.
-
Ben Sandofsky
https://twitter.com/sandofsky
•
Jun 3
Wow. Apple sign-in support is mandatory? https://developer.apple.com/news/?id=06032019j
Sounds like they are requiring Apple Sign-In to be an option if any other third party sign-in is also provided. Good move IMO, better for users! This will stop apps from having just a "Sign in with Facebook" option. -
Dana Fried
https://twitter.com/leftoblique
•
Jun 4
Isn't there a single open standard being used under the hood by most of the big sign in providers now? I was under the impression that they're all OAuth or something?
I've been testing out the new API and it's definitely OAuth/OpenID Connect. But it's true that this will add more work for developers, both just getting this set up and also dealing with a new kind of account identifier. -
1/ On the occasion of the launch of @apple's "Sign in with Apple," allow me to indulge in a walk down a memory lane called @MozillaPersona -- the project I loved and led at Mozilla 6-8 years ago, the project that broke my heart. This is my take, I'm sure it's incomplete.
-
Seth A. Roby
https://twitter.com/TALlama
•
Jun 4
I haven’t looked into the tech specs yet; but I’m assuming it’s just WebauthN or OAuth under the hood. If so it shouldn’t be hard to support. -
Brandon Carroll
https://twitter.com/bcarroll22
•
Jun 4
If you have a native and a web app, and a user creates their account with Apple sign in through your app, I wonder how you sign in with that account in your web app? Is Apple sign in basically just oauth with a fake email address you don’t know? And what’s your password?
It's just OAuth. Sign In with Apple isn't limited to mobile apps. Here's a demo of doing it in a web app. https://github.com/aaronpk/sign-in-with-apple-example
