Aaron Parecki

Stephan https://twitter.com/Stephan007 • Jun 6
Nice write up! Question: if an authenticated user gets a new/extra role, does the server create a new JWT or is there a way to update the existing token?

The analogy continues... with JWT access tokens, that's like encoding access data into the hotel key card. You'd have to go back to the front desk to get a new card.

Portland, Oregon

Thu, Jun 6, 2019 12:12pm -07:00
Stephan https://twitter.com/Stephan007 • Jun 6
Nice write up! Question: if an authenticated user gets a new/extra role, does the server create a new JWT or is there a way to update the existing token?

The answer is it depends on how your access tokens / hotel key cards are implemented!

Portland, Oregon

Thu, Jun 6, 2019 12:11pm -07:00
Wizages - Sam Patzer https://twitter.com/Wizages • Jun 6
Do you know where you can find the .well-known/openid-configuration on the apple url?
Do they even use it?

I haven't found it yet. I wouldn't be surprised if they just don't have that endpoint

Portland, Oregon

1 like 4 replies

Thu, Jun 6, 2019 10:46am -07:00
Gokul Thirumalai https://twitter.com/gokult • Jun 5
Thanks Alex. Where do you see the biggest gap that will help you push forward?

The docs are also wrong in a few places. Happy to provide details via DM or email.

Portland, Oregon, USA

Wed, Jun 5, 2019 4:45pm -07:00
Gokul Thirumalai https://twitter.com/gokult • Jun 5
Thanks Alex. Where do you see the biggest gap that will help you push forward?

I have so many questions for you! I was able to create a proof of concept, but would love to know some of the missing details. The current documentation is not complete enough to make a working app, I had to guess things based on my knowledge of OIDC.

https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon, USA

1 reply

Wed, Jun 5, 2019 4:40pm -07:00
Nate Angell https://twitter.com/xolotl • Jun 5
Lawyer at @indiewebcamp: "Why isn't anyone at my GDPR unconference session?"

you joke, but: https://indieweb.org/2018/D%C3%BCsseldorf/gdpr

Portland, Oregon, USA

2 likes 1 repost 2 replies

Wed, Jun 5, 2019 12:41pm -07:00
Simon Rice https://twitter.com/_SimonRice • Jun 5
Excellent thread - just to clarify with another example since Google do identity & calendar - if my app needs OAuth to (say) read playlist data specifically from Spotify via their dev API & do nothing whatsoever user ID related with them, I don’t need “Sign In With Apple”?

Yes that is my understanding reading their guidelines. Of course this remains to be seen how it will play out in practice.

Portland, Oregon

2 likes 1 reply

Wed, Jun 5, 2019 10:33am -07:00
AngeloStavrow https://micro.blog/AngeloStavrow • Jun 5
@aaronpk This is a great resource, thanks! Is sign-in still working for you, though? I'm seeing the Apple sign-in page throw an error in my testing after I authenticate (though it's possible there's an error in the setup).

It's working with the first app I registered in the portal, but hasn't worked with new app IDs I've made since! I'm guessing some weird Apple but that they'll probably fix soon. This is all clearly very early beta right now.

Portland, Oregon

1 reply

Wed, Jun 5, 2019 9:14am -07:00
Amirsh https://twitter.com/A_sharif90 • Jun 5
Sorry @aaronpk, I got a bit confused. Maybe my question is very simple, so the purpose of login with apple is for authentication or not? You called it Oauth provider as they don't have a user_info endpoint?

Yes it seems to be designed for authentication only. They do also return an OAuth access token and refresh, though I am not sure what you can do with that yet.

Portland, Oregon

3 likes

Wed, Jun 5, 2019 6:46am -07:00
Daniele Vistalli https://twitter.com/DanieleVistalli • Jun 5
Now I would just love to have a quick guide for using Apple Sign In as an Okta generic oidc inbound provider. Is this possible already ?

I actually just got this working last night!

Portland, Oregon

1 like 3 replies

Wed, Jun 5, 2019 6:34am -07:00
Dan Grover https://twitter.com/DanGrover • Jun 4
I can see this giving users a lot of rope to hang themselves, too. If you are trying to use any cross-platform service, you now have no way to log in on a non-Apple device or recover your account.

It's just OAuth, and it works on the web too. https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon, USA

5 likes 1 repost 1 reply

Tue, Jun 4, 2019 8:16pm -07:00
Michael Warkentin https://twitter.com/mwarkentin • Jun 5
@Threadreaderapp unroll

already did that myself 😉 https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon, USA

4 likes 1 repost

Tue, Jun 4, 2019 5:16pm -07:00
André Neves https://twitter.com/andreneves • Jun 4
So now services/apps need to handle OAuth, Apple SSO, and regular email/pass. Feels like more mental burden for developers.

Also turns out Apple's is also OAuth :-) https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon

2 likes

Tue, Jun 4, 2019 3:42pm -07:00
André Neves https://twitter.com/andreneves • Jun 4
Feels a lot like another way to lock users inside of the Apple world. How is this any better than signing up with any other service like Google or Facebook (for OAuth for example). It has some nice 'privacy' features but it feels like a marketing stunt more than anything imo

It's more about providing easier options for users: https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon

2 likes 2 replies

Tue, Jun 4, 2019 3:42pm -07:00
complexmix https://twitter.com/thatonehacker5 • Jun 4
It will be set as the default (knowing Apple) and will make all other options so inconvenient that apple users will essentially have one choice. Just like how you can use Chrome on iOS, but they make it as inconvenient as possible to avoid the POS that is Safari.

It's still up to the app to provide the buttons. Check out the sample walkthroughs in that blog post.

Portland, Oregon

1 reply

Tue, Jun 4, 2019 3:27pm -07:00
complexmix https://twitter.com/thatonehacker5 • Jun 4
Ah yes, take away the freedom of choice

In contrast: this forces app developers to provide users the choice between Apple or some other sign-in, rather than letting developers require just e.g. Facebook login.

More: https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon, USA

2 likes 2 reposts 1 reply

Tue, Jun 4, 2019 3:16pm -07:00
Halyna https://twitter.com/Halyna_13 • Jun 4
No, you don’t need an Apple device for 2FAuth of Apple ID. They send an SMS to authenticate the new login.

Confirmed. I was able to create a brand new Apple ID, enroll a Google Voice phone number for 2FA, and never touch this account from an iOS device.

Portland, Oregon

6 likes 2 replies

Tue, Jun 4, 2019 1:25pm -07:00
Stefan Esser https://twitter.com/i0n1c • Jun 4
you still need a trusted apple device to use Apple 2FA in addition to trusted phone number, don’t you?

I honestly don't know. But also keep in mind this is primarily designed for logging in to iOS apps, so ppl can log in with their Apple account instead of their Facebook account, which is a win for user privacy.

Portland, Oregon

Tue, Jun 4, 2019 1:12pm -07:00
Stefan Esser https://twitter.com/i0n1c • Jun 4
yes and how are you supposed to get through the Apple 2FA protection without an Apple device?

via SMS or phone call

> A trusted phone number is a number that can be used to receive verification codes by text message or automated phone call. You must verify at least one trusted phone number to enroll in two-factor authentication.

https://support.apple.com/en-us/HT204915

Portland, Oregon

4 likes 2 replies

Tue, Jun 4, 2019 12:57pm -07:00
Stefan Esser https://twitter.com/i0n1c • Jun 4
because you want to actually login to a service from an android device

That's not how it works. It works like every other OAuth flow, you click the button and are redirected to Apple to sign in. Here's a full walkthrough with screenshots: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon

4 likes 8 replies

Tue, Jun 4, 2019 12:54pm -07:00

older