Aaron Parecki

Tim Ysewyn @ 🇧🇪🏠 https://twitter.com/TYsewyn • Jun 6
Why should the role be in the token if you have the userinfo endpoint? Or why should there even be a (list of) role(s) in the token if it’s only a means to have access to an endpoint? 🤔

Some people like to use JWTs for access tokens or other self-encoded mechanisms. There are definitely trade-offs.

Portland, Oregon

Thu, Jun 6, 2019 12:20pm -07:00
https://rhiaro.co.uk/ https://toot.cat/@rhiaro • Jun 6
I once bought into the "if you don't post to your own website you don't have anything valuable to offer on technology" theory but eventually realised there are other things in tech and, shock horror, even the Web, than posting on your own website. I still see it being thrown around as an excuse to dismiss out of hand work that people don't understand immediately and find directly relevant to their specific needs though.
Posting this on my own website, so it must be true. https://rhiaro.co.uk/2019/06/theory

echoing the rest of that conversation, I think the larger point is the inverse.

If you *only* post your thoughts about decentralization on platforms that actively work against decentralization and cause real-world harm to people, then maybe it's okay to ignore those thoughts.

Portland, Oregon

Thu, Jun 6, 2019 12:17pm -07:00
Stephan https://twitter.com/Stephan007 • Jun 6
Nice write up! Question: if an authenticated user gets a new/extra role, does the server create a new JWT or is there a way to update the existing token?

if your access tokens are just a reference to a record in a database (the hotel key is just a number, and the doors look up access info in a central server), then you can update the roles in the existing token.

Portland, Oregon

Thu, Jun 6, 2019 12:13pm -07:00
Stephan https://twitter.com/Stephan007 • Jun 6
Nice write up! Question: if an authenticated user gets a new/extra role, does the server create a new JWT or is there a way to update the existing token?

The analogy continues... with JWT access tokens, that's like encoding access data into the hotel key card. You'd have to go back to the front desk to get a new card.

Portland, Oregon

Thu, Jun 6, 2019 12:12pm -07:00
Stephan https://twitter.com/Stephan007 • Jun 6
Nice write up! Question: if an authenticated user gets a new/extra role, does the server create a new JWT or is there a way to update the existing token?

The answer is it depends on how your access tokens / hotel key cards are implemented!

Portland, Oregon

Thu, Jun 6, 2019 12:11pm -07:00
Wizages - Sam Patzer https://twitter.com/Wizages • Jun 6
Do you know where you can find the .well-known/openid-configuration on the apple url?
Do they even use it?

I haven't found it yet. I wouldn't be surprised if they just don't have that endpoint

Portland, Oregon

1 like 4 replies

Thu, Jun 6, 2019 10:46am -07:00
Gokul Thirumalai https://twitter.com/gokult • Jun 5
Thanks Alex. Where do you see the biggest gap that will help you push forward?

The docs are also wrong in a few places. Happy to provide details via DM or email.

Portland, Oregon, USA

Wed, Jun 5, 2019 4:45pm -07:00
Gokul Thirumalai https://twitter.com/gokult • Jun 5
Thanks Alex. Where do you see the biggest gap that will help you push forward?

I have so many questions for you! I was able to create a proof of concept, but would love to know some of the missing details. The current documentation is not complete enough to make a working app, I had to guess things based on my knowledge of OIDC.

https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon, USA

1 reply

Wed, Jun 5, 2019 4:40pm -07:00
Nate Angell https://twitter.com/xolotl • Jun 5
Lawyer at @indiewebcamp: "Why isn't anyone at my GDPR unconference session?"

you joke, but: https://indieweb.org/2018/D%C3%BCsseldorf/gdpr

Portland, Oregon, USA

2 likes 1 repost 2 replies

Wed, Jun 5, 2019 12:41pm -07:00
Simon Rice https://twitter.com/_SimonRice • Jun 5
Excellent thread - just to clarify with another example since Google do identity & calendar - if my app needs OAuth to (say) read playlist data specifically from Spotify via their dev API & do nothing whatsoever user ID related with them, I don’t need “Sign In With Apple”?

Yes that is my understanding reading their guidelines. Of course this remains to be seen how it will play out in practice.

Portland, Oregon

2 likes 1 reply

Wed, Jun 5, 2019 10:33am -07:00
AngeloStavrow https://micro.blog/AngeloStavrow • Jun 5
@aaronpk This is a great resource, thanks! Is sign-in still working for you, though? I'm seeing the Apple sign-in page throw an error in my testing after I authenticate (though it's possible there's an error in the setup).

It's working with the first app I registered in the portal, but hasn't worked with new app IDs I've made since! I'm guessing some weird Apple but that they'll probably fix soon. This is all clearly very early beta right now.

Portland, Oregon

1 reply

Wed, Jun 5, 2019 9:14am -07:00
Amirsh https://twitter.com/A_sharif90 • Jun 5
Sorry @aaronpk, I got a bit confused. Maybe my question is very simple, so the purpose of login with apple is for authentication or not? You called it Oauth provider as they don't have a user_info endpoint?

Yes it seems to be designed for authentication only. They do also return an OAuth access token and refresh, though I am not sure what you can do with that yet.

Portland, Oregon

3 likes

Wed, Jun 5, 2019 6:46am -07:00
Daniele Vistalli https://twitter.com/DanieleVistalli • Jun 5
Now I would just love to have a quick guide for using Apple Sign In as an Okta generic oidc inbound provider. Is this possible already ?

I actually just got this working last night!

Portland, Oregon

1 like 3 replies

Wed, Jun 5, 2019 6:34am -07:00
Dan Grover https://twitter.com/DanGrover • Jun 4
I can see this giving users a lot of rope to hang themselves, too. If you are trying to use any cross-platform service, you now have no way to log in on a non-Apple device or recover your account.

It's just OAuth, and it works on the web too. https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon, USA

5 likes 1 repost 1 reply

Tue, Jun 4, 2019 8:16pm -07:00
Michael Warkentin https://twitter.com/mwarkentin • Jun 5
@Threadreaderapp unroll

already did that myself 😉 https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon, USA

4 likes 1 repost

Tue, Jun 4, 2019 5:16pm -07:00
André Neves https://twitter.com/andreneves • Jun 4
So now services/apps need to handle OAuth, Apple SSO, and regular email/pass. Feels like more mental burden for developers.

Also turns out Apple's is also OAuth :-) https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

Portland, Oregon

2 likes

Tue, Jun 4, 2019 3:42pm -07:00
André Neves https://twitter.com/andreneves • Jun 4
Feels a lot like another way to lock users inside of the Apple world. How is this any better than signing up with any other service like Google or Facebook (for OAuth for example). It has some nice 'privacy' features but it feels like a marketing stunt more than anything imo

It's more about providing easier options for users: https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon

2 likes 2 replies

Tue, Jun 4, 2019 3:42pm -07:00
complexmix https://twitter.com/thatonehacker5 • Jun 4
It will be set as the default (knowing Apple) and will make all other options so inconvenient that apple users will essentially have one choice. Just like how you can use Chrome on iOS, but they make it as inconvenient as possible to avoid the POS that is Safari.

It's still up to the app to provide the buttons. Check out the sample walkthroughs in that blog post.

Portland, Oregon

1 reply

Tue, Jun 4, 2019 3:27pm -07:00
complexmix https://twitter.com/thatonehacker5 • Jun 4
Ah yes, take away the freedom of choice

In contrast: this forces app developers to provide users the choice between Apple or some other sign-in, rather than letting developers require just e.g. Facebook login.

More: https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-misunderstandings

Portland, Oregon, USA

2 likes 2 reposts 1 reply

Tue, Jun 4, 2019 3:16pm -07:00
Halyna https://twitter.com/Halyna_13 • Jun 4
No, you don’t need an Apple device for 2FAuth of Apple ID. They send an SMS to authenticate the new login.

Confirmed. I was able to create a brand new Apple ID, enroll a Google Voice phone number for 2FA, and never touch this account from an iOS device.

Portland, Oregon

6 likes 2 replies

Tue, Jun 4, 2019 1:25pm -07:00

older