bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Supporting Sign in with Apple on iOS and web apps can be an easy task if you use the right tools.

How to Implement Sign in with Apple Easily on iOS Apps

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Following Apple’s release of Sign in with Apple and iOS13, Auth0 support coming next week



Using third-party or social login services such as Facebook or Google for app login? Apple’s new App Store Developer Guidelines require that if your app exclusively uses a third-party or social login service to setup or authenticate the user’s primary account, the app [must](https://developer.apple.com/news/?id=06032019j) provide Sign in With Apple for your end-users (existing apps and app updates have until April 2020 to be compliant.)

![Sign In with Apple feature landing page mockup screenshot](https://images.ctfassets.net/23aumh6u8s0i/7mvfWW2HPoJ1fAZzJ5wKNc/6d6b119e6ba2723024e5e2875297d56d/hero)

## Smooth Adoption Expected

Once iOS users complete their initial sign-in, they’ll be able to subsequently sign in using the native bio verification mechanisms built into iOS devices like thumbprints and Face ID. When users can do this instead of having to enter a password, we expect this will quickly become the login path of choice.

## Privacy Play

GDPR sparked a [global shift in data privacy](https://auth0.com/explore/data-privacy/). While organizations are thinking harder about the data they store and where it flows, Apple has realized the need to support end-user choices — which is why SIgn In With Apple allows users to obfuscate their real identity from third-parties including app developers.

So if I use Sign in with Apple, and select “Hide my Email”, application developers will not have any personally identifiable information from my login. The application will only recognize me based on a randomly generated email address from Apple that is uniquely identifiable so that Apple can maintain the correct association. 

This causes a slight problem for application developers who rely on email addresses to associate accounts to actual people. Apple has taken a hard stance on this but it is also evolving its identity practices at a rapid pace. Auth0 has kept up with these recent changes and will be releasing a solution that has been beta-tested with actual customers and end-users next week.

If you need Sign In With Apple to do business and you’re doing it yourself, you’re about to touch code — and then every time Apple makes a change, you’ll need to touch it again to ensure that code is keeping pace. The advantage of Auth0 is that we shield you from every change from Apple or other identity providers. Even adding features like multi-factor authentication can easily be switched on with a toggle.

## What’s Coming Next Week

![Sign-in with Apple Flows](https://images.ctfassets.net/23aumh6u8s0i/4Ir5yzLS6BxzCoIXjg8U1a/95e05a6faf160e091ee3a4afc2981c76/siwa-flows)

The General Availability (GA) of our Sign In With Apple integration will include Native flows and Web flows. Web flows have been in [public beta since June](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/), enabling customers who want to use Sign In with Apple in web applications to try it out. At Auth0, Sign In With Apple will be an out-of-the-box feature — a simple toggle + minimal code.

![Sign In With Apple Has Been In Public Beta Since June](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

Offloading authentication to Auth0 means touching code when YOU want to make a change, not when your identity provider tells you to. And it means you can quickly comply with Apple’s mandate while leveraging the benefits of Face or Touch ID and eliminate the need for usernames/passwords.

With 1.4 billion iOS devices already in the market and nearly two million apps competing for iOS users’ attention this change could be a big deal — if Auth0 didn’t already have you covered.


Ready for 1.4 Billion iOS Devices?

2b7b341132c3df90155a9914f13b6deb

Former Auth0 Employee

Zach Walchuk

Why the OpenID Foundation's open letter to Apple might not matter for your applications.



Last week, the OpenID Foundation posted an [open letter to Apple](https://openid.net/2019/06/27/open-letter-from-the-openid-foundation-to-apple-regarding-sign-in-with-apple/), encouraging them to bring the recently announced Sign In with Apple login feature in line with the [OpenID Connect (OIDC) protocol](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog). As we pointed out when it was first announced, [Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/) aligns with some of the requirements laid out in the OIDC and [OAuth 2.0](https://tools.ietf.org/html/rfc6749) specifications, but Apple makes little mention of these standards in their official documentation.

<include src="ebook-ads/OidcHandbook" />

![OpenID Foundation and Apple logo illustration](https://images.ctfassets.net/23aumh6u8s0i/47vwPJFYvPU0hM9s7rMakE/a5f080fb33d7c3e95d9a7b40aa1eefd5/apple-oidc)

The letter from the OpenID Foundation was [accompanied by a document](https://bitbucket.org/openid/connect/src/default/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md) outlining where Sign In with Apple differs from the OIDC specification. This document, drafted by the OpenID Foundation’s Certification team and other members of the identity community (including Filip Skokan, an engineer at Auth0), calls out the OIDC spec violations that increase the risk of attacks and privacy concerns, as well as additional peculiarities that will make it difficult for developers to incorporate Sign In with Apple into their existing applications.

## What This Means For Application Developers

While Sign In with Apple is still very much under development and a number of significant changes can be expected, a lot of attention is being paid to the implementation specifics even at this early stage. This is largely due to the fact that Apple will require the Sign In with Apple option for all applications in their ecosystem that support third-party logins. A new identity provider that complies with established standards could greatly reduce the burden on application developers, as many applications are already set up to handle similar connections that do follow the standards.

Of course, Apple may choose not to align with the OIDC specification for any number of reasons related to their goals and requirements as a hardware and software provider. Identity and access management is not a core product for Apple, and establishing interoperability with systems outside of their ecosystem may very well not be a high priority. As with any identity solution tightly coupled with a company’s other software, features that benefit general use may only be put into place when they overlap with the specific requirements of operating within that company’s primary offerings. But interoperability is not the only concern addressed in the OpenID Foundation’s letter — it remains to be seen how Apple will address the attack surface exposed by not complying with parts of the specifications that deal with preventing known attacks.

## Managing Discrepancies with an Independent Identity Platform

Independent identity platforms, focused solely on [identity and access management](https://auth0.com/blog/identity-as-a-service-in-2018/), do not run into these same issues with competing priorities. It is in their best interest, and the interests of their users, to connect as easily and widely with other systems as possible. At Auth0, we provide simple configuration options to set up a variety of [social](https://auth0.com/docs/identityproviders#social) and [enterprise](https://auth0.com/docs/identityproviders#enterprise) connections that follow the standards established by OIDC and OAuth 2.0, SAML, WS-Federation, and many others. For those connections that don’t entirely comply with specifications, we work to bridge the gaps by implementing the best options the providers offer and adding measures where we can to harden against attacks. And while we continue to be active in the identity community to encourage the adoption of recognized standards, the Auth0 platform is built to address and keep up with any differences, so that application developers can be free from worrying about changes that might affect their code.

Because Auth0 is a [certified OpenID provider](https://openid.net/certification/), you know what to expect when connecting with our platform. Any application already supporting an OIDC-compliant provider is already set up to quickly integrate with Auth0 and connect to a vast array of identity providers by simply turning on a few switches. And with our [collection of SDKs](https://auth0.com/docs/libraries#sdk-repositories-and-support-status) across multiple languages, it’s easy to secure any application with Auth0 without having to worry about implementation details.

## Aside: Try Sign In with Apple on Auth0 Today

Auth0's beta support of Sign In with Apple makes it easy to get started:

* <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up for an Auth0 account.</a>
* Use the [QuickStart](https://auth0.com/docs/quickstarts) of your choice to integrate Auth0 into your application, or start from scratch and have a secure app deployed in minutes.
* Add Sign In with Apple under “Connections” > “Social”, and test with Auth0's developer credentials.

![Auth0 Dashboard - Social Connections with Sign In with Apple included](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)


Apple ID, OIDC, and How Identity Independence Keeps You Free

Integrated support for Sign In with Apple is now available in Auth0 as a beta feature.



Two weeks ago, Apple announced the launch of a new authentication feature, [Sign In with Apple](https://developer.apple.com/sign-in-with-apple/). According to Apple, Sign In with Apple offers a number of benefits for Apple users, including enhanced privacy (with the ability to hide your email address) and a seamless experience across Apple devices and the web. Reactions to this announcement included a point of concern for application developers — all apps in the App Store that offer authentication through third-parties (such as Google, Twitter, or Facebook) will be required to support Sign In with Apple, and integrating a new identity provider which may not fully comply to standard protocols is not an easy task.

In our [initial coverage of the news](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple), we mentioned that using an identity management service like Auth0 greatly reduces the effort required to integrate a new identity provider. With a [follow-up post](https://auth0.com/blog/implement-sign-in-with-apple-using-auth0-extensibility/), we demonstrated how our [Custom Social Connections](https://auth0.com/docs/extensions/custom-social-extensions) feature could help you integrate Sign In with Apple without making changes to your application code, using a simple script run on our servers.

Today, we are happy to announce that integrated support for Sign In with Apple is available in Auth0 as a beta feature, making it far easier than anything we've shown yet to preview the experience in your own applications. You don't even need an Apple Developer account to get started — just flip a switch and give it a try!

## Add Sign In with Apple to Your Applications

For <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Auth0 users</a>, adding Sign In with Apple to your applications is simple:

* For the easiest setup, go to "Universal Login" in the Auth0 dashboard and click "New".
    * If you prefer the Classic Universal Login experience, click the "Login" tab and turn on "Customize Login Page". Find the line in your HTML that pulls in the Lock script and update to reference Lock version 11.16:  
    `<script src="https://cdn.auth0.com/js/lock/11.16/lock.min.js"></script>`
* Save your changes, then go to “Connections” > “Social”:
![Auth0 Dashboard - Social Connections with Sign In with Apple included](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)
* Click on the Apple icon to turn on the Sign In with Apple connection. To test right away with Auth0's developer credentials, leave the fields blank. To test more fully with your own Apple Developer account, you can follow these steps (more details in our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple)):
    * The `Client ID` is the identifier you choose after registering a Services ID in the Apple Developer portal.
    * Your [domain](https://auth0.com/docs/custom-domains) will need to be verified with Apple as part of the service configuration.
    * The `Client Secret Signing Key` can be downloaded when you register a new key in the Apple Developer portal. The `Key ID` will also be available after this step.
    * Your `Team ID` can be found [here](https://developer.apple.com/account/#/membership).
![Auth0 Dashboard Sign In with Apple provider settings](https://images.ctfassets.net/23aumh6u8s0i/21TYVKzlcsyCQA1MVrMCGh/e034e39c10a8203a8cdb6c0f35dd836b/sign-in-with-apple-settings)
* Click “Save”, then before exiting the window click the “Applications” tab to select which of your Auth0 applications should allow the Sign In with Apple option. Click “Save” one more time.
* Navigate to your application’s login page to verify the change:
![Auth0 Sign In with Apple identity provider Login form preview](https://images.ctfassets.net/23aumh6u8s0i/7hJCOMwmV588En96HxkM1w/7908df4dd2dadaeb5172ee02e7964b69/apple-login-page)

> **Note:** Testing Sign In with Apple with your own Apple Developer account does require a [custom domain](https://auth0.com/docs/custom-domains), as you will need to verify ownership of your domain with Apple.

We’re still in the early days of this beta feature from Apple, and the current implementation is missing some necessary functionality. At the time of this post, Apple doesn’t return names and email addresses for signed-in users, and you can bet a number of extensive changes to the service will be made before it is fully released. While we can’t guarantee that the level of integration shown in this preview will always be available, we’ll be keeping track of any necessary changes and doing everything we can so that when Sign In with Apple is ready for production, you will be too.

## Get Started with Auth0

If you aren’t already using Auth0, it’s easy to get started:

* <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up for an Auth0 account.</a>
* Use the [QuickStart](https://auth0.com/docs/quickstarts) of your choice to integrate Auth0 into your application, or start from scratch and have a secure app deployed in minutes.
* Add Sign In with Apple under “Connections” > “Social”, and test with Auth0's developer credentials.

## What’s Next

Sign In with Apple is just one of the identity providers that can be added to your application with the flip of a switch, and adding social connections is only one of the many features available to Auth0 users. As we continue to learn more about Apple’s requirements for this service, we’ll maintain support with our built-in integration and share how Auth0’s advanced features (such as [account linking](https://auth0.com/docs/link-accounts), more to come soon) can help you give your users an optimal sign-in experience.

If you have any feedback or questions regarding the Sign In With Apple beta, please let us know in the [Auth0 Community forum](https://community.auth0.com/c/auth0-beta-programs/sign-in-with-apple).






Try Sign In with Apple in Your Auth0 Apps Today

abhishek-hingnikar

I am a Specialist Solutions Engineer at Auth0. I specialize in Identity and Access Management and enjoy building software. I have experience developing software in several frameworks and a variety of domains. I enjoy traveling, cooking, and building robots!

Specialist Solutions Engineer

Abhishek Hingnikar

Extend Auth0's core functionality to support Sign In with Apple in your application.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  Integrated support for Sign In with Apple is now available in Auth0 as a beta feature! <strong><a href="https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/">Implement Sign In With Apple now</a>.</strong>
</div>

Last Thursday, [we took a look at Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/), the new identity provider features Apple released at WWDC 2019. In that post, we included simple steps to add support for Sign In with Apple in a Node.js application. Today, we're going to show you how you can support Sign in with Apple without adding any special code to your app — thanks to [Auth0's Custom Social Connections](https://auth0.com/docs/connections/social/oauth2), Apple is just one of the many [identity providers](https://auth0.com/docs/identityproviders) you can leverage when connecting to Auth0.

## Extending Auth0’s Core Functionality

We recently wrote about our [vision and guiding principles](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/). Developers don’t want to feel like they are constrained by their tools and libraries, especially with an infrastructure component like authentication. Extensibility within our product is a first class citizen, and this is reflected by the fact that 87% of our customers extend the platform. One of the extensibility points we provide allows for adding a new federated authentication method, as highlighted below. This is what we will use to add support for Sign In with Apple:

![Auth0’s extensibility options](https://images.ctfassets.net/23aumh6u8s0i/76ZZsR3TMEJbf9WBnLMRma/7e91db2ea59764168e13721b2db8829a/auth0-engine-custom-connections)

## Prerequisites

To add support for Sign In with Apple, you'll need to have an Auth0 Tenant [set up with a custom domain](https://auth0.com/docs/custom-domains), as well as a web application configured to use Auth0 for authentication at that domain. You can get an application up and running in a few simple steps by using any of our [quick starts](https://auth0.com/docs/quickstarts). Note that for the purpose of this post, your application can use any development stack: Node.js, ASP.NET, Java, and so on.

## Register with Apple

Once you have your application set up, you'll need to create an Apple App ID and a Services ID. We covered these steps in detail in our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple), but in summary the steps are:

* Create an [Apple Developer Account](https://developer.apple.com)
* Go to ["Certificates, IDs, & Profiles"](https://developer.apple.com/account/resources/certificates/list) -> [ "Identifiers"](https://developer.apple.com/account/resources/identifiers/list/serviceId) -> "Register an App ID"
* Choose "App IDs" as the identifier type and hit "Continue"
* Provide a description and a Bundle ID (reverse-domain name style, i.e., `com.mycustomdomain`)
* Scroll down and check "Sign In with Apple", then "Continue" followed by "Register"
* Back at the "Certificates, IDs, & Profiles" section, click the blue icon next to "Identifiers"
* Choose "Services IDs" and click "Continue". Fill in the description and identifier (`com.mycustomdomain.webapp`)
* After checking "Sign In with Apple", click on "Configure"
* Define your "Web Domain" (`mycustomdomain.com`) and "Return URL" (`mycustomdomain.com/callback`)
* Click "Save", and then "Continue" followed by "Register"

Once you have your Services ID, you'll need to verify your domain with Apple:

* On the "Certificates, IDs, & Profiles" page, click your newly created Services ID
* Hit the "Configure" button next to the "Sign In with Apple" feature, then click "Download" 
* Copy the `apple-developer-domain-association.txt` file to your application server and make it accessible at `https://mycustomdomain.com/.well-known/apple-developer-domain-association.txt` (see our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple) for a detailed example)
* When this is ready, click "Verify" on your Services ID configuration page. If no error is raised, you are good to go

## Create a Custom Social Connection

In the next step, you’ll add Apple to the collection of identity providers you can integrate with via Auth0.

After you've registered your application with Apple, visit the Auth0 Dashboard and go to **Connections > Social**, scroll to the bottom, and click **Create Custom**.

Most of the information you'll need to create this custom connection has been established in previous steps. To generate the client secret, do the following:

* Head to ["Keys"](https://developer.apple.com/account/resources/authkeys/list) under the "Certificates, Identifiers, & Profiles" section of your Apple developer dashboard
* Click on the round, blue icon to add a new key
* Enter a "Key Name" and check the "Sign In with Apple" option
* Click on "Configure" to make sure the "Choose a Primary App ID" field is filled with your App ID
* Hit "Save", "Continue", and then "Register"
* Download the key, move to its own directory, and rename to `authkey.p8`. Make a note of the Key ID
* Use a JWT library with support for the ES256 algorithm to generate the client secret from the key — the example below uses Node.js, but libraries for other languages can be used in a similar fashion

To use this script, create a new file called `generate-secret.js` in the same directory as the key and add the following code:

```js
const jwt = require("jsonwebtoken");
const fs = require("fs");

const privateKey = fs.readFileSync("./authkey.p8");
const token = jwt.sign({}, privateKey, {
 algorithm: "ES256",
 expiresIn: "60 days",
 audience: "https://appleid.apple.com",
 issuer: "TEAM_ID",
 subject: "com.mycustomdomain.webapp",
 keyid: "KEY_ID"
});

console.log("The token is:", token);
```

> **Note:** You will need to replace `com.mycustomdomain.webapp` with the identifier for your Services ID and replace `TEAM_ID` with your Team ID, which can be found [here](https://developer.apple.com/account/#/membership). You'll also need to replace `KEY_ID` with the Key ID you noted earlier.

Run this script to generate your client secret:

```bash
node generate-secret.js
```

With this, you have almost everything you need to complete the custom social connection! Returning to your Auth0 dashboard, make sure your custom social connection fields look like this:

* **Name:** `Apple`, or any name you choose
* **Client ID:** your Services ID identifier, e.g., `com.mycustomdomain.webapp`
* **Client Secret:** the string generated in the previous step
* **Fetch User Profile Script:**

    ```js
    function (accessToken, ctx, cb) {
      const jwt = require('jsonwebtoken@7.1.9');
      const jwksClient = require('jwks-rsa@1.1.1');
    
      const client = jwksClient({
        jwksUri: 'https://appleid.apple.com/auth/keys',
        cache: true
      });
    
      const idToken = ctx.id_token;
      const decoded = jwt.decode(idToken, {complete: true});
      const {kid, alg} = decoded.header;

      client.getSigningKey(kid, (err, key) => {
        if (err) {
          console.log(err);
          return callback(err);
        }
        const signingKey = key.publicKey || key.rsaPublicKey;
    
        jwt.verify(idToken, signingKey, {
          issuer: 'https://appleid.apple.com',
          audience: 'com.mycustomdomain.webapp',
          algorithms: [alg]
        }, (err, profile) => {
          if (err) return cb(err);
          profile.id = profile.sub;
          cb(null, profile);
        });
      });
    }
    ```
* **Authorization URL:** `https://appleid.apple.com/auth/authorize`
* **Token URL:** `https://appleid.apple.com/auth/token`
* **Scope:** `email name`
* **Custom Headers:**
    
    ```json
    {
      "UserAgent": "Auth0",
      "Accepts": "application/json"
    }
    ```

Once you have everything filled out correctly, click **Create** and enable this connection for your application.

And that's it for set up! 

## Using Sign In with Apple

To try it out, make sure your application is running and give it a visit. When you visit your login page,  you should now see an option for Sign In with Apple:

![Login page](https://images.ctfassets.net/23aumh6u8s0i/4koCt6YbjXzQbGbt00affl/a0c196a8f93f3b7f6f4ea75e6adc01ab/login-page)

Click "Continue with Apple", then enter your Apple ID and password:

![Apple credentials](https://images.ctfassets.net/23aumh6u8s0i/7C7TdNTFutvWyWcdsdJsas/594d3a6de274f7f99c3f6827fea734bd/apple-credentials)

You will be asked to verify a new device. Click "Allow":

![Verify device](https://images.ctfassets.net/23aumh6u8s0i/ouXAZobxgZZKtkDR6NFtW/7b2d78d5242f42dd0586c1a73f29537c/verify-device)

Next you'll be given a verication code. Make a note of this code, click "Done", and then enter the code on the "Two-Factor Authentication" screen:

![2FA](https://images.ctfassets.net/23aumh6u8s0i/52IPsCq25vPdRzE9MpYuuO/fa6dd59fb20d9aafb8f81caa8ae02545/2FA)

When this is done, you'll have the option to edit your name and choose whether you'd like to share or hide your email. Make your choice, then click "Continue":

![Email preferences](https://images.ctfassets.net/23aumh6u8s0i/4wtIHL0LNQqhTd6SsKU5x4/1db29403d5c797a22693e1b290a7a787/email-preferences)

You are now signed in with Apple!

![Logged in](https://images.ctfassets.net/23aumh6u8s0i/7J3lSENs4GOIGkfaCe269P/497f957787a9de1e4a2db66987836897/logged-in)

## Coming Soon

We’re working hard to add Sign In with Apple as one of our core integrations, which will make supporting this option in your application as [easy as turning on a switch](https://auth0.com/learn/social-login/). Stay tuned!





Implement Sign In with Apple using Auth0 Extensibility

Learn about Sign In with Apple, the new identity provider announced at Apple WWDC 2019.

"open-id-connect"