Register with Apple utilizing Vapor 4

Apple developer portal setup

To be able to make the Register with Apple work in your web site you may want a payed developer account. That’ll price you $99 / 12 months if you’re a person developer. You may examine numerous membership choices or simply merely enroll utilizing this hyperlink, however you may want an present Apple ID.

I assume that you simply made it to date and you’ve got a working Apple developer account by now. A standard misbelief about Register with Apple (SiwA) is that you simply want an present iOS utility publised to the App Retailer to make it work, however that is not the case. It really works and not using a companion app, nevertheless you may want an utility identifier registered within the dev portal.

App identifier

Choose the Identifiers menu merchandise from the record on the left, press the plus (+) button, choose the App IDs possibility and press the Proceed button. Fill out the outline discipline and enter a customized bunde indentifier that you simply’d like to make use of (e.g. com.mydomain.ios.app). Scroll down the Capabilities record till you discover the Register With Apple possibility, mark the checkbox (the Allow as major App ID ought to seem proper subsequent to an edit button) and press the Proceed button on the highest proper nook. Register the appliance identifier utilizing the highest proper button, after you discover every little thing all proper.

It is best to see the newly created AppID within the record, if not there’s a search icon on the appropriate aspect of the display screen. Choose the AppIDs possibility and the appliance identifer merchandise ought to seem. 🔍

Service identifier

Subsequent we’d like a service identifier for SiwA. Press the add button once more and now choose the Companies IDs possibility. Enter an outline and fill out the identifier utilizing the identical reverse-domain title model. I want to make use of my area title with a suffix, that may be one thing like com.instance.siwa.service. Press the Proceed and the Register buttons, we’re virtually prepared with the configuration half.

Filter the record of identifiers by Service IDs and click on on the newly created one. There’s a Configure button, that you need to press. Now affiliate the Major App ID to this service identifier by deciding on the appliance id that we made beforehand from the choice record. Press the plus button subsequent to the Web site URLs textual content and enter the given area that you simply’d like to make use of (e.g. instance.com).

You may even have so as to add at the very least one Return URL, which is principally a redirect URL that the service can use after an auth request. It is best to all the time use HTTPS, however aside from this constraint the redirect URL may be something (e.g. https://instance.com/siwa-redirect). #notrailingslash

You may add or take away URLs at any time utilizing this display screen, fortunately there’s a take away possibility for each area and redirect URL. Press Subsequent to avoid wasting the URLs and Completed if you find yourself prepared with the Register with Apple service configuration course of.

Keys

The very last thing that we have to create on the dev portal is a personal key for shopper authentication. Choose the Keys menu merchandise on the left and press the add new button. Title the important thing as you need, choose the Register with Apple possibility from the record. Within the Configure menu choose the Major App ID, it ought to be related with the appliance identifier we made earlier. Click on Save to return to the earlier display screen and press Proceed. Overview the info and eventually press the Register button.

Now that is your solely likelihood to get the registered non-public key, in case you pressed the executed button with out downloading it, you’ll lose the important thing endlessly, it’s important to make a brand new one, however don’t fret an excessive amount of in case you messed it up you’ll be able to click on on the important thing, press the massive purple Revoke button to delete it and begin the method once more. This comes useful if the important thing will get compromised, so do not share it with anyone else in any other case you may should make a brand new one. 🔑

Workforce & JWK identifier

I virtually overlook that you’re going to want your crew identifier and the JWK identifier for the register course of. The JWK id may be discovered underneath the beforehand generated key particulars web page. For those who click on on the title of the important thing you’ll be able to view the small print. The Key ID is on that web page alongside with the revoke button and the Register with Apple configuration part the place you will get the crew identifier too, because the service bundle identifier is prefixed with that. Alternatively you’ll be able to copy the crew id from the very high proper nook of the dev portal, it is proper subsequent to your title.

Implementing Register With Apple

Earlier than we write a single line of Swift code let me clarify a simplified model of your complete course of.

All the login stream has 3 fundamental elements:

• Provoke an internet auth request utilizing the SiwA button (begin the OAuth stream)
• Validate the returned consumer id token utilizing Apple’s JWK service
• Alternate the consumer id token for an entry token

Among the tutorials overcomplicate this, however you may see how straightforward is to put in writing your complete stream utilizing Vapor 4. We do not even want extra scripts that generate tokens we are able to do every little thing in pure Swift, which is sweet. Lets begin a brand new Vapor challenge. You may want the JWT bundle as effectively.

import PackageDescription

let bundle = Package deal(
    title: "binarybirds",
    platforms: [
       .macOS(.v10_15)
    ],
    dependencies: [
        .package(url: "https://github.com/vapor/vapor.git", from: "4.4.0"),
        .package(url: "https://github.com/vapor/leaf.git", from: "4.0.0-rc"),
        .package(url: "https://github.com/vapor/jwt.git", from: "4.0.0-rc"),
    ],
    targets: [
        .target(name: "App", dependencies: [
            .product(name: "Vapor", package: "vapor"),
            .product(name: "Leaf", package: "leaf"),
            .product(name: "JWT", package: "jwt"),
        ]),
        .goal(title: "Run", dependencies: ["App"]),
    ]
)

If you do not know tips on how to construct the challenge you need to learn my novices information about Vapor 4.

The Register with Apple button

We will use the Leaf template engine to render our views, it is fairly easy to make it work, I will present you the configuration file in a second. We will use only one easy template this time. We will name it index.leaf and save the file into the Sources/Views listing.

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <meta title="viewport" content material="width=device-width, initial-scale=1">
        <model>
            .signin-button {
                width: 240px;
                peak: 40px;
            }
            .signin-button > div > div > svg {
                width: 100%;
                peak: 100%;
                colour: purple;
            }
            .signin-button:hover {
                cursor: pointer;
            }
            .signin-button > div {
                define: none;
            }
      </model>
    </head>
    <physique>
        <script sort="textual content/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"></script>
        <div id="appleid-signin" data-color="black" data-border="false" data-type="register" class="signin-button"></div>
        <script sort="textual content/javascript">
            AppleID.auth.init({
                clientId : '#(clientId)',
                scope : '#(scope)',
                redirectURI: '#(redirectUrl)',
                state : '#(state)',
                usePopup : #(popup),
            });
        </script>
    </physique>
</html>

The Register with Apple JS framework can be utilized to render the login button on the web site. There’s a comparable factor for iOS referred to as AuthenticationServices, however this time we’re solely going to focus on the net. Sadly the register button is kind of buggy so we’ve got so as to add some further CSS hack to repair the underlying points. Come on Apple, why do we’ve got to hack this stuff? 😅

Beginning the AppleID auth course of is basically easy you simply should configure a couple of parameters. The shopper id is service the bundle identifier that we entered on the developer portal. The scope may be both title or e mail, however you should use each if you need. The redirect URI is the redirect URL that we registered on the dev portal, and the state ought to be one thing distinctive that you should use to establish the request. Apple will ship this state again to you within the response.

Noone talks concerning the usePopup parameter, so we’ll depart it that manner too… 🤔

Alternatively you should use meta tags to configure the authorization object, you’ll be able to learn extra about this within the Configuring your webpage for Register with Apple documentation.

Vapor configuration

It is time to configure our Vapor utility so we are able to render this Leaf template file and use the signing key that we aquired from Apple utilizing the dev portal. We’re coping with some secret data right here, so you need to by no means retailer it within the repository, however you should use Vapor’s surroundings for this objective. I want to have an extension for the obtainable surroundings variables.

extension Surroundings {
    
    static var siwaId = Surroundings.get("SIWA_ID")!
    
    static let siwaRedirectUrl = Surroundings.get("SIWA_REDIRECT_URL")!
    
    static var siwaTeamId = Surroundings.get("SIWA_TEAM_ID")!
    
    static var siwaJWKId = Surroundings.get("SIWA_JWK_ID")!
    
    static var siwaKey = Surroundings.get("SIWA_KEY")!
}

In Vapor 4 you’ll be able to setup a customized JWT signer that may signal the payload with the right keys and different values based mostly on the configuration. This JWT signer can be utilized to confirm the token within the response. It really works like magic. JWT & JWTKit is an official Vapor bundle, there may be undoubtedly no must implement your individual answer. On this first instance we’ll simply put together the signer for later use and render the index web page so we are able to initalize the OAuth request utilizing the web site.

import Vapor
import Leaf
import JWT

extension JWKIdentifier {
    static let apple = JWKIdentifier(string: Surroundings.siwaJWKId)
}

extension String {
    var bytes: [UInt8] {
        return .init(self.utf8)
    }
}

public func configure(_ app: Utility) throws {
    
    app.views.use(.leaf)
    

    app.middleware.use(SessionsMiddleware(session: app.periods.driver))

    app.jwt.apple.applicationIdentifier = Surroundings.siwaId
    
    let signer = strive JWTSigner.es256(key: .non-public(pem: Surroundings.siwaKey.bytes))
    app.jwt.signers.use(signer, child: .apple, isDefault: false)

    app.get { req -> EventLoopFuture<View> in
        struct ViewContext: Encodable {
            var clientId: String
            var scope: String = "title e mail"
            var redirectUrl: String
            var state: String
            var popup: Bool = false
        }

        let state = [UInt8].random(rely: 16).base64
        req.session.information["state"] = state
        let context = ViewContext(clientId: Surroundings.siwaId,
                                  redirectUrl: Surroundings.siwaRedirectUrl,
                                  state: state)
        return req.view.render("index", context)
    }
}

The session middleware is used to switch a random generated code between the index web page and the redirect handler. Now in case you run the app and click on on the Register with Apple button you may see that the stream begins, however it’ll fail after you recognized your self. That is okay, the 1st step is accomplished. ✅

The redirect handler

Apple will attempt to ship a POST request with an object that comprises the Apple ID token to the registered redirect URI after you have recognized your self utilizing their login field. We will mannequin this response object as an AppleAuthResponse struct within the following manner:

import Basis

struct AppleAuthResponse: Decodable {

    enum CodingKeys: String, CodingKey {
        case code
        case state
        case idToken = "id_token"
        case consumer
    }

    let code: String
    let state: String
    let idToken: String
    let consumer: String
}

The authorization code is the primary parameter, the state shuld be equal along with your state worth that you simply ship as a parameter whenever you press the login button, if they do not match do not belief the response anyone is attempting to hack you. The idToken is the Apple ID token, we’ve got to validate that utilizing the JWKS validation endpoint. The consumer string is the e-mail deal with of the consumer.

app.publish("siwa-redirect") { req in
    let state = req.session.information["state"] ?? ""
    let auth = strive req.content material.decode(AppleAuthResponse.self)
    guard !state.isEmpty, state == auth.state else {
        return req.eventLoop.future("Invalid state")
    }

    return req.jwt.apple.confirm(auth.idToken, applicationIdentifier: Surroundings.siwaId)
    .flatMap { token in
        
    }
}

The code above will deal with the incoming response. First it’s going to attempt to decode the AppleAuthResponse object from the physique, subsequent it’s going to name the Apple verification service utilizing your non-public key and the idToken worth from the response. This validation service returns an AppleIdentityToken object. That is a part of the JWTKit bundle. We have simply accomplished Step 2. ☺️

Exchanging the entry token

The AppleIdentityToken solely lives for a brief time frame so we’ve got to trade it for an entry token that can be utilized for for much longer. We’ve got to assemble a request, we’re going to use the next request physique to trade tokens:

struct AppleTokenRequestBody: Encodable {
    
    enum CodingKeys: String, CodingKey {
        case clientId = "client_id"
        case clientSecret = "client_secret"
        case code
        case grantType = "grant_type"
        case redirectUri = "redirect_uri"
    }
    
    
    let clientId: String

    
    let clientSecret: String

    
    let code: String
    
    
    let redirectUri: String
    
    
    let grantType: String = "authorization_code"
}

We’ll additionally must generate the shopper secret, based mostly on the response we’re going to make a brand new AppleAuthToken object for this that may be signed utilizing the already configured JWT service.

struct AppleAuthToken: JWTPayload {
    let iss: String
    let iat = Int(Date().timeIntervalSince1970)
    let exp: Int
    let aud = "https://appleid.apple.com"
    let sub: String

    init(clientId: String, teamId: String, expirationSeconds: Int = 86400 * 180) {
        sub = clientId
        iss = teamId
        exp = self.iat + expirationSeconds
    }

    func confirm(utilizing signer: JWTSigner) throws {
        guard iss.rely == 10 else {
            throw JWTError.claimVerificationFailure(title: "iss", purpose: "TeamId have to be your 10-character Workforce ID from the developer portal")
        }

        let lifetime = exp - iat
        guard 0...15777000 ~= lifetime else {
            throw JWTError.claimVerificationFailure(title: "exp", purpose: "Expiration have to be between 0 and 15777000")
        }
    }
}

Since we’ve got to make a brand new request we are able to use the built-in AysncHTTPClient service. I’ve made a bit of extension across the HTTPClient object to simplify the request creation course of.

extension HTTPClient {
    static func appleAuthTokenRequest(_ physique: AppleTokenRequestBody) throws -> HTTPClient.Request {
        var request = strive HTTPClient.Request(url: "https://appleid.apple.com/auth/token", technique: .POST)
        request.headers.add(title: "Consumer-Agent", worth: "Mozilla/5.0 (Home windows NT 6.2) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1090.0 Safari/536.6'")
        request.headers.add(title: "Settle for", worth: "utility/json")
        request.headers.add(title: "Content material-Kind", worth: "utility/x-www-form-urlencoded")
        request.physique = .string(strive URLEncodedFormEncoder().encode(physique))
        return request
    }
}

The humorous factor right here is in case you do not add the Consumer-Agent header the SiwA service will return with an error, the issue was talked about in this text additionally mentioned on the Apple Developer Fourms.

Anyway, let me present you the whole redirect handler. 🤓

app.publish("siwa-redirect") { req -> EventLoopFuture<String> in
    let state = req.session.information["state"] ?? ""
    let auth = strive req.content material.decode(AppleAuthResponse.self)
    guard !state.isEmpty, state == auth.state else {
        return req.eventLoop.future("Invalid state")
    }

    return req.jwt.apple.confirm(auth.idToken, applicationIdentifier: Surroundings.siwaId)
    .flatMap { token -> EventLoopFuture<HTTPClient.Response> in
        do {
            let secret = AppleAuthToken(clientId: Surroundings.siwaId, teamId: Surroundings.siwaTeamId)
            let secretJwtToken = strive app.jwt.signers.signal(secret, child: .apple)

            let physique = AppleTokenRequestBody(clientId: Surroundings.siwaId,
                                             clientSecret: secretJwtToken,
                                             code: auth.code,
                                             redirectUri: Surroundings.siwaRedirectUrl)

            let request = strive HTTPClient.appleAuthTokenRequest(physique)
            return app.http.shopper.shared.execute(request: request)
        }
        catch {
            return req.eventLoop.future(error: error)
        }
    }
    .map { response -> String in
        guard var physique = response.physique else {
            return "n/a"
        }
        return physique.readString(size: physique.readableBytes) ?? "n/a"
    }
}

As you’ll be able to see I am simply sending the trade request and map the ultimate response to a string. From this level it’s very easy to implement a decoder, the response is one thing like this:

struct AppleAccessToken: Decodable {

    enum CodingKeys: String, CodingKey {
        case accessToken = "access_token"
        case tokenType = "token_type"
        case expiresIn = "expires_in"
        case refreshToken = "refresh_token"
        case idToken = "id_token"
    }

    let accessToken: String
    let tokenType: String
    let expiresIn: Int
    let refreshToken: String
    let idToken: String
}

You should utilize this response to authenticate your customers, however that is up-to-you based mostly by yourself enterprise logic & necessities. You should utilize the identical authTokenRequest technique to refresh the token, you simply should set the grant sort to refresh_token as a substitute of authorization_code

I do know that there’s nonetheless room for enhancements, the code is much from excellent, however it’s a working proof of idea. The article is getting actually lengthy, so possibly that is the appropriate time cease. 😅

If you’re in search of place to be taught extra about SiwA, you need to examine this hyperlink.

Conclusion

You may have a working Register with Apple implementation inside an hour if you’re utilizing Vapor 4. The toughest half right here is that it’s important to work out each single little element by your self, taking a look at different folks’s supply code. I am attempting to clarify issues as straightforward as potential however hey, I am nonetheless placing collectively the items for myself too.

That is a particularly enjoyable journey for me. Shifting again to the server aspect after virtually a decade of iOS growth is a refreshing expertise. I can solely hope you may take pleasure in my upcoming e-book referred to as Sensible Server Aspect Swift, as a lot as I take pleasure in studying and writing concerning the Vapor. ❤️