fcc5c0d2a1
* Add gem omniauth-apple * Integrate omniauth-apple * Integrate callback * Add fields * Add tests, fix bugs and make it all work * Show only enabled providers for the current user * Add default profile image for Apple * Remove localhost patch * Bring over the changed Apple username if the user changes it * More specs fixed * Incorporate feedback from PR * Fix specs * Simplify code and fix spec * Fix Broadcast generators to take into account the new provider * Fix spec * Generate a truly unique apple_username * Fix user specs * Add omniauth-apple-0.0.2 to vendor cache * Fix merge conflict and spec * Update VCR fastly sloan cassette * Revert "Generate a truly unique apple_username" This reverts commit 2462875575b0bbd6b3c1d56b25afcd3189671608. * Fix user specs * Fix specs * Fix specs * Hide Connect Apple button behind a feature flag * Revert "Hide Connect Apple button behind a feature flag" This reverts commit 105bde0373389a4eb9b6e948f60734c7e0e99cba. * Fix line lengths * Fix spec * ES tag * CSRF bypass for Apple callback * custom user_nickname in Apple provider with small tweaks + omniauth-apple bump * Fixes username specs * Makes Apple users default image Users::ProfileImageGenerator * Fallback to mascot_image_url in test environment to avoid breaking Travis * Fixes Apple CSRF error + makes default nickname more readable * Trigger Travis * Better devise config * Apple SiteConfig entires in /admin/config * Fixing specs * Adds beta_access? to Authentication::Providers::Provider * Fixes specs * Codeclimate double quote fix in Gemfile * Fixes /admin/config allowed params & adds feature flag for provider beta_access? * Remove Enfile & adds temporary docs * Adds custom apple auth provider settings * Fix authenticator spec * Fix configs spec (use last instead of first to avoid apple special case) * Remove dangling fields from /admin/config * updates feature flag * More test fixes * Hide config behind feature flag too * omniauth-apple bump * Takes care of edge case fallback * Reverse apple_username update * Adds auth_time to info hash in apple omniauth mock * Switch to next instead of nesting for feature flag * Fixes CVE-2015-9284 * Fixes specs after auth providers initiatior refactor from GET to POST * Spec fixes * More spec fixes * Fix Rails codebase reference link Co-authored-by: rhymes <rhymesete@gmail.com> Co-authored-by: rhymes <rhymes@hey.com>
3.5 KiB
| title |
|---|
| Apple Authentication (beta) |
Sign in with Apple Authentication
Forem allows you to authenticate using Sign in with Apple. In order to use this authentication method you'll need to be enrolled to the Apple Developer Program in order to retrieve the necessary credentials and an HTTPS supported URL for the callback configuration (HTTP won't work). Then you'll need to provide the keys to the Rails application.
Beta support
This authentication provider is currently marked as beta. This means it will be available but hidden from public access until more thoroughly tested.
If you want to make this feature publicly available (without the state
parameter) you can enable the apple_auth feature flag from the Flipper
dashboard or the Rails console with Flipper.enable(:apple_auth).
Apple Developer Portal Configuration
Register/Sign in to your Apple Developer Account.
Service ID Configuration
- Name the Service and finalize the registration
- Configure Domains and Subdomains & the callback URL. This example uses ngrok for HTTPS support.
Key Configuration
- Register a new Key. Enable the "Sign in with Apple" option and configure it so it's associated with the corresponding App ID
- Download the Key
Configuring the Rails Application
Now with both the Service ID and Key you'll need to enable Apple Authentication
and pass in the credentials in the admin dashboard /admin/config.
Add the corresponding configuration data. Make sure the PEM key you downloaded
has explicit linebreaks (\n), don't forget the one at the very end of it.
Save the changes and restart your server for these values to take effect.
Email configuration
Apple uses what they call Private Email Relay Service to hide user's emails. For this to work first create a new email source.
Emails sent need to be authenticated and the configuration depends on the different providers available: