fcc5c0d2a1
* Add gem omniauth-apple * Integrate omniauth-apple * Integrate callback * Add fields * Add tests, fix bugs and make it all work * Show only enabled providers for the current user * Add default profile image for Apple * Remove localhost patch * Bring over the changed Apple username if the user changes it * More specs fixed * Incorporate feedback from PR * Fix specs * Simplify code and fix spec * Fix Broadcast generators to take into account the new provider * Fix spec * Generate a truly unique apple_username * Fix user specs * Add omniauth-apple-0.0.2 to vendor cache * Fix merge conflict and spec * Update VCR fastly sloan cassette * Revert "Generate a truly unique apple_username" This reverts commit 2462875575b0bbd6b3c1d56b25afcd3189671608. * Fix user specs * Fix specs * Fix specs * Hide Connect Apple button behind a feature flag * Revert "Hide Connect Apple button behind a feature flag" This reverts commit 105bde0373389a4eb9b6e948f60734c7e0e99cba. * Fix line lengths * Fix spec * ES tag * CSRF bypass for Apple callback * custom user_nickname in Apple provider with small tweaks + omniauth-apple bump * Fixes username specs * Makes Apple users default image Users::ProfileImageGenerator * Fallback to mascot_image_url in test environment to avoid breaking Travis * Fixes Apple CSRF error + makes default nickname more readable * Trigger Travis * Better devise config * Apple SiteConfig entires in /admin/config * Fixing specs * Adds beta_access? to Authentication::Providers::Provider * Fixes specs * Codeclimate double quote fix in Gemfile * Fixes /admin/config allowed params & adds feature flag for provider beta_access? * Remove Enfile & adds temporary docs * Adds custom apple auth provider settings * Fix authenticator spec * Fix configs spec (use last instead of first to avoid apple special case) * Remove dangling fields from /admin/config * updates feature flag * More test fixes * Hide config behind feature flag too * omniauth-apple bump * Takes care of edge case fallback * Reverse apple_username update * Adds auth_time to info hash in apple omniauth mock * Switch to next instead of nesting for feature flag * Fixes CVE-2015-9284 * Fixes specs after auth providers initiatior refactor from GET to POST * Spec fixes * More spec fixes * Fix Rails codebase reference link Co-authored-by: rhymes <rhymesete@gmail.com> Co-authored-by: rhymes <rhymes@hey.com>
83 lines
3.5 KiB
Markdown
83 lines
3.5 KiB
Markdown
---
|
|
title: Apple Authentication (beta)
|
|
---
|
|
|
|
# Sign in with Apple Authentication
|
|
|
|
Forem allows you to authenticate using
|
|
[Sign in with Apple](https://developer.apple.com/sign-in-with-apple/). In order
|
|
to use this authentication method you'll need to be enrolled to the
|
|
[Apple Developer Program](https://developer.apple.com/programs/) in order to
|
|
retrieve the necessary credentials and an HTTPS supported URL for the callback
|
|
configuration (HTTP won't work). Then you'll need to provide the keys to the
|
|
Rails application.
|
|
|
|
#### Beta support
|
|
|
|
This authentication provider is currently marked as beta. This means it will be
|
|
available but hidden from public access until more thoroughly tested.
|
|
|
|
If you want to make this feature publicly available (without the state
|
|
parameter) you can enable the `apple_auth` feature flag from the Flipper
|
|
dashboard or the Rails console with `Flipper.enable(:apple_auth)`.
|
|
|
|
# Apple Developer Portal Configuration
|
|
|
|
[Register/Sign in](https://developer.apple.com/account) to your Apple Developer
|
|
Account.
|
|
|
|
## Service ID Configuration
|
|
|
|
1. [Create a Service ID](https://developer.apple.com/account/resources/identifiers/list/serviceId)
|
|
|
|
|
|
|
|
2. Name the Service and finalize the registration
|
|
|
|
|
|
|
|
3. Configure Domains and Subdomains & the callback URL. This example uses
|
|
[ngrok](https://ngrok.io) for HTTPS support.
|
|
|
|
|
|
|
|
## Key Configuration
|
|
|
|
1. [Register a new Key](https://developer.apple.com/account/resources/authkeys/add).
|
|
Enable the "Sign in with Apple" option and configure it so it's associated
|
|
with the corresponding App ID
|
|
|
|
|
|
|
|
2. Download the Key
|
|
|
|
|
|
|
|
# Configuring the Rails Application
|
|
|
|
Now with both the Service ID and Key you'll need to enable Apple Authentication
|
|
and pass in the credentials in the admin dashboard `/admin/config`.
|
|
|
|
|
|
|
|
Add the corresponding configuration data. Make sure the PEM key you downloaded
|
|
has explicit linebreaks (`\n`), don't forget the one at the very end of it.
|
|
|
|
|
|
|
|
Save the changes and restart your server for these values to take effect.
|
|
|
|
## Email configuration
|
|
|
|
Apple uses what they call Private Email Relay Service to hide user's emails. For
|
|
this to work first
|
|
[create a new email source](https://developer.apple.com/account/resources/services/list).
|
|
|
|
|
|
|
|
Emails sent need to be authenticated and the configuration depends on the
|
|
different providers available:
|
|
|
|
- [Mailchimp](https://mailchimp.com/help/set-up-custom-domain-authentication-dkim-and-spf/)
|
|
- [SendGrid](https://sendgrid.com/docs/ui/account-and-settings/how-to-set-up-domain-authentication/)
|
|
- [SES](https://docs.aws.amazon.com/es_es/ses/latest/DeveloperGuide/send-email-authentication-dkim.html)
|