[Need help with testing] Feature request: Apple Signin

[imWildCat]

Apple Signin is also a great option. Do we have plan for it? Or could I start a draft PR for it?

[ganigeorgiev]

I don't have experience with Apple ID and its authentication flow.

I'll have to research it, but if Apple supports OAuth2 and could return the user email address, then I guess it shouldn't be very difficult to integrate it with PocketBase.

For now I'm not planning to work on this because a lot of other tasks already have piled in the roadmap, but if you want to pick it, you can see what changes are required from this closed Twitter OAuth2 PR - #118 (twitter oauth2 api currently doesn't support returning the user email address so it cannot be integrated with PocketBase).

[imWildCat]

Sure! I will give a try! Thanks for the reply!

[ganigeorgiev]

This probably will need to be prioritized a little because I've recently learned from Twitter that the App store seems to have a requirement for "Apple Sign-in" if other 3rd party auth services are used:

Apps that exclusively use a third-party or social login service (such as Facebook Login, Google Sign-In, Sign in with Twitter, Sign In with LinkedIn, Login with Amazon, or WeChat Login) to set up or authenticate the user’s primary account with the app must also offer Sign in with Apple as an equivalent option.

With PocketBase v0.6.0+, we now support OAuth2 providers that don't return an email, so it shouldn't be an issue even if the Apple OAuth2 api doesn't return it.

If @imWildCat couldn't find the time to work on this, I'll pick the issue after the users management refactoring in #376

[imWildCat]

@ganigeorgiev thanks! Yeah, please take over this work.

I recently moved to a new country and am still in the process of settling down.

[jonafeucht]

I’ve researched and experimented with this a bit over the weekend, and it looks like the barrier to entry to even test this is having an active developer account.

But besides that, it does look like Apple is following industry standards. Although instead of using the PKCE flow, they're using the hybrid flow.

I believe this will need a rewrite of some sort, which will add technical debt to Pocketbase since it uses the former exclusively #55.

Also, I think it would be best to convert this issue into a discussion.

Resources for further study:

• https://appleid.apple.com/.well-known/openid-configuration
• https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple
• https://developer.apple.com/forums/thread/118688?answerId=367664022#367664022
• https://bitbucket.org/openid/connect/src/master/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md
• https://www.scottbrady91.com/openid-connect/implementing-sign-in-with-apple-in-aspnet-core
• https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api
• https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js
• https://developer.apple.com/videos/play/wwdc2019/706/

[CodeWithBenji]

Not sure if anyone is onto this. If no one is currently working on it I'm more than happy to start working on an implementation.

[ganigeorgiev]

@Benjii-lee Thanks, but keep in mind that PRs for new features are temporary "frozens" due to ongoing users management refactoring in #376 and it's better to wait because there will be a lot of internal changes (especially to the tests).

[ganigeorgiev]

I've tried to look today into this, but as @jonafeucht mentioned, it seems that you need to enroll in the "Apple Developer Program" first in order to obtain an "App ID".

But unfortunately, I wasn't able to do any of this because when I clicked from web "Account > Enroll today" and tried to enroll as "Individual/Sole Proprietor", I got the following message at the final step:

Your enrollment in the Apple Developer Program could not be completed at this time.

I'm not sure what I've done wrong, but I'm not even allowed to change the user fields that I've entered before the final step.

Additionally, looking at the Apple guides, there also seems to be a fee of $99 per year, but I'm not sure if this is only for when you want to submit something to the App store or it just an enrollment requirement?

In any case, I'll have to put this feature request "on hold" unless someone with an apple developer account decide to contribute.

@Benjii-lee if you want to help with this feel free to make a PR against the rc branch. For an example you could check the most recent Microsoft AD provider integration in 5298543 (you can ignore the UI changes).

[benallfree]

I have an active apple dev acct, how can I help?

[deannemphos]

@ganigeorgiev I'm still relatively new to Swift but I believe that registering the app with Apple to get a valid App ID requires payment for the developer account.

I'm working on a project right now that will require Apple Sign In and I have a developer account so I'll post updates here if I make any headway.

[ganigeorgiev]

@benallfree, @deannemphos

To be honest, I'm not really sure what are all the requirements for the integration because I wasn't able to continue beyond the "App Developer Program" enrollment (and I'm still baffled why I'm getting the above error; there was no payment option or any additional verification process other than the phone text message).

But anyway, for a guide I'm using the official Apple docs - https://help.apple.com/developer-account/#/devde676e696.

This article also contains very detailed instructions what to do in the Apple dashboard - https://medium.com/identity-beyond-borders/how-to-configure-sign-in-with-apple-77c61e336003.

Supabase also has a great documentation for this in https://supabase.com/docs/guides/auth/auth-apple.

To summarize, we need to be able to allow "Sign-in with Apple" by configuring a ClientId and ClientSecret but the problem is obtaining them and creating the OAuth2 application in the Apple developer platform.

[deannemphos]

Decided to take a crack at it, the instructions you linked were as straightforward as it gets & worked like a charm. I managed produce valid tokens and got a successful login attempt to a test URL. As best as I can tell, adding an Apple ID login option to the admin dashboard should work much in the same way as any of the other registered OAuth2 providers.

For anyone looking to implement this before PocketBase officially adds support, the docs already cover handling user authentication from any OAuth2 provider and should work just fine for web apps. On the Apple Developer dashboard, make sure the return URL in your Services ID configuration points to the proper address and is using HTTPS otherwise it'll return an invalid address error.

As for Swift, I'm not positive on how to integrate PocketBase with the built-in "sign in with Apple" option but manually adding in OAuth authentication (which you'd have to do anyways for something like Google sign-in) and using the generated tokens would work the same even if it's a bit more effort.

Let me know if you need any help whenever this gets implemented, I'd be more than happy to generate valid tokens for you or anyone working it @ganigeorgiev!

[n1xx1]

The problem with implementing the apple oauth flow is that currently you can only request the name and email scope if your response_mode is set to form_post. So you are required to have a backend that actually handles a post callback and does the authentication.

Also it would be cool if pocketbase could generate the client secret itself if you configure the teamid, clientid, keyid and private key. But from what I've seen there is no support for custom options for providers and I don't know if @ganigeorgiev wants to go this route.

[ganigeorgiev]

@n1xx1 We can add a special helper endpoint for Apple OAuth2 if that's the only limitation, but please note that the email or name fields are no longer required and as long as Apple returns an account id we can create/associate it to a PocketBase user just fine.

[GregoryConrad]

Hi, I was evaluating pocketbase for my app (currently using Firebase), and really want to switch to pocketbase (mainly because of its extensibility as a framework). However, this is a blocking issue, as I am only using social sign in and Apple requires you to have SIWA to submit to the App Store in this case.

Some things I want to note:

Your enrollment in the Apple Developer Program could not be completed at this time.

I had this same error online. If you have an Apple device, can you try installing the Apple Developer app and doing enrollment from there? I was able to register my Apple developer account from within the app but not on web.

Also, I am not sure how pocketbase works internally, but SIWA is a bit different than some other providers; for starters, you only get a user's name (if they supply it) on the first sign in. After that first sign in, the information you get each subsequent sign-in is extremely limited. I do also know that you will always get an email on the first sign in (not sure about subsequent ones but I frankly doubt it), but the email may be an anonymous SIWA email to protect users' privacy.

[sonovice]

Is there anything we can do to help with the Apple sign in?
In my case, the absence prevents the use of pocketbase as a backend for iOS apps, although I would love to use it.

[ganigeorgiev]

@sonovice Nothing has changed since my last comment in - #899 (comment).

The suggested implementation in the related PR needs to be slightly refactored to minimize the settings.Settings breaking changes.

After the upcoming v0.13.0 release I'll try again creating a new Apple developer account and will see if I can prioritize it.

[n1xx1]

Unfortunately I didn't have time to update the PR.

[ganigeorgiev]

@n1xx1 No worries. I'll try to update it sometime next week.

[ganigeorgiev]

@sonovice and anyone else who is following here, I've submitted a new POC implementation in #1954.

I need help with verifying that it works and will appreciate if someone got the time to test it and help me finalize it.
You can find steps how to run the changes in the #1954 PR description.

[ganigeorgiev]

The Apple OAuth2 implementation from #1954 was merged in the develop branch and it will be available with the next v0.14.0 release.

[sonovice]

@ganigeorgiev Sorry that I could not test it yet. I'll be back on Thursday and will give it a whirl.