Appleid

[mnestor]

Summary

I do have everything working. Probably not the best way in parts though.

Apple really wants their POST for callback:
Had to add MethodPost to the /oauth2/callback handler.
For csrf needed to change samesite to no. With it set to lax the browser will nuke the session on POST and csrf will always fail.

For documentation update, really not much but I'll get a PR over there too. This just adds an idp_provider of "apple"

idp_provider: "apple"
idp_client_id: blah
idp_client_secret:  blah

For routing, we are limited to just checking based on email.

Related issues

Fixes #3958

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[CLAassistant]

All committers have signed the CLA.

[desimone]

Thanks for the PR @mnestor , we have an apple account. Just need to test / confirm this works on our end.

[coveralls]

Coverage: 63.243% (+0.03%) from 63.215% when pulling 266c281 on mnestor:appleid into d0e7b88 on pomerium:main.

[mnestor]

Hopefully G101 issue is resolved here, trying to lint on my system just bombs out.

[calebdoxsey]

I confirmed that this works.

I suggest two changes, which we can do in subsequent PRs.

1. Support using the private key directly and generating the JWT according to apple's documentation: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens (a tedious manual step)
2. Only disabling CSRF for Apple.

[mnestor]

I had been considering #1 already but was trying to keep the changes down. Should it be done in an either or case? Meaning allow the current way or use the private key?

For #2 I will need to think on as that was my first inclination as well as only allowing post for apple but didn't see a path without... a lot more changes. Could just have been a bit of tunnel vision though.

Should I add a #3 for the Post as well?

[calebdoxsey]

I had been considering #1 already but was trying to keep the changes down. Should it be done in an either or case? Meaning allow the current way or use the private key?

For #2 I will need to think on as that was my first inclination as well as only allowing post for apple but didn't see a path without... a lot more changes. Could just have been a bit of tunnel vision though.

Should I add a #3 for the Post as well?

I can implement the changes I mentioned in a separate PR after we merge this one.

I left comments on some changes. If fixing the lint gets the tests to pass I will merge.

[calebdoxsey]

(and yes, for the client secret I will try to make it work either way, which we can detect fairly easily by whether or not the client secret is a JWT or a PEM file)

[mnestor]

Okay. I was going to try and hammer all those out tomorrow but am rather interested to see your way and I'm still newish to Go. Thanks for fixing my comment failures! Already hit commit on them all.

I am thinking there is something wrong with this but it could just be my environment is small and I couldn't figure out separation of services yet so its all in one except for postgres. The auth session seems to be sending the user back to Apple more frequently than I think it should but that just might be my service restarts.

[calebdoxsey]

I think the token is only valid for 10 minutes? Trying to figure out if there is a way to make it last longer.

[calebdoxsey]

Actually its not the token expiration. I'm not sure why I had to re-login. It doesn't seem to be happening now.