sso with apple id not working

[rolikeusch]

i have setup sso with apple id, but when try to login i get the message "invalid_request - response_mode must be form_post when ..." (see screenshot for full message)
i found something about this in the apple forum, not sure if this also related to my issue.

any idea how i can fix this?

[Eugeny]

I've fixed this issue, but unfortunately couldn't confirm it since I need to wait for my Service ID provisioning - could you give this build a try? https://github.com/warp-tech/warpgate/actions/runs/3352578787

[rolikeusch]

I have now an other error message, but I think the url in the apple config is right - I used https://server-url/@warpgate/api/sso/return

[Eugeny]

This means that the redirect URL generated by Warpgate doesn't match the one set in the Sign in with Apple configuration - you can see the actual redirect URL inside the SSO URL that Warpgate sends you to, e.g.:

https://appleid.apple.com/auth/authorize?response_type=code&client_id=com.warpgate.test&state=TVQhIfGywuWs4WB9X0T3nQ&code_challenge=klbY_EQhMNdugmfEgcEW4lmcFogVMoOD6ngc2kLKQ5Q&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fwarpgate.com%3A8888%2F%40warpgate%2Fapi%2Fsso%2Freturn&scope=openid+email&response_mode=form_post&nonce=GOBBTJBf7C9glNyaN7vbAg

<-- &redirect_uri=https%3A%2F%2Fwarpgate.com%3A8888%2F%40warpgate%2Fapi%2Fsso%2Freturn

[rolikeusch]

ah I see the problem. that's the url:

redirect_uri=https%3A%2F%2Fserver-url%3A8888%2F%40warpgate%2Fapi%2Fsso%2Freturn&scope=openid+email&response_mode=form_post&nonce=npucAM-3e6nS

and there ist the port 8888 hard coded? how can I change this? as my server is listen on port 443. in the config I have:

external_host: server-url

also if i append the port, there will still be 8888 used.

[Eugeny]

I see - you have a reverse proxy in front, right? Currently Warpgate is not aware that frontend and backend port numbers can differ and will use the port number from the config file to construct the URL. I'll need to add a new external_port option for each protocol

[rolikeusch]

yes right, I have a proxy in front.

[Eugeny]

Should be fixed now - see https://github.com/warp-tech/warpgate/wiki/Warpgate-behind-a-reverse-proxy for configuration

[rolikeusch]

not sure if you see this issue or if I have to open a new one. I think I have now everything set for Apple ID. I can also login with my Apple ID, but then I see this error:

but I don't know what code verification fails now.

[Eugeny]

Finally fixed! Please note that the config layout is now changed too - Warpgate will now generate the JWT token for you