This is maybe the first time I see a positive open letter. Kudos to both parties.
Apple Successfully Implements OpenID Connect with Sign in with Apple
31–40 of 121 posts
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#32Looks like Apple fixed all of the critical issues here https://bitbucket.org/openid/connect/src/default/How-Sign-in... but left in some "peculiarities," some of which are quite unpleasant. > The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope. So if y…
How is that a bad thing?
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#33Looks like Apple fixed all of the critical issues here https://bitbucket.org/openid/connect/src/default/How-Sign-in... but left in some "peculiarities," some of which are quite unpleasant. > The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope. So if y…
Is there a straight-forward deauthorize / re-request ux loop to allow for changes to app scope over time?
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#34has sign in with Apple launched yet? It was the Big Thing in iOS 13 that I was personally most excited about but honestly, if it has launched, I haven't seen it yet. edit: from the comments it sounds like it has launched, but currently being implemented in a voluntary manner. Looked at the 9to5Mac article on iOS 13 support of apps and it looks like I just don't use any of them unfortunately. Love the idea still and h…
Apple was planning on making SIWA support mandatory, but pushed that back to 2020.
My understanding is that critical bugs pushed back the implementation deadline even for existing applications.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#35Looks like Apple fixed all of the critical issues here https://bitbucket.org/openid/connect/src/default/How-Sign-in... but left in some "peculiarities," some of which are quite unpleasant. > The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope. So if y…
How is that a bad thing?
How is it not? Consent to releasing information should be supported on a granular on-demand level. If I initially only need name, I'll ask the user to consent for that. If I later on need an email (lets say for some additional functionality user is trying to access), I'll ask for email separately. This is much better than being constrained to only the initial scope being respected, resulting everyone basically request everything right away, faced with a situation where they can't do it later.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#36Still not to spec. And no PKCE? Oy.
But it is to spec. [0]
"Since September 2019 all spec violations have been addressed by Apple, as recorded in the next section. The section thereafter - "Peculiarities" lists specific implementation choices by Apple that differ from what most implementations provide, but are not spec violations per se."
[0] - https://bitbucket.org/openid/connect/src/default/How-Sign-in...
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#37So I don't currently use Apple products, does this mean that people can use their own OpenID Connect identity providers with Apple (like if I run an Open ID Connect server at idp.example.com, I can add it as an authentication source) or is this just for using Apple's Identity Provider to allow your own apps to log-in via your Apple account? Open ID Connect is essentially a an OAuth2 implementation. The original Open…
Decentralization always fails, centralization is inherent to society and human nature. That's why we generally centralize around areas that turn into huge metropolitan cities, and why 99% of git usage is on Github, Gitlab or Bitbucket. We're a centralization-loving race. So OAuth 1.0's dream of decentralization resulted in only a few OAuth providers ever lasting long.
[deleted]
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#38So I don't currently use Apple products, does this mean that people can use their own OpenID Connect identity providers with Apple (like if I run an Open ID Connect server at idp.example.com, I can add it as an authentication source) or is this just for using Apple's Identity Provider to allow your own apps to log-in via your Apple account? Open ID Connect is essentially a an OAuth2 implementation. The original Open…
Decentralization always fails, centralization is inherent to society and human nature. That's why we generally centralize around areas that turn into huge metropolitan cities, and why 99% of git usage is on Github, Gitlab or Bitbucket. We're a centralization-loving race. So OAuth 1.0's dream of decentralization resulted in only a few OAuth providers ever lasting long.
Except that TCP/IP, email, and the web has shown that it can also be otherwise. Big sites come and go. I don’t think you can always state general rules along these lines (cities are different from hosting source code). You have to look at the friction vs advantages per scenario. The web, for example, has little friction due to Google providing the grease, and massive long-tail advantages in decentralization. OpenID has a lot of friction in its implementation, and few known identity providers exist for most individuals... not to mention trade offs in the implementation and profile details available per provider create incentive for developers to only put a “sign in with Facebook/google” button on their sites/apps.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#39The working document linked to by this press release: https://bitbucket.org/openid/connect/src/default/How-Sign-in... Since September 2019 all spec violations have been addressed by Apple, as recorded in the next section. The section thereafter - "Peculiarities" lists specific implementation choices by Apple that differ from what most implementations provide, but are not spec violations per se. The previous HN discus…
And in fairness to Apple, most OIDC implementations have peculiarities. The Go OAuth library has a handful of quirks for specific providers.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#40I'm glad they've got the tech right for the actual authentication, but their email relay is still far from usable.
It's limited in very fundamental ways, that will prevent many companies of any scale from using it. It's very difficult to make it work with an email service such as SendGrid, and it's limited to 10 domains you can prove ownership of, and 10 specific email addresses.
I work for a company that charges users and ships physical products – our payment providers and shipping providers all need to be able to contact our customers if they choose to use those services, but this would be essentially impossible (or a prohibitive amount of technical work at scale).
It's a very poor implementation. I wrote an obnoxiously long blog post about this. https://danpalmer.me/2019-07-02-on-signing-in-with-apple/