Earlier quoted context omitted.
For new Apps it is mandatory, existing apps have until April of next year to support it before updates will start getting rejected.
Only mandatory if you use Facebook/google sign in.
Any third party sign-in.
Apple Successfully Implements OpenID Connect with Sign in with Apple
71–80 of 121 posts
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#72Slightly off topic, but it's been frustrating to me that large organizations only want to implement OpenID providers and not consumers. What Apple has done makes it easier to bring your Apple identity across the internet, but it's ultimately an identity that Apple owns.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#73Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#74So I don't currently use Apple products, does this mean that people can use their own OpenID Connect identity providers with Apple (like if I run an Open ID Connect server at idp.example.com, I can add it as an authentication source) or is this just for using Apple's Identity Provider to allow your own apps to log-in via your Apple account? Open ID Connect is essentially a an OAuth2 implementation. The original Open…
Decentralization always fails, centralization is inherent to society and human nature. That's why we generally centralize around areas that turn into huge metropolitan cities, and why 99% of git usage is on Github, Gitlab or Bitbucket. We're a centralization-loving race. So OAuth 1.0's dream of decentralization resulted in only a few OAuth providers ever lasting long.
I wonder if people "centralize", i.e. gather, around cities to enjoy the more and varied (decentralized, even?) opportunities afforded. Many rural areas force centralization of, say, one grocery store or one hardware store. There is generally one town center, whereas in larger metropolitan areas one can choose from many, many different social circles, markets, and to some extent even governmental centers. That strikes me as a big win for decentralization.
Even your example of git seems counter to your point— can you imagine if all version control ground to a halt whenever GitHub went down?
I realize this is off-topic, but it is an interesting thought.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#75I'm glad they've got the tech right for the actual authentication, but their email relay is still far from usable. It's limited in very fundamental ways, that will prevent many companies of any scale from using it. It's very difficult to make it work with an email service such as SendGrid, and it's limited to 10 domains you can prove ownership of, and 10 specific email addresses. I work for a company that charges use…
I think maybe if everybody selling something didn’t make the audacious assumption that I’m also providing my email address because I really want you to spam the shit out of me with all of your announcements and promotions, it wouldn’t have to come to this.
I certainly don’t want anybody I buy from having my Apple ID email, and they should not assume that just because it is a user identifier, that does not mean it’s even used for email. Some retailers do this with things like paypal, and actually overwrite the supplied email address with the one from paypal. Really annoying.
The correct pattern is to ask the user for the email address that they would like you to have. And preferably, never send email to it again.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#76Slightly off topic, but it's been frustrating to me that large organizations only want to implement OpenID providers and not consumers. What Apple has done makes it easier to bring your Apple identity across the internet, but it's ultimately an identity that Apple owns.
Basically, if you're a large org, you must be an OpenID Provider (OP). Optionally, you might also be a consumer.
If an org supports social login, for instance, they are likely a consumer and a provider.
The user authenticates at an external OP (like Apple or Google), but a local account (or "identity") is always created by the service provider, which should be stored in an OpenID Provider.
> but it's ultimately an identity that Apple owns.
I would say that's slightly inaccurate.. it's ultimately identity information that Apple owns. And of course, Apple owns your account with Apple.
But the minute you "sign in with Apple" to any service, they too are creating a local identity for you (sans password). That identity begins with the information provided by Apple (e.g. name, email address, etc.), but can expand over time to include additional information provided by the user, not Apple.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#77For those of you interested in this topic, check out Internet Identity Workshop: https://internetidentityworkshop.com/
Great little "un-conference", hosted semi-annually in Mountain View, CA. Where a lot of the nuts and bolts were worked out for OpenID Connect.
In fact, today IIW 29 is coming to a close. Next gathering in April, 2020.
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#78Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#79Earlier quoted context omitted.
What value would they enter at what prompt in order to activate the Apple Accounts process? For example, "openid.apple.com" or "some_email_address@openid.apple.com" or ...?
Usually you offer a connect button with the most popular providers. You could also detect a login with somename@whateverapplemaildomain in order to passthrough for those addresses. There are some discovery mechanisms that can be added for DNS/http(s) services as well against different tlds. In the end, probably would just add an apple-logo button next to twitter, google and facebook auth buttons. ---- Aside, in terms…
I wish there was an easy way to save a hackernews comment for later
Re: Apple Successfully Implements OpenID Connect with Sign in with Apple
#80Earlier quoted context omitted.
Usually you offer a connect button with the most popular providers. You could also detect a login with somename@whateverapplemaildomain in order to passthrough for those addresses. There are some discovery mechanisms that can be added for DNS/http(s) services as well against different tlds. In the end, probably would just add an apple-logo button next to twitter, google and facebook auth buttons. ---- Aside, in terms…
I wish there was an easy way to save a hackernews comment for later
Click on the 'X minutes ago' permalink on the comment, and then select 'favorite'. It will show up under 'favorited ... comments' linked from your profile page while logged in.