Live data from Hacker News

Apple Successfully Implements OpenID Connect with Sign in with Apple

openid.net

111–120 of 121 posts

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#111
post #8

So I don't currently use Apple products, does this mean that people can use their own OpenID Connect identity providers with Apple (like if I run an Open ID Connect server at idp.example.com, I can add it as an authentication source) or is this just for using Apple's Identity Provider to allow your own apps to log-in via your Apple account? Open ID Connect is essentially a an OAuth2 implementation. The original Open…

OpenID Connect’s most frustrating aspect is its naming, reminding me of a time when OpenID (1.0) was more commonplace.

With OpenID Connect, users only get the benefit if the site implements a particular identity provider... a continued move to the walled-gardenism of the net.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#112
post #57

Shameless plug (but I hope that's okay, again): IRMA Authentication is an open-source app [1] and protocol that offers privacy-friendly attribute based authentication and signing using Camenisch and Lysyanskaya's Idemix [2]. It's currently heavily focused towards The Netherlands, where citizens can obtain attributes such as name, home address and age. These attributes can then be selectively disclosed directly to a s…

Is IRMA still phone-only? IRMA can't meet its stated design goals if owning a smartphone is required.

Currently, IRMA is indeed still phone-only. We're quite aware that not everybody owns or wants to use a smartphone. Our software is not very tightly bound to the iOS and Android platforms, and we've explored various options over the years (smartcards, random-reader'esque devices). However, executing one of those options will only be possible if we see more adoption in general.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#113

Earlier quoted context omitted.

Can you offer a real-world example of when this would be the case for a product where logging in is required?

Even from a user standpoint... oops I clicked the "cancel" button when I meant to click "confirm" and now I have to go through the signup process all over again because the developer is not allowed to ask me again.

Last time I touched permissions the app was able to give the user a link to iOS Settings page where the user can grant previously denied permissions.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#114

Earlier quoted context omitted.

My Apple ID is a personal email address at a custom domain name. I also use the same email address as a Microsoft ID. How would/should/could a service be expected to take my email and determine what services it is associated with? I assume that’s not really possible, and as an end-user I don’t particularly want that to be possible anyway. But let’s take a simpler scenario, just because my email address is something@g…

If I understand correctly AppleID is supposed to obfuscate your real email such that the website you connect to will only see a hhfyguihry636357484@privacy.apple.com or something similar.

optionally, IIRC

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#115
post #86

Earlier quoted context omitted.

Basically, if you're a large org, you must be an OpenID Provider (OP). Optionally, you might also be a consumer. If an org supports social login, for instance, they are likely a consumer and a provider. The user authenticates at an external OP (like Apple or Google), but a local account (or "identity") is always created by the service provider, which should be stored in an OpenID Provider. > but it's ultimately an id…

You are correct in that quite often who implements provider vs consumer depends largely on market position. There is technically no reason Apple can't become a consumer, other than they aren't interested in doing so. Also consider that, should Apple choose to eliminate your account, then you've lost whatever you use Apple to sign in with unless those downstream providers offer some kind of recovery mechanism.

> Also consider that, should Apple choose to eliminate your account, then you've lost whatever you use Apple to sign in with unless those downstream providers offer some kind of recovery mechanism.

Yes, some kind of recovery mechanism, some ability to set a local credential post-registration, or some ability to link and unlink external accounts, e.g. Sign in with Apple, then link your Google, FB, and Github accounts. Then, if you lose access to your Apple account, you still have additional options for authentication.

The latter two options are something I wish more organizations offered..!

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#116
post #98

Apple's online credential/auth* user experience is terrible. I can't wait till Apple fixes their account auto-lock feature. On weekly basis I have to unlock my account because someone is trying to login with my email. I contacted the customer service to see if something could be done to avoid auto-locking. The only suggestion was to pick another email address that's not common. Also in order for me to unlock I have t…

To be honest I read all your complaints as a "screw Apple for protecting me".. pretty disrespectful. Their answer is expected. If your email is something like "john.smith@gmail.com" - there are like few hundred thousends of Smiths there.. And the complaint that recovery email cannot be the same as account email - so you want your account to be compromised without ANY way to recover it? Those seem like complaints of a…

The problem would go away if Apple got off their lazy lock-in ass and allowed U2F like everyone else.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#117

Earlier quoted context omitted.

Usually you offer a connect button with the most popular providers. You could also detect a login with somename@whateverapplemaildomain in order to passthrough for those addresses. There are some discovery mechanisms that can be added for DNS/http(s) services as well against different tlds. In the end, probably would just add an apple-logo button next to twitter, google and facebook auth buttons. ---- Aside, in terms…

> There are some discovery mechanisms that can be added for DNS/http(s) services as well against different tlds. I'm aware of OIDC's webfinger discovery mechanism; IIRC, it lets you translate "person@example.com" into a valid login. (But I don't think I've ever seen anyone implement this.) Is there something else? I think you could also implement just a DNS identifier to OIDC discovery which would let you translate s…

Microsoft's online login is probably the most prominent example of translating "user@domain.com" into a SSO login/redirect that uses Azure AD or another SSO provider for signon that I can think of.

I know it's based on DNS and/or HTTP(S) entries for the common SSO, just don't recall all the specs off hand.

For the google/apple and other very common cases you can detect by a whitelist for the domain part. For others, if there isn't a discovery mechanism in place, would have to defer to internal (password) created accounts.

It's a bit of a mess, fortunately there's a handful of TLDs that account for over 95% of public users. IIRC, when I worked at emailage, it was something like >85% of requests were from 20 domains, and 95% or so were from 100.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#118
post #92

Earlier quoted context omitted.

`OpenID Connect` (OIDC) is not `OpenID`, despite the confusingly similar name. For the most part, `OpenID Connect` prefers to the wall full of Sign-In Options buttons/logos for determining ID Provider, instead of a user entering some specific address (as `OpenID` used to) and a lookup process, because there is more ceremony involved in establishing trust between an ID Provider and Relying Party as OIDC is built on to…

Yes, there is a way to do the dynamic functionality of OpenID 2.0 on Connect by using Metadata, WebFinger, and Dynamic Client Registration, but most of the large providers do not support all three of these. Google (for instance) wants a relying party to do some amount of registration/click through first in a web browser before their site can rely on Google. Apple (for their part) hangs your ability to support Sign in…

Yes, hence, "for the most part, prefers". Since it's an optional part of the spec and because basically no major OIDC IdP supports it nor plans to ever support it, it's basically nonexistent functionality.

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#119

Earlier quoted context omitted.

> There are some discovery mechanisms that can be added for DNS/http(s) services as well against different tlds. I'm aware of OIDC's webfinger discovery mechanism; IIRC, it lets you translate "person@example.com" into a valid login. (But I don't think I've ever seen anyone implement this.) Is there something else? I think you could also implement just a DNS identifier to OIDC discovery which would let you translate s…

My Apple ID is a personal email address at a custom domain name. I also use the same email address as a Microsoft ID. How would/should/could a service be expected to take my email and determine what services it is associated with? I assume that’s not really possible, and as an end-user I don’t particularly want that to be possible anyway. But let’s take a simpler scenario, just because my email address is something@g…

I'm mostly trying to clarify if the parent poster knew about something more than Webfinger, since his post mentions "DNS/http(s) services"; wasn't sure if that referred to Webfinger, or something else.

> How would/should/could a service be expected to take my email and determine what services it is associated with?

By following the OIDC standard, namely, using Webfinger discovery. I was mostly confused since, AFAIK, OIDC only mentions webfinger, not DNS, so I was curious if the parent to my post knew something I did not.

> as an end-user I don’t particularly want that to be possible anyway

I don't see why not. Note that this is discovering who the identity provider associated with an email is in an automated way — this is not discovering what services you log in to with that identity. That is, for "example@gmail.com", Webfinger would discover that Google is the identity provider. This is something a human can — roughly — already discern from the email anyways; this just provides an automated means. Moreover, it provides a means for the service wanting to log you in to then subsequently redirect you to; there are certain configuration parameters needed beyond just the email.

The idea is to make it simple for the average user: just enter your email.

> just because my email address is something@gmail.com, does that mean Google should be used as the OAuth provider?

Not necessarily, but I think the OIDC flow there is pretty good. One could imagine an implementation whereby GMail allowed you to specify an alternative IdP for your email, and then responded to with that when queried. This is more to do with Google's implementation. (Which, AFAIK, doesn't implement Webfinger at all, so it is kind of moot. And while I doubt they'd ever implement this sort of thing, the point is more that an IdP under your control could / that nothing in the spec prohibits it.)

> Maybe I use that same email address as an Apple ID and as a Microsoft ID as well.

I think OIDC supports this. The Webfinger query is not limited to a single result. (Though, given the paucity of webfinger implementations, I don't know how well UIs would handle this. But again, implementation vs. specification.) Even if that didn't work, you could always enter your IdP hostname directly into the RP, and it could either Webfinger that, or just see if that hostname is the IdP by attempting to pull the metadata from it.

(It is sad that most OIDC implementing RPs only give you a few hand-selected buttons leading to major IdPs to choose from.)

Re: Apple Successfully Implements OpenID Connect with Sign in with Apple

#120
post #98

Apple's online credential/auth* user experience is terrible. I can't wait till Apple fixes their account auto-lock feature. On weekly basis I have to unlock my account because someone is trying to login with my email. I contacted the customer service to see if something could be done to avoid auto-locking. The only suggestion was to pick another email address that's not common. Also in order for me to unlock I have t…

To be honest I read all your complaints as a "screw Apple for protecting me".. pretty disrespectful. Their answer is expected. If your email is something like "john.smith@gmail.com" - there are like few hundred thousends of Smiths there.. And the complaint that recovery email cannot be the same as account email - so you want your account to be compromised without ANY way to recover it? Those seem like complaints of a…

I am talking about the basic user experience for my iTunes music, video and apps. Apple's "protection" of my account isn't better or stronger than other popular online services, such as, Facebook, Dropbox, or Gmail. I have more sensitive data in my Dropbox and Gmail accounts than Apple's. And yet I go through trouble each week to unlock my account. Why do I need to be troubled by it to get access to things I paid for?

So here is a real story why I complained about requiring a different email address than the primary one. So a few years ago my apple account got locked due to their extra "protection". I tried to reset my password. I was given two options: to recovery by email or answer secret questions. Unfortunately I no longer had access to my works email and my answers weren't matching. It took another year till I could remember the exact answer I entered at the beginning. Till then my hundreds dollar of digital goods were locked out.

Post reply on HN