2 ms·

Is Sign in with Apple compliant with OAuth2 / OpenID Conenct? If it's not I don't see how Apple can justify mandating the inclusion of something that isn't stan

• ascagnel_ 7y ago
  They don't call it OAuth/OpenID, but they're using the same terminology and API: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple#how-sign-in-with-apple-works-hint-it-uses-oauth-and-oidc https://developer.okta.com/blog/2019/06/04/what-the-heck-is-...
• setr 7y ago
  If they provide a sufficiently good sdk, I'm not clear on what the issue is justification-wise, beyond the justification necessary for any mandatory inclusions they already have. Why does a standard matter for justifying mandatory inclusion of ... anything? Most of their mandates probably lack any kind of standardization.
• TJSomething 7y ago
  It's mostly compliant as of a few months ago [0]. That document is actually out of date, because Apple added a discovery endpoint since then [1]. They also haven't implemented the userinfo endpoint, but the only claims they expose are openid, name, and email, so it's not that big of a deal to just ask for those in the id_token. And the client_secret_post thing isn't much of a problem either, since their custom JWT is a perfectly valid client secret that's compliant with the underlying OAuth 2.0 standard and it's explained in their discovery document. [0] https://bitbucket.org/openid/connect/src/default/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md https://bitbucket.org/openid/connect/src/default/How-Sign-in... [1] https://appleid.apple.com/.well-known/openid-configuration https://appleid.apple.com/.well-known/openid-configuration