Apple sign-in mix between id and token

[SebC99]

In #5755, it is said that the authData should be:

{
  "apple": {
    "id": "jwt token for user", // required, used for validation
    "access_token": "an authorized access token for the user", // optional, currently does nothing but maybe in the future
  }
}

whereas the authAdapter's id should be a unique id to recognized the user.
The Apple JWT is always changing since it includes the time and the Apple Public Key, so we have to use the Apple credential.user as the id and the JWT (identityToken) as the token/access_token.
And then, when the server inspects the JWT, we can check if the sub element is equal to the id

In the current version, every login causes a user creation.
I can try to to a PR if you want

(btw, great work for this implementation!)

[dplewis]

Nice catch! Feel free to submit a PR. Where do you get credential.user?

Also can you add support for private key as discussed here?
#5846 (comment)

[SebC99]

@dplewis I don't know what it is about... I can't see anywhere in Apple's doc how the private key could replace the public key. I'm guessing it's two completely different subject: the public key is need for the JWT validation, and the private key is needed to obtain new tokens (??)

[dplewis]

@SebC99 Just checked you are right, you can ignore that.

[SebC99]

@dplewis I think the iOS and the JS version is not really the same, so the credential.user identifier is described here and is corresponding to the sub element of the JWT identity token.
I don't know what's the name of that identifier in the JS version, except that it's still in the decoded JWT token.

[dplewis]

The JS Version returns a user but its a JSON string here

The Rest API Version returns

[access_token] => ...
[token_type] => Bearer
[expires_in] => 3600
[refresh_token] => ...
[id_token] => ...

In both cases if a developer wanted a identifier they would have to decode the JWT and use the sub field as you mentioned.

Here is how I decode id_token in php

$claims = explode('.', $response->id_token)[1];
$claims = json_decode(base64_decode($claims));
$userId = $claims['sub'];

The solution you have is valid but we should document how to get the identifier.

[SebC99]

You're right, in JS, it's easy to obtain the id with JSON.parse(atob(token.split(".")[1])).sub