Skip to content

Configuring Apple

Apple can be used as a federated authenticator in WSO2 Identity Server.

How it works

When a user attempts to log in to a client application through Apple Sign In:

  1. The client application initiates the authentication flow by communicating with WSO2 Identity Server.
  2. WSO2 Identity Server redirects the user to the Apple Sign In page.
  3. Apple authenticates the user and redirects the user back to WSO2 Identity Server with an authorization code.
  4. WSO2 Identity Server sends the authorization code to the Apple Sign In token endpoint and requests an ID token in return.
  5. Apple validates the client application's client ID, client secret, and authorization code and responds with an ID token, access token, and refresh token.
  6. WSO2 Identity Server validates the received ID token and extracts the authenticated user information.
  7. WSO2 Identity Server completes the authentication flow by redirecting back to the client application with the authenticated user information.

Configurations

Follow the steps below to configure WSO2 Identity Server to authenticate users using their Apple credentials.

Before you begin

  1. Register an application on the Apple Developer Portal and make sure you obtain the following:

    • Client ID: This identifies the requests sent from WSO2 Identity Server to the application.
    • Client secret: This authenticates the requests sent from WSO2 Identity Server to the application.
    • Callback URL: This is the URL to which Apple sends the response after authenticating the user.
  2. Sign in to WSO2 Identity Server Management Console.

Configuring the identity provider

To configure WSO2 Identity Server as an identity provider that uses Apple for federated authentication:

  1. On the Main tab of the Management Console, click Identity > Identity Providers > Add.

    Add Identity Provider menu-item

    The Add New Identity Provider screen appears.

    Add New Identity Provider screen

  2. Enter a meaningful name in the Identity Provider Name text box, e.g., AppleSignIn.

  3. Under Federated Authenticators, click OAuth2/OpenID Connect Configuration, and enter the required values as given below.

    OAuth2/OpenID Connect Federated Authenticator Configuration screen

    Field Description Sample Value
    Enable OAuth2/OpenIDConnect Selecting this option enables OAuth2/OpenID Connect to be used as an authenticator for users provisioned to WSO2 Identity Server. Selected
    Default Selecting this option signifies that OAuth2/OpenID Connect is used as the main/default form of authentication. Selecting this removes the selection made for any other Default checkboxes for other authenticators. Selected
    Client Id This is the client key of your Apple application. idp.demologin.com
    Client Secret This is the client secret of your Apple application.
    Authorization Endpoint URL This is the authorization endpoint URL pertaining to Apple Sign In. https://appleid.apple.com/auth/authorize
    Token Endpoint URL This is the token endpoint URL pertaining to Apple Sign In. https://appleid.apple.com/auth/token
    Callback URL This is the service provider's URL to which authorization codes are sent. Upon successful authentication, the browser should be redirected to this URL. The URL should be specified in the following format: https://:/acs https://localhost/callback
    Userinfo Endpoint URL This is not relevant for this feature. -
    OpenID Connect User ID Location This is not relevant for this feature. -
    Additional Query Parameters These are the additional query parameters that are necessary authenticate users through Apple Sign In. scope=openid email
    Enable HTTP basic auth for client authentication This is not relevant for this feature.

    Warning

    Make sure to keep it unselected.


  4. Click Register.

You have successfully added the identity provider.

Configuring the service provider

To configure the client application as a service provider in WSO2 Identity Server:

  1. In the Main menu of the WSO2 Identity Server Management Console, click Identity > Service Providers > Add.

    Add Service Provider menu-item

    The Add New Service Provider screen appears.

    Add New Service Provider screen

  2. Enter a meaningful name for the client application in the Service Provider Name text box and click Register. The Service Providers screen appears.

    Service Providers screen

  3. Click Inbound Authentication Configuration section and configure based on the authentication protocol that is required for the client application.

    Inbound Authentication Configuration options

    Tip

    If your client application uses OpenID Connect, click OAuth/OpenID Connect Configuration > Configure.

    1. Enter the callback URL or your Apple application.

    2. Click Register. Note that you will be redirected to the Service Providers screen, which displays the client key and client secret.

    Info

    For more information on inbound authentication configurations, see Configuring Inbound Authentication for a Service Provider.

  4. Under Local and Outbound Authentication Configuration section, select Federated Authentication as the Federated Authentication radio button and select the identity provider as AppleSignIn.

    Local and Outbound Authentication Configuration

  5. Click Update to save the changes.

You have now successfully added and configured the service provider. You can now try to log in to the client application with your Apple ID.

Top