Skip to content

Add Apple login

You can add Apple login to your applications using WSO2 Identity Server and enable users to log in with their Apple IDs.

Follow this guide for instructions.

Register WSO2 Identity Server on Apple

Before you begin

You need a paid subscription to get access to an Apple developer account.

To register WSO2 Identity Server on Apple, you need to create the following components on Apple's Developer Portal:

Step 1: Register an App ID

To register an App ID:

  1. On the Apple Developer portal, go to Program resources > Certificates, Identifiers & Profiles > Identifiers.

    Add Apple identifiers

  2. Click + to register an App ID.

  3. Select App IDs and click Continue.
  4. Select App as the type and click Continue.

  5. Enter the values for the following parameters.

    Parameter Definition
    Description A description for the services ID.
    Bundle ID A unique identifier for the application. It is usually a string of characters in reverse domain name notation.
    Example: com.domainname.appname

    Register an App ID

  6. Under the Capabilities tab, select Sign in with Apple.

  7. Click Continue and then click Register.
Step 2: Register a Services ID

To register a services ID:

  1. On the Apple Developer portal, go to Program resources > Certificates, Identifiers & Profiles > Identifiers.

    Add Apple identifiers

  2. Click + and select Services IDs and click Continue.

  3. Enter values for the following parameters:

    Parameter Definition
    Description A description for the services ID.
    Identifier A unique identifier for the application. It is usually a string of characters in reverse domain name notation. This value is considered the client ID of the application.
    Example: com.domainname.appname

  4. Click Continue and then click Register.

  5. Go back to the Identifiers section and click on the Services ID you created.
  6. Enable Sign in with Apple and click Configure.
  7. Under Web Authentication Configuration, select the App ID you created as the Primary App ID.

  8. Enter the following values under Register Website URLs.

    Parameter Value
    Domain wso2is.example.com
    Return URL https://wso2is.example.com/commonauth

    Restrictions with Sign in with Apple on Localhost

    The Sign in with Apple feature cannot be configured with localhost (or 127.0.0.1). Attempting this setup results in an "invalid domain" error from Apple's configuration step. For testing, use a real or DNS-resolvable domain name. For local development, domain mappings in the etc/hosts file can be utilized.

  9. Click Continue and then click Save.

Step 3: Register a new key

To register a new key:

  1. On Apple Developer portal, go to Program resources > Certificates, Identifiers & Profiles > Keys.

    Add Apple keys

  2. Click + to register a new key.

  3. Enter a name for the key, enable Sign in with Apple, and click Configure.
  4. Under Configure Keys, select the App ID you created previously and click Save. Then click Continue.

  5. Click Register.

    Note

    You will now see that your app's Private key is ready to be downloaded. Download and save it securely, as you cannot download it again. Also, take note of the Key ID that is displayed on this page.

  6. Click Done.

Note down the Team ID displayed in the top right corner under your name.

You can follow the Apple documentation for detailed instructions.

Tip

A client secret is required to integrate the Apple application with WSO2 Identity Server. Usually, the external IdP generates a client secret, but in this scenario, Apple expects WSO2 Identity Server to generate the client secret.

Register the Apple IdP

Now, let's register the Apple IdP in WSO2 Identity Server.

  1. On the WSO2 Identity Server Console, go to Connections.
  2. Click New Connections and select Apple.

  3. Enter the following details of the Apple identity provider and click Finish:

    Add Apple IDP in WSO2 Identity Server

    Parameter Description
    Name A unique name for this Apple identity provider.
    Services ID The services ID obtained from Apple..
    Team ID Apple developer team ID obtained from Apple.
    Key ID Key identifier of the private key generated for the app.
    Private Key Private key generated for the app.

After creating the Apple identity provider, go to the Settings tab and see the list of scopes to which Apple has granted permissions.

  • email: Allows to view the user's email address.
  • name: Allows to view the user's name fields.

Note

WSO2 Identity Server needs these scopes to get user information. WSO2 Identity Server checks the attribute configurations of the application and sends the relevant attributes received from Apple to the app. You can read the Apple documentation to learn more.

Update the client secret validity period

WSO2 Identity Server generates a client secret for the IdP. This client secret has the default maximum validity period of six months.

If you wish to reduce the validity period:

  1. On the WSO2 Identity Server Console, go to Connections.
  2. Click Setup on your Apple IdP.
  3. On the Settings tab update the value of the Client Secret Validity Period.

Enable Apple login

Before you begin

You need to register an application with WSO2 Identity Server. You can register your own application or use one of the sample applications provided.

  1. On the WSO2 Identity Server Console, go to Applications.

  2. Select your application, go to the Login Flow tab and add Apple login from your preferred editor:

    1. Click Add Sign In Option to add a new authenticator to the first step.

    2. Select the Apple connection.

    3. Click Confirm to add login with Apple to the sign-in flow.

      Configuring Apple login in WSO2 Identity Server using the Visual Editor

    Recommendations

    It is recommended to add your social and enterprise connections to the first authentication step as they are used for identifying the user.

  3. Click Update to save your changes.

Try it out

Follow the steps given below.

  1. Access the application URL.

  2. Click Login to open the WSO2 Identity Server login page.

  3. On the WSO2 Identity Server login page, click Sign in with Apple.

    Login with Apple

  4. Log in to Apple with an existing Apple ID.

Note

When a user successfully logs in with Apple for the first time,

  • Apple will prompt you to create an account for the Apple IDP application.
  • A user account is created in the WSO2 Identity Server Console with the Apple username. Apple will manage this new user account.

Configure connection

To learn more about other configurations available for the connection, refer to the add federated login documentation.