omniauth-apple 1.1.0 → 1.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +18 -3
  3. data/README.md +71 -0
  4. data/lib/omniauth/apple/version.rb +1 -1
  5. data/lib/omniauth/strategies/apple.rb +30 -18
  6. data/omniauth-apple.gemspec +0 -1
  7. metadata +2 -16
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: feebd01d5717de66bfd00f8587459642d203ca2ffaf0b2057c5cd002993d3531
4
- data.tar.gz: 2febe43a836eb2232c011b7f87996bbc837ce56f94ebe03f8eb57378ead44530
3
+ metadata.gz: 31e8e9835b469abca7611926aaa4da9b1f3e35804ea9c4e9fa5b06a1791dcdd1
4
+ data.tar.gz: c916fa50a22971da3f2f71a72566e43771531945b7d9e83bbaf0914a04a6253a
5
5
  SHA512:
6
- metadata.gz: 4c91f969f3e89c2bfd272d8c8df82287b964d3bb636c8dde97b037edb3b6030e415e79715ff940175c0c807a518c1279470fbe73b69a6bb752acb84774db358b
7
- data.tar.gz: 619709528b5b0e683ea0f9938268a9443cb273788dea3ae98f557cf828d539b35dd898c7c73efcfb04115944f003bfd29702916403a40d3e715ef8fb5c53fbe6
6
+ metadata.gz: 02bde67e85651dc85bacdb548248d240d9a3c501f24a204ad572253af8cd6468914fe3de86ee30bbc7a174bb6249d77ee6ae82222573beb829dc9b4f7f690099
7
+ data.tar.gz: 57a0b49a53f55a77470ad280c27acdb11bccfa93e43170ed0c34730b3fdb9918bb0d43a1ac20ae30f10eb101ef161bac5a79a90e54bee7186c8c813e7923f733
data/CHANGELOG.md CHANGED
@@ -1,5 +1,18 @@
1
1
  ## [Unreleased]
2
2
 
3
+ ## [1.2.1] - 2022-10-25
4
+
5
+ ### Fixed
6
+
7
+ - [#94](https://github.com/nhosoya/omniauth-apple/pull/94) rack-protection.rb is back in rack-protection v3.0.1
8
+ - [#96](https://github.com/nhosoya/omniauth-apple/pull/96) handle JWKS fetch failures
9
+
10
+ ## [1.2.0] - 2022-09-27
11
+
12
+ ### Fixed
13
+
14
+ - [#91](https://github.com/nhosoya/omniauth-apple/pull/91) explicitly specify auth_scheme for oauth2 v2+ support
15
+
3
16
  ## [1.1.0] - 2022-09-26
4
17
 
5
18
  ### Added
@@ -56,7 +69,9 @@
56
69
 
57
70
  ## [0.0.1] - 2019-06-07
58
71
 
59
- [Unreleased]: https://github.com/nhosoya/omniauth-apple/compare/v1.0.2...master
60
- [1.0.0]: https://github.com/nhosoya/omniauth-apple/compare/v0.0.3...v1.0.0
61
- [1.0.1]: https://github.com/nhosoya/omniauth-apple/compare/v1.0.0...v1.0.1
72
+ [Unreleased]: https://github.com/nhosoya/omniauth-apple/compare/v1.2.0...master
73
+ [1.2.0]: https://github.com/nhosoya/omniauth-apple/compare/v1.1.0...v1.2.0
74
+ [1.1.0]: https://github.com/nhosoya/omniauth-apple/compare/v1.0.2...v1.1.0
62
75
  [1.0.2]: https://github.com/nhosoya/omniauth-apple/compare/v1.0.1...v1.0.2
76
+ [1.0.1]: https://github.com/nhosoya/omniauth-apple/compare/v1.0.0...v1.0.1
77
+ [1.0.0]: https://github.com/nhosoya/omniauth-apple/compare/v0.0.3...v1.0.0
data/README.md CHANGED
@@ -34,6 +34,77 @@ Rails.application.config.middleware.use OmniAuth::Builder do
34
34
  end
35
35
  ```
36
36
 
37
+ ## Configuring "Sign In with Apple"
38
+
39
+ _other Sign In with Apple guides:_
40
+ - ["How To" by janak amarasena (2019)](https://medium.com/identity-beyond-borders/how-to-configure-sign-in-with-apple-77c61e336003)
41
+ - [the docs, by Apple](https://developer.apple.com/sign-in-with-apple/)
42
+
43
+ ### Look out for the values you need for your config
44
+ 1. your domain and subdomains, something like: `myapp.com`, `www.myapp.com`
45
+ 2. your redirect uri, something like: `https://myapp.com/users/auth/apple/callback` (check `rails routes` to be sure)
46
+ 3. omniauth's "client id" will be Apple's "bundle id", something like: `com.myapp`
47
+ 4. you will get the "team id" value from Apple when you create your _**App Id**_, something like: `H000000B`
48
+ 5. Apple will give you a `.p8` file, which you'll use to GENERATE your `:pem` value
49
+
50
+ ### Steps
51
+
52
+ 1. Log into your [Apple Developer Account](https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=891bd3417a7776362562d2197f89480a8547b108fd934911bcbea0110d07f757&path=%2Faccount%2F&rv=1)
53
+ (if you don't have one, you can [create one here](https://appleid.apple.com/account?appId=632&returnUrl=https%3A%2F%2Fdeveloper.apple.com%2Faccount%2F))
54
+
55
+ 2. Get an App Id with the "Sign In with Apple" capability
56
+ - go to your [Identifiers](https://developer.apple.com/account/resources/identifiers/list) list
57
+ - [start a new Identifier](https://developer.apple.com/account/resources/identifiers/add/bundleId) by clicking on the + sign in the Identifiers List
58
+ - select _**App IDs**_ and click _**continue**_
59
+ - select _**App**_ and _**continue**_
60
+ - enter a description and a bundle id
61
+ - check the **_"Sign In with Apple"_** capability
62
+ - save it
63
+
64
+ 3. Get a Services Id (which we will use as our client id)
65
+ - go to your [Identifiers](https://developer.apple.com/account/resources/identifiers/list) list
66
+ - [start a new Identifier](https://developer.apple.com/account/resources/identifiers/add/bundleId) by clicking on the + sign in the Identifiers List
67
+ - select _**Services IDs**_ and click _**continue**_
68
+ - enter a description and a bundle id
69
+ - make sure **_"Sign In with Apple"_** is checked, then click _**configure**_
70
+ - make sure the Primary App ID matches the App ID you configured earlier
71
+ - enter all the subdomains you might use (comma delimited):
72
+
73
+ example.com,www.example.com
74
+
75
+ - enter all the redirect URLS you might use (comma delimited):
76
+
77
+ https://example.com/users/auth/apple/callback,https://example.com/users/auth/apple/callback
78
+
79
+ - save the "Sign In with Apple" capability config and the Service Id
80
+
81
+ 4. Get a Secret Key
82
+ - go to your [Keys](https://developer.apple.com/account/resources/authkeys/list) list
83
+ - [start a new Key](https://developer.apple.com/account/resources/authkeys/add) by clicking on the + sign in the Keys List
84
+ - enter a name
85
+ - make sure **_"Sign In with Apple"_** is checked, then click _**configure**_
86
+ - make sure the Primary App ID matches the App ID you configured earlier
87
+ - save the "Sign In with Apple" capability
88
+ - click "continue" to finish the Key config (you will be prompted to _**Download Your Key**_)
89
+ - Apple will give you a `.p8` file, keep it safe and secure (don't commit it).
90
+
91
+ ### Mapping Apple Values to OmniAuth Values
92
+ - your `:team_id` is in the top-right of your App Id config (aka _**App ID Prefix**_), it looks like: `H000000B`
93
+ - your `:client_id` is in the top-right of your Services Id config (aka _**Identifier**_), it looks like: `com.example`
94
+ - your `:key_id` is on the left side of your Key Details page, it looks like: `XYZ000000`
95
+ - your `:pem` is the content of the `.p8` file you got from Apple, _**with an extra newline at the end**_
96
+
97
+ - example from a Devise config:
98
+
99
+ ```ruby
100
+ config.omniauth :apple, ENV['APPLE_SERVICE_BUNDLE_ID'], '', {
101
+ scope: 'email name',
102
+ team_id: ENV['APPLE_APP_ID_PREFIX'],
103
+ key_id: ENV['APPLE_KEY_ID'],
104
+ pem: ENV['APPLE_P8_FILE_CONTENT_WITH_EXTRA_NEWLINE']
105
+ }
106
+ ```
107
+
37
108
  ## Contributing
38
109
 
39
110
  Bug reports and pull requests are welcome on GitHub at https://github.com/nhosoya/omniauth-apple.
data/lib/omniauth/apple/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  module OmniAuth
2
2
  module Apple
3
- VERSION = "1.1.0"
3
+ VERSION = "1.2.1"
4
4
  end
5
5
  end
data/lib/omniauth/strategies/apple.rb CHANGED
@@ -11,7 +11,8 @@ module OmniAuth
11
11
  option :client_options,
12
12
  site: 'https://appleid.apple.com',
13
13
  authorize_url: '/auth/authorize',
14
- token_url: '/auth/token'
14
+ token_url: '/auth/token',
15
+ auth_scheme: :request_body
15
16
  option :authorize_params,
16
17
  response_mode: 'form_post',
17
18
  scope: 'email name'
@@ -73,27 +74,38 @@ module OmniAuth
73
74
  def id_info
74
75
  @id_info ||= if request.params&.key?('id_token') || access_token&.params&.key?('id_token')
75
76
  id_token = request.params['id_token'] || access_token.params['id_token']
76
- jwt_options = {
77
- verify_iss: true,
78
- iss: 'https://appleid.apple.com',
79
- verify_iat: true,
80
- verify_aud: true,
81
- aud: [options.client_id].concat(options.authorized_client_ids),
82
- algorithms: ['RS256'],
83
- jwks: fetch_jwks
84
- }
85
- payload, _header = ::JWT.decode(id_token, nil, true, jwt_options)
86
- verify_nonce!(payload)
87
- payload
77
+ if (verification_key = fetch_jwks)
78
+ jwt_options = {
79
+ verify_iss: true,
80
+ iss: 'https://appleid.apple.com',
81
+ verify_iat: true,
82
+ verify_aud: true,
83
+ aud: [options.client_id].concat(options.authorized_client_ids),
84
+ algorithms: ['RS256'],
85
+ jwks: verification_key
86
+ }
87
+ payload, _header = ::JWT.decode(id_token, nil, true, jwt_options)
88
+ verify_nonce!(payload)
89
+ payload
90
+ else
91
+ {}
92
+ end
88
93
  end
89
94
  end
90
95
 
91
96
  def fetch_jwks
92
- http = Net::HTTP.new('appleid.apple.com', 443)
93
- http.use_ssl = true
94
- request = Net::HTTP::Get.new('/auth/keys', 'User-Agent' => 'ruby/omniauth-apple')
95
- response = http.request(request)
96
- JSON.parse(response.body, symbolize_names: true)
97
+ conn = Faraday.new(headers: {user_agent: 'ruby/omniauth-apple'}) do |c|
98
+ c.response :json, parser_options: { symbolize_names: true }
99
+ c.adapter Faraday.default_adapter
100
+ end
101
+ res = conn.get 'https://appleid.apple.com/auth/keys'
102
+ if res.success?
103
+ res.body
104
+ else
105
+ fail!(:jwks_fetching_failed, CallbackError.new(:jwks_fetching_failed, 'HTTP Error when fetching JWKs'))
106
+ end
107
+ rescue Faraday::Error => e
108
+ fail!(:jwks_fetching_failed, e)
97
109
  end
98
110
 
99
111
  def verify_nonce!(payload)
data/omniauth-apple.gemspec CHANGED
@@ -38,7 +38,6 @@ Gem::Specification.new do |spec|
38
38
 
39
39
  spec.add_dependency 'omniauth-oauth2'
40
40
  spec.add_dependency 'jwt'
41
- spec.add_dependency 'rack-protection', '~> 2.0'
42
41
  spec.add_development_dependency "bundler", "~> 2.0"
43
42
  spec.add_development_dependency "rake", "~> 13.0"
44
43
  spec.add_development_dependency "rspec", "~> 3.9"
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: omniauth-apple
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.0
4
+ version: 1.2.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - nhosoya
@@ -9,7 +9,7 @@ authors:
9
9
  autorequire:
10
10
  bindir: exe
11
11
  cert_chain: []
12
- date: 2022-09-26 00:00:00.000000000 Z
12
+ date: 2022-10-25 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: omniauth-oauth2
@@ -39,20 +39,6 @@ dependencies:
39
39
  - - ">="
40
40
  - !ruby/object:Gem::Version
41
41
  version: '0'
42
- - !ruby/object:Gem::Dependency
43
- name: rack-protection
44
- requirement: !ruby/object:Gem::Requirement
45
- requirements:
46
- - - "~>"
47
- - !ruby/object:Gem::Version
48
- version: '2.0'
49
- type: :runtime
50
- prerelease: false
51
- version_requirements: !ruby/object:Gem::Requirement
52
- requirements:
53
- - - "~>"
54
- - !ruby/object:Gem::Version
55
- version: '2.0'
56
42
  - !ruby/object:Gem::Dependency
57
43
  name: bundler
58
44
  requirement: !ruby/object:Gem::Requirement