Apple - new option for using private key instead secret key. #1019

hamrak · 2023-05-04T09:28:28Z

Rather than static client secrets, Apple requires that you derive a client secret yourself from your private key. They use the JWT standard for this, using an elliptic curve algorithm with a P-256 curve and SHA256 hash. In other words, they use the ES256 JWT algorithm.

This PR add new configuration options that allow you to use private key instead of manually generating secret key every 6 months.

'key_id' => env('APPLE_KEY_ID'),
'team_id' => env('APPLE_TEAM_ID'),
'private_key' => env('APPLE_PRIVATE_KEY'), // Must be absolute path, e.g. /var/www/cert/AuthKey_XYZ.p8
'passphrase' => env('APPLE_PASSPHRASE'), // Set if your key have a passphrase.
'signer' => env('APPLE_SIGNER'), // Signer used for Configuration::forSymmetricSigner().

Need to merge #1018 first.

atymic · 2023-05-13T07:53:06Z

Could we get a docs like and a rebase please :)

# Conflicts: # src/Apple/Provider.php

hamrak · 2023-05-13T16:18:36Z

I don't know what you mean exactly.
Official Apple documentation for creating secret token is here: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens#3262048

I also put some description in README.md.

Can you tell me exactly what I should add? :)

atymic · 2023-05-13T22:32:25Z

src/Apple/Provider.php

+        return (new self(
+            new Request(),
+            config('services.apple.client_id'),
+            config('services.apple.client_secret'),


Will this method still work if the secret is dervied?

Yes it will work. I had to do that (create new object) because this function is called statically (don't know why) and it was necessary to call other non static functions.

stale · 2023-08-12T07:01:52Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

pricop · 2023-09-22T09:10:17Z

This seems to be inspired from https://bannister.me/blog/generating-a-client-secret-for-sign-in-with-apple-on-each-request

Perhaps add support for private keys that are stored in the database / string format too?

My proposal would be something like:

$this->privateKey = $private_key_path; // Support for plain text private keys

if (!empty($private_key_path) && file_exists($private_key_path)) {
    $this->privateKey = file_get_contents($private_key_path);
}

This will ensure backwards compatibility for those of us who are already using this integration.

Thank you.

hamrak · 2023-09-24T18:30:59Z

pricop

Done ;)

stale · 2023-12-15T07:30:01Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

atymic · 2024-02-07T12:56:53Z

Is this ready for review/merge?

pricop · 2024-02-07T13:48:40Z

Yes, it should be ready for review/merge. I've been using this successfully into production on multiple websites. This would be an awesome addition.

hamrak · 2024-02-07T14:18:50Z

Yes, i use it in production too.

atymic

One small change and a comment.

atymic · 2024-02-10T12:11:20Z

src/Apple/Provider.php

+    protected function getJwtConfig()
+    {
+        if (!$this->jwtConfig) {
+            $private_key_path = config('services.apple.private_key', '');


can we access this via the standard method, ie add to

public static function additionalConfigKeys() { return ['private_key', 'otherkey...']; }

$this->getConfig('private_key', '')

Yes, we can. Changed.

atymic · 2024-02-10T12:12:43Z

src/Apple/Provider.php

+                $this->privateKey = file_get_contents($private_key_path);
+            }
+
+            $this->jwtConfig = Configuration::forSymmetricSigner(


Just to confirm, there is no bc break here, existing integrations using the secret key will continiue to work fine?

yes, if you pass the path to the private key file, it will get the contents of the private key file, otherwise you put the private key contents by default.

atymic · 2024-02-10T12:13:23Z

@hamrak just a quick thing re; config and a question, then I will merge and tag new vers :)

atymic · 2024-02-11T13:35:20Z

src/Apple/Provider.php

+            if (!empty($this->privateKey)) {
+                $appleToken = new AppleToken($this->getJwtConfig());
+                $this->clientSecret = $appleToken->generate();
+                config()->set('services.apple.client_secret', $this->clientSecret);


Might need to set this to a variable on the class with above switch to $this->getConfig

Why do you think so?

atymic · 2024-02-11T13:35:46Z

src/Apple/Provider.php

+    {
+        return (new self(
+            new Request(),
+            config('services.apple.client_id'),


Suggested change

config('services.apple.client_id'),

$this->getConfig('client_id', '')

And other calls to config()

You can call $this-> in static function, or ?

oh my bad, didn't realise it was static. Is that why it overrides the global config above?

oh my bad, didn't realise it was static. Is that why it overrides the global config above?

yes

atymic · 2024-02-11T14:20:28Z

src/Apple/Provider.php

+    {
+        return (new self(
+            new Request(),
+            config('services.apple.client_id'),


oh my bad, didn't realise it was static. Is that why it overrides the global config above?

atymic · 2025-01-03T07:53:17Z

cc @hamrak sorry can you resolve conflicts and we can get this in

# Conflicts: # src/Apple/Provider.php

hamrak · 2025-01-06T09:18:33Z

cc @hamrak sorry can you resolve conflicts and we can get this in

Done.

hamrak added 3 commits May 4, 2023 07:51

no message

5641e50

Fix StyleCI

37df282

Add option for private key instead of secret key.

d9048ea

This was referenced May 4, 2023

Apple - 400 Bad Request on calling userFromToken Method #1004

Closed

Apple - Broken since 5.5.0 #1015

Closed

hamrak added 2 commits May 4, 2023 16:24

FIX ERROR: Key cannot be empty

cab4fb5

Merge branch 'master' into p8

e00146f

hamrak added 2 commits May 13, 2023 17:46

Merge commit 'ab427bd39c95e2c25196c3d0e55558f63f193133' into p8

a8d76d3

# Conflicts: # src/Apple/Provider.php

Update README.md

372d8d1

atymic reviewed May 13, 2023

View reviewed changes

stale bot added the stale label Aug 12, 2023

stale bot closed this Sep 17, 2023

atymic reopened this Sep 18, 2023

stale bot removed the stale label Sep 22, 2023

hamrak added 2 commits September 24, 2023 20:28

Merge commit '87fac09257241b997baef2e0992719bda028e37a' into p8

806916a

Apple - Added support for plain text private keys [pricop]

0618773

stale bot added the stale label Dec 15, 2023

stale bot removed the stale label Feb 7, 2024

atymic requested changes Feb 10, 2024

View reviewed changes

Merge commit 'da904b57acadf9303e2747f725662cfb61db1636' into p8

c3a25b5

Define additionalConfigKeys()

add78fd

hamrak requested a review from atymic February 11, 2024 11:45

atymic requested changes Feb 11, 2024

View reviewed changes

atymic approved these changes Feb 11, 2024

View reviewed changes

Merge commit 'e5687f2fe8ab305f7dea4a8805cf499ad24c7542' into p8

f9bc3fd

# Conflicts: # src/Apple/Provider.php

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apple - new option for using private key instead secret key. #1019

Apple - new option for using private key instead secret key. #1019

hamrak commented May 4, 2023

atymic commented May 13, 2023

hamrak commented May 13, 2023

atymic May 13, 2023

hamrak May 18, 2023

stale bot commented Aug 12, 2023

pricop commented Sep 22, 2023

hamrak commented Sep 24, 2023

stale bot commented Dec 15, 2023

atymic commented Feb 7, 2024

pricop commented Feb 7, 2024

hamrak commented Feb 7, 2024

atymic left a comment

atymic Feb 10, 2024

hamrak Feb 11, 2024

atymic Feb 10, 2024

hamrak Feb 11, 2024

atymic commented Feb 10, 2024

atymic Feb 11, 2024

hamrak Feb 11, 2024

atymic Feb 11, 2024

hamrak Feb 11, 2024

atymic Feb 11, 2024

hamrak Jan 6, 2025

atymic Feb 11, 2024

atymic commented Jan 3, 2025

hamrak commented Jan 6, 2025

	config('services.apple.client_id'),
	$this->getConfig('client_id', '')

Apple - new option for using private key instead secret key. #1019

Are you sure you want to change the base?

Apple - new option for using private key instead secret key. #1019

Conversation

hamrak commented May 4, 2023

atymic commented May 13, 2023

hamrak commented May 13, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stale bot commented Aug 12, 2023

pricop commented Sep 22, 2023

hamrak commented Sep 24, 2023

stale bot commented Dec 15, 2023

atymic commented Feb 7, 2024

pricop commented Feb 7, 2024

hamrak commented Feb 7, 2024

atymic left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

atymic commented Feb 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

atymic commented Jan 3, 2025

hamrak commented Jan 6, 2025