Sign in with Apple

The AspNet.Security.OAuth.Apple provider for Sign in with Apple requires some custom configuration compared to the other OAuth 2.0 providers in this repository.

This document provides some additional information and context to help you configure the provider to successfully integrate Sign in with Apple into your ASP.NET Core application.

Configuration

Client Secret

Unlike other providers, the ClientSecret property is not used as Sign in with Apple does not use a static client secret value. Instead the client secret has to be generated using a private key file provided by Apple from the Developer Portal that is used with the Key ID and Team ID to create a signed JSON Web Token (JWT).

The provider comes with a built-in extension method UsePrivateKey(string) to generate they secret from a .p8 certificate file on disk that you provide. Here's a code example:

services.AddAuthentication(options => /* Auth configuration */)
        .AddApple(options =>
        {
            options.ClientId = Configuration["AppleClientId"];
            options.KeyId = Configuration["AppleKeyId"];
            options.TeamId = Configuration["AppleTeamId"];

            options.UsePrivateKey((keyId) =>
                Environment.ContentRootFileProvider.GetFileInfo($"AuthKey_{keyId}.p8"));
        });

Alternatively you can use the Func<string, Task<ReadOnlyMemory<char>>> PrivateKey property of the AppleAuthenticationOptions class to provide a delegate to a custom method of your own that loads the private key's bytes from another location, such as Azure Key Vault, Kubernetes secrets etc.

Below are two examples of this approach.

Loading from an Environment Variable

services.AddAuthentication(options => /* Auth configuration */)
        .AddApple(options =>
        {
            options.ClientId = Configuration["Apple:ClientId"];
            options.KeyId = Configuration["Apple:KeyId"];
            options.TeamId = Configuration["Apple:TeamId"];
            options.PrivateKey = (keyId, _) =>
            {
                return Task.FromResult(Configuration[$"Apple:Key:{keyId}"].AsMemory());
            };
        });

Loading from Azure Key Vault

services.AddAuthentication(options => /* Auth configuration */)
        .AddApple()
        .Services
        .AddOptions<AppleAuthenticationOptions>(AppleAuthenticationDefaults.AuthenticationScheme)
        .Configure<IConfiguration, SecretClient>((options, configuration, client) =>
        {
            options.ClientId = configuration["Apple:ClientId"];
            options.KeyId = configuration["Apple:KeyId"];
            options.TeamId = configuration["Apple:TeamId"];
            options.PrivateKey = async (keyId, cancellationToken) =>
            {
                var secret = await client.GetSecretAsync($"AuthKey-{keyId}", cancellationToken: cancellationToken);
                return secret.Value.Value.AsMemory();
            };
        });

Issues Loading Private Key

If you encounter issues loading the private key of the certificate, the reasons could include one of the following scenarios.

Windows Server with IIS

For the second scenario, in order to load private keys Windows requires the user profile to be loaded.

This can be configured manually in IIS (or via your hosting platform's admin portal), but in some web hosting scenarios such as Azure App Service's Free and Shared tiers, it is not possible to load the user profile for security reasons due to the multi-tenant architecture of such services.

If you cannot load the user profile, possible solutions include:

Upgrading to a paid tier with dedicated infrastructure, such as Azure App Service's Standard tier
Loading the key from a .pfx file using the ephemeral key set (X509KeyStorageFlags.EphemeralKeySet)

Further information can be found in this GitHub issue: aspnet-contrib#358

Related Issues

Below are links to some issues raised against this repository that were related to configuration and/or environmental issues:

Apple secret generation doesn't work in Azure App Service Free/Shared Tier (#358)
Allow passing in private key as string instead of p8 file (#385)
Apple Signin redirects to a blank page 404 Error (#390)