苹果第三方登录Sign in with Apple服务端验证

2020-05-13 15:33:58 Albin Wong 7416

苹果官方接口文档：[Sign in with Apple REST API](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api "Sign in with Apple REST API")
### 开发者后台配置
1. 在“Certificates, Identifiers & Profiles (英文)”(证书、标识符和描述文件) 中，从侧边栏中选择“Identifiers”(标识符), 在[证书配置管理中心](https://developer.apple.com/account/resources/identifiers/list "证书配置管理中心")，配置Sign In with Apple功能
[![配置Sign In with Apple功能](/uploads/article/20200513/2e4f4f9a5c4ac90df2a120e72a826ac7.png)](https://www.albinwong.com/uploads/article/20200513/2e4f4f9a5c4ac90df2a120e72a826ac7.png)
2. 创建“通过 Apple 登录”私钥，选择“Sign in with Apple”(通过 Apple 登录)。创建和下载启用了“通过 Apple 登录”的私钥，并将该私钥与主要 App ID 相关联。每个主要 App ID 可以关联两个密钥。点按“Configure”(配置)，选择正确的`Primary App ID`，生成一个私钥，该文件"AuthKey_{Kid}.p8"存在。创建和下载启用了“通过 Apple 登录”的私钥，并将该私钥与主要 App ID 相关联。每个主要 App ID 可以关联两个密钥。然后，获取密钥标识符 (kid) 来创建 JSON 网络令牌 (JWT)，用来与已启用的功能进行通信。该私钥只能能下载一次，请务必把该文件保存好。
[![](/uploads/article/20200515/3258513456d8c3dd674bc5d6ffcfe510.png)](https://www.albinwong.com/uploads/article/20200515/3258513456d8c3dd674bc5d6ffcfe510.png)
[![view kid](/uploads/article/20200515/553c4f42b2f9a00b5d793282f4088398.png "view kid")](https://www.albinwong.com/uploads/article/20200515/553c4f42b2f9a00b5d793282f4088398.png "view kid")
3. 在[identifiers](https://developer.apple.com/account/resources/identifiers/list "identifiers")中查找`App ID Prefix`(Team ID)和`Bundle ID`(explicit)
[![](/uploads/article/20200515/3633f9de866642a528381e94cf0e01a1.png)](https://www.albinwong.com/uploads/article/20200515/3633f9de866642a528381e94cf0e01a1.png)

### 服务端验证
第三方依赖安装
```
composer require fproject/php-jwt 4.0
composer require lcobucci/jwt 3.3
```
#### 一、验证identityToken有效性和正确性
`identityToken`是基于一个JWT算法格式，要使用JWT这个库去进行解析验证，验证其有效性、合法性

1.使用Apple的公钥来验证identityToken

官方文档： [Fetch Apple's public key for verifying token signature](https://developer.apple.com/documentation/sign_in_with_apple/fetch_apple_s_public_key_for_verifying_token_signature "Fetch Apple's public key for verifying token signature")

协议 | https
--- | ---
http请求方式 | GET
Url | https://appleid.apple.com/auth/keys

**响应参数**

参数 | 类型 | 是否必填 | 描述 | 实例值
---|--- | :---: | --- | ---
kty | String | 是 | 密钥类型参数设置 | RSA
kid | String | 是 | 标识符密钥 | 86D88Kf
use | String | 是 | 预期使用的公钥 | sig
alg | String | 是 | 加密算法 | RS256
n | String | 是 | RSA公钥 | iGaLqP6y-SJCCBq5Hv6pGDbG_SQ11MNjH7rWHcCFYz4hGwHC4lcSurTlV8u3avoVNM8jXevG1Iu1SY11qInqUvjJ....
e | String | 是 | RSA公钥标识符 | AQAB

**返回成功示例**`200`
```json
{
  "keys": [
    {
      "kty": "RSA",
      "kid": "86D88Kf",
      "use": "sig",
      "alg": "RS256",
      "n": "iGaLqP6y-SJCCBq5Hv6pGDbG_SQ11MNjH7rWHcCFYz4hGwHC4lcSurTlV8u3avoVNM8jXevG1Iu1SY11qInqUvjJur--hghr1b56OPJu6H1iKulSxGjEIyDP6c5BdE1uwprYyr4IO9th8fOwCPygjLFrh44XEGbDIFeImwvBAGOhmMB2AD1n1KviyNsH0bEB7phQtiLk-ILjv1bORSRl8AK677-1T8isGfHKXGZ_ZGtStDe7Lu0Ihp8zoUt59kx2o9uWpROkzF56ypresiIl4WprClRCjz8x6cPZXU2qNWhu71TQvUFwvIvbkE1oYaJMb0jcOTmBRZA2QuYw-zHLwQ",
      "e": "AQAB"
    },
    {
      "kty": "RSA",
      "kid": "eXaunmL",
      "use": "sig",
      "alg": "RS256",
      "n": "4dGQ7bQK8LgILOdLsYzfZjkEAoQeVC_aqyc8GC6RX7dq_KvRAQAWPvkam8VQv4GK5T4ogklEKEvj5ISBamdDNq1n52TpxQwI2EqxSk7I9fKPKhRt4F8-2yETlYvye-2s6NeWJim0KBtOVrk0gWvEDgd6WOqJl_yt5WBISvILNyVg1qAAM8JeX6dRPosahRVDjA52G2X-Tip84wqwyRpUlq2ybzcLh3zyhCitBOebiRWDQfG26EH9lTlJhll-p_Dg8vAXxJLIJ4SNLcqgFeZe4OfHLgdzMvxXZJnPp_VgmkcpUdRotazKZumj6dBPcXI_XID4Z4Z3OM1KrZPJNdUhxw",
      "e": "AQAB"
    }
  ]
}
```
这里需要使用返回参数`n`和`e`信息去获取PEM格式的公钥了
```php
/**
     * Create a public key represented in PEM format from RSA modulus and exponent information
     *
     * @param string $n the RSA modulus encoded in Base64
     * @param string $e the RSA exponent encoded in Base64
     * @return string the RSA public key represented in PEM format
*/
private static function createPemFromModulusAndExponent($n, $e)
{
        $modulus = JWT::urlsafeB64Decode($n);
        $publicExponent = JWT::urlsafeB64Decode($e);
 
        $components = [
            'modulus' => pack('Ca*a*', 2, JWK::encodeLength(strlen($modulus)), $modulus),
            'publicExponent' => pack('Ca*a*', 2, JWK::encodeLength(strlen($publicExponent)), $publicExponent)
        ];
 
        $RSAPublicKey = pack(
            'Ca*a*a*',
            48,
            JWK::encodeLength(strlen($components['modulus']) + strlen($components['publicExponent'])),
            $components['modulus'],
            $components['publicExponent']
        );

$rsaOID = pack('H*', '300d06092a864886f70d0101010500'); 
        $RSAPublicKey = chr(0) . $RSAPublicKey;
        $RSAPublicKey = chr(3) . JWK::encodeLength(strlen($RSAPublicKey)) . $RSAPublicKey;

$RSAPublicKey = pack(
            'Ca*a*',
            48,
            JWK::encodeLength(strlen($rsaOID . $RSAPublicKey)),
            $rsaOID . $RSAPublicKey
        );

$RSAPublicKey = "-----BEGIN PUBLIC KEY-----\r\n" .
            chunk_split(base64_encode($RSAPublicKey), 64) .
            '-----END PUBLIC KEY-----';

return $RSAPublicKey;
}
```
得到PEM格式的公钥后就可以对客户端传过来的`identityToken`， Apple公钥接口每次返回两个可用数据，具体采用哪个公钥和解析`identityToken`，需参照`identityToken`header中 `kid`去选择:

```
// jwt 格式
eyJraWQiOiJBSURPUEsxIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnNreW3pbmcuZGV2aWNlbW9uaXRvciIsImV4cCI6MTU2NTY2ODA4NiwiaWF0IjoxNTY1NjY3NDg3LCJzdWIiOiIwMDEyNDcuOTNiM2E4OTlhN2M4NGMwY2I0NmNkMDhmMTAwNzk3ZjIuMDcwNCIsImNfaGFzaCI6Ik9oMmFtOWVNTldWWTNkcTVKbUNsYmciLCJhdXRoX3RpbWUiOjE1NjU2Njc0ODZ9.e-pdwK4iKWErr_Gcpkzo8JNi_MWwexnA15FvyOXQxTx0GsXzFT3qE3DmXqAar96nx3EqsHI1Qgquqt2ogyj-lLijK_46ifckdqPjncTEGzVWkNTX8uhY7M867B6aUnmR7u-cf2HsmhXrvgsJLGp2TzCI3oTp-kskBOeCPMyTxzNURuYe8zabBlUy6FDNIPeZwZXZqU0Fr3riv2k1NkGx5MqFdUq3z5mNfmWbIAuU64Z3yKhaqwGd2tey1Xxs4hHa786OeYFF3n7G5h-4kQ4lf163G6I5BU0etCRSYVKqjq-OL-8z8dHNqvTJtAYanB3OHNWCHevJFHJ2nWOTT3sbw
 
// header 解码
{
  "kid": "86D88Kf", //  对应上文说的密钥id
  "alg": "RS256"
}
 
// PAYLOAD 解码
{
  "iss": "https://appleid.apple.com", // 苹果签发的
  "aud": "com.Albin.Wong", // 开发者的APP ID
  "exp": 1589363490, // 该token的有效期为10分钟
  "iat": 1589362890,
  "sub": "000453.bcd374dec46c44309477241d3ca27878.0654", // 该用户在开发者中唯一标识
  "c_hash": "N1jySQaoiWt_ZwQOONO3Rg",
  "email": "albinwong@sina.com", // 如果用户在授权时隐藏了真实Apple ID, 将会得到一个邮箱服务器地址为 privaterelay.appleid.com 的转交邮箱
  "is_private_email" : true, // 如果email不是以privaterelay.appleid.com结尾的，该值不存在
  "email_verified": "true",
  "auth_time": 1589362890,
  "nonce_supported": true
}
```
**验证方法**
```php
public function checkIdentityToken($identityToken)
{
	$authKey = new Client(['base_uri' => 'https://appleid.apple.com'])->request('GET', '/auth/keys');
	$authKey = $res->getBody()->getContents();
     if (!empty($authKey)) {
          $auth = json_decode($authKey, true)['keys'];
     }
	try {
		$pem = self::createPemFromModulusAndExponent($auth[0]['n'], $auth[0]['e']);
		$result = (array)JWT::decode($verifyToken, $pem, array('RS256'));
	} catch (Exception $e) {
		if ($e->getMessage() == 'Signature verification failed') {
			$pem = $this->createPemFromModulusAndExponent($auth[1]['n'], $auth[1]['e']);
			$result = (array)JWT::decode($verifyToken, $pem, array('RS256'));
		}
	}
	var_export($result);
}
```

#### 二、 authorizationCode验证，生成和验证token

官方文档： [Generate and validate tokens](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens "Generate and validate tokens")

##### 1. 生成client_secret
`client_secret`是一个JSON对象，它包含一个header和playload。头包含以下参数

参数 | 类型 | 是否必填 | 描述 | 实例值
---|--- | :---: | --- | ---
alg | String | 是 | 算法类型 | ES256
kid | String | 是 | 开发者标识符密钥	 | 334NJ8LZ96
iss | String | 是 | 开发者team ID | DEF123GHIJ
iat | String | 是 | 生成claim时间戳 | 1437179036
exp | String | 是 | claim过期时间(最长生命周期180天) | 1493298100
aud | String | 是 | claim key  | https://appleid.apple.com
sub | String | 是 | 开发者的APP ID | com.Albin.Wong

在创建令牌之后，使用椭圆曲线数字签名算法(ECDSA)、P-256曲线和SHA-256哈希算法对其进行签名。在算法头密钥中指定ES256值。在kid属性中指定键标识符。

已解码的客户端机密JWT令牌具有以下格式:
```
{
    "alg": "ES256",
    "kid": "334NJ8LZ96"
}
{
    "iss": "DEF123GHIJ",
    "iat": 1437179036,
    "exp": 1493298100,
    "aud": "https://appleid.apple.com",
    "sub": "com.Albin.Wong"
}
```

生成`client_secret`实例
```php
public function generateClientSecret()
{
	$clientID = "com.Albin.Wong";
	$teamID = identifiers中查找App ID Prefix;
	$keyID = 私钥的ID;
	$payLoad = [
            "iss" => $teamID,
            "iat" => time(),
            "exp" => time() + 86400*180,
            "aud" => "https://appleid.apple.com", // 常数
            "sub" => $clientID,
	];
	$privateKey = fopen("AuthKey_{Kid}.p8","r");
	$JWTHeader = [
		'typ' => 'JWT',
		'alg' => 'ES256',
		'kid' => $keyID,
	];

$clientSecret = $this->createdJWT($jwtHeader, $payLoad, $privateKey);
}

private function createdJWT($jwtHeader, $payLoad, $privateKey)
{
        $signer = new \Lcobucci\JWT\Signer\Ecdsa\Sha256();
        $key = new \Lcobucci\JWT\Signer\Key($privateKey);
        $builder = new \Lcobucci\JWT\Builder();
        $builder->sign($signer, $privateKey);
        foreach ($jwtHeader as $key => $value)
        {
            $builder->withHeader($key, $value);
        }
        foreach ($payLoad as $key => $value)
        {
            $builder->withClaim($key, $value);
        }
        $jwt_token = $builder->getToken();
        $clientSecret = (string)$jwt_token;
        return $clientSecret;
}
```

##### 2. authorizationCode验证

协议 | https
--- | ---
http请求方式 | POST
Url | https://appleid.apple.com/auth/token

请求参数

参数 | 类型 | 是否必填 | 描述 | 实例值
---|--- | :---: | --- | ---
client_id | String | 是 | 开发者的APP ID | com.Albin.Wong
client_secret | String | 是 | 根据开发者信息基于ES256生成JWT | 
code | String | 否 | 授权用户的授权码 | c4ee187846b194e6992457a5500c58487.0.nuvt.v4ipHMlBhIZELiAtCSjqcw
grant_type | String | 是 | 授权类型 | `authorization_code`(生成令牌) `refresh_token`(更新令牌) 
refresh_token | String | 否 | 生成令牌时返回的`id_token`JWT格式 |
redirect_uri | String | 否 | 回调地址(仅在Web验证中有效) | https://www.albinwong.com/

当对用户进行授权时，使用以下参数:`client_id`、`client_secret`、`grant_type`、`code`和`redirect_uri`;
当刷新令牌时，请使用以下参数:`client_id`、`client_secret`、`grant_type`和`refresh_token`。

响应参数

参数 | 类型 | 是否必填 | 描述 | 实例值
---|--- | :---: | --- | ---
access_token  | String | 是 | 用来访问允许的数据的令牌(目前没用😂) | a4ca7a14e8dcc4feeacef495b1b3afca6.0.muvt.287tdEiu5x8V5tZIq9q_nA
expires_in  | String | 是 | token的生命周期(s) | 3600
id_token  | String | 是 | 用户身份信息JWT | eyJ...
refresh_token  | String | 是 | 重新生成新的访问令牌的刷新令牌 | rddae591ef0be4b539f6e2c33ee4c6d5b.0.muvt.Ub54wfvFT2l-sm7MsaKPKg
token_type  | String | 是 | token类型，一直返回`bearer` | bearer

返回实例`200`
```json
{
	'access_token' : 'a35bec0e9d9d841f58b1ff03f9afd191e.0.muvt.IZuwE2O3MFMbS5RzuOi4dQ',
	'token_type' : 'Bearer',
	'expires_in' : 3600,
	'refresh_token' : 'r89e43dfc960e45cd9a6a532060ff1ff2.0.muvt.Wv1SbEjQHocTmdhM_tslcA',
	'id_token' : 'eyJ...',
}
```
服务端验证实例
```php
public function checkAuthCode($authCode)
{
	$clientSecret = $this->generateClientSecret();
	$grantType = 'authorization_code';
	$redirectUrl = 'http://api.albinwong.com/api/v1/sign_in_with_apple';
	$params = [
		'client_id' => $clientID,
		'client_secret' => $clientSecret,
		'code' => $authCode,
		'grant_type' => $grantType,
		'redirect_uri' => $redirectUrl,
	];
	$verifyRes = new Client(['base_uri' => 'https://appleid.apple.com'])->request('POST', '/auth/token', $params);
	
	// 再次verifyRes解析id_token 
	if (isset($verifyRes['id_token'])) {
		try {
			$pem = $this->createPemFromModulusAndExponent($auth[0]['n'], $auth[0]['e']);
			$verifyRes['res'] = (array)JWT::decode($verifyRes['id_token'], $pem, array('RS256'));
		} catch (Exception $e) {
			$pem = $this->createPemFromModulusAndExponent($auth[1]['n'], $auth[1]['e']);
			$verifyRes['res'] = (array)JWT::decode($verifyRes['id_token'], $pem, array('RS256'));
		}
	}
	return $verifyRes;
}
```

`authorizationCode`验证响应
```json
{
	'access_token' : 'c35bec0ed9d741f58b1qq03f9afd191e.0.muvt.IZuwE3O5MFMbS5RzuOi4dQ',
	'token_type' : 'Bearer',
	'expires_in' : 3600,
	'refresh_token' : 'r89e43dfc960e45cd9a6a532060ff1ff2.0.muvt.Wv1SbEjQHocTmdhM_tslcA',
	'id_token' => 'eyJraWQ..',
}
```

##### 3. token刷新(如需要)

```php
function refreshAccessToken($clientID, $refreshToken)
{
	$refreshTokenParams = [
		'grant_type' => 'refresh_token',
        'client_id'  => $clientID,
        'client_secret' => $clientSecret,
        'refresh_token' => $refreshToken,
	];
	$res = new Client(['base_uri' => 'https://appleid.apple.com'])->request('POST', '/auth/token', $refreshTokenParams);
	return $res;
}
```
Response`200`
```json 
{
	"access_token":"ab763cfbebf0a4a07b7096d8f5d048b69.0.muvt.m4dTSfPRKetURQlxKHrIUQ",
	"token_type":"Bearer",
	"expires_in":3600
}
```

(3) Comments

John Doe- Reply

February 26, 2013 at 1:18 pm
- saqib sarwar- Reply
  
  February 26, 2013 at 1:20 pm
  
  Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Typi non habent claritatem insitam; est usus legentis in iis qui facit eorum claritatem. Investigationes demonstraverunt lectores legere me lius quod ii legunt saepius. Claritas est etiam processus dynamicus, qui sequitur mutationem consuetudium lectorum. Mirum est notare quam littera gothica, quam nunc putamus parum claram, anteposuerit litterarum formas humanitatis per seacula quarta decima et quinta decima. Eodem modo typi, qui nunc nobis videntur parum clari, fiant sollemnes in futurum.
John Doe- Reply

February 26, 2013 at 1:27 pm

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat.

Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum.

Your email address will not be published. Required fields are marked *

Name *

Email *

Website

Comment

You can use these HTML tags and attributes <a href="" title=""> <abbr title=""> <acronym title=""> <blockquote cite=""> <cite> <code> <del datetime=""> <q cite=""> <strike> 

苹果第三方登录Sign in with Apple服务端验证

(3) Comments

John Doe- Reply

saqib sarwar- Reply

John Doe- Reply

Leave a Reply