mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add backend support for Apple auth provider

Browse Source 
It's a bit different from other OAuth providers and requires a
different set of options and a private key file.
This commit is contained in:
Dmitry Verkhoturov
2023-01-03 23:47:42 -06:00
committed by Umputun
parent d7e9be99f9
commit c1b3fba344
10 changed files with 77 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/src/docs/configuration/authorization/index.md
+19 -2
View File
@@ -1,4 +1,4 @@
---
**---
title: Authorization
---
@@ -6,6 +6,23 @@ title: Authorization
Authentication handled by external providers. You should set up OAuth2 for at least one of them to allow users to make comments. It is not mandatory to have all of them, but one should be correctly configured.
### Apple (not implemented yet)
1. Log in [to the developer account](https://developer.apple.com/account).
1. If you don't have an App ID yet, [create one](https://developer.apple.com/account/resources/identifiers/add/bundleId). Later on, you'll need **TeamID**, which is an "App ID Prefix" value.
1. Enable the "Sign in with Apple" capability for your App ID in [the Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list) section.
1. Create [Service ID](https://developer.apple.com/account/resources/identifiers/list/serviceId) and bind with App ID from the previous step. Apple will display the description field value to end-users on sign-in. You'll need that service **Identifier as a ClientID** later on.
1. Configure "Sign in with Apple" for created Service ID. Add domain where you will use that auth on to "Domains and subdomains" and its main page URL (like `https://example.com/` to "Return URLs".
1. Register a [New Key](https://developer.apple.com/account/resources/authkeys/list) (**private key**) for the "Sign in with Apple" feature and download it, you'll need to put it to `/var/apple.p8` path inside container. Also write down the private **Key ID**.
1. Add your Remark42 domain name and sender email in the Certificates, Identifiers & Profiles >> [More](https://developer.apple.com/account/resources/services/configure) section as a new Email Source.
After completing the previous steps, you can proceed with configuring the Apple auth provider. You'll need to set the following environment variables:
- `AUTH_APPLE_CID` (**required**) - Client ID
- `AUTH_APPLE_TID` (**required**) - Team ID
- `AUTH_APPLE_KID` (**required**) - Private Key ID
- `AUTH_APPLE_PRIVATE_KEY_FILEPATH` (default `/var/apple.p8`) - Private key file location
### Facebook
1. Open the list of apps on the [Facebook Developers Platform](https://developers.facebook.com/apps)
@@ -93,4 +110,4 @@ For more details refer to [Yandex OAuth](https://yandex.com/dev/oauth/doc/dg/con
Optionally, anonymous access can be turned on. In this case, an extra `anonymous` provider will allow logins without any social login with any name satisfying two conditions:
- the name should be at least three characters long
- the name has to start from the letter and contains letters, numbers, underscores and spaces only
- the name has to start from the letter and contains letters, numbers, underscores and spaces only**
site/src/docs/configuration/parameters/index.md
+4
View File
@@ -80,6 +80,10 @@ services:
| auth.ttl.cookie | AUTH_TTL_COOKIE | `200h` | cookie TTL |
| auth.send-jwt-header | AUTH_SEND_JWT_HEADER | `false` | send JWT as a header instead of a cookie |
| auth.same-site | AUTH_SAME_SITE | `default` | set same site policy for cookies (`default`, `none`, `lax` or `strict`) |
| auth.apple.cid | AUTH_APPLE_CID | | Apple client ID |
| auth.apple.tid | AUTH_APPLE_TID | | Apple service ID |
| auth.apple.kid | AUTH_APPLE_KID | | Private key ID |
| auth.apple.private-key-filepath | AUTH_APPLE_PRIVATE_KEY_FILEPATH | `/var/apple.p8` | Private key file location |
| auth.google.cid | AUTH_GOOGLE_CID | | Google OAuth client ID |
| auth.google.csec | AUTH_GOOGLE_CSEC | | Google OAuth client secret |
| auth.facebook.cid | AUTH_FACEBOOK_CID | | Facebook OAuth client ID |