This post has been republished via RSS; it originally appeared at: Azure Active Directory Identity Blog articles.
Greetings! We are going to start highlighting Azure AD B2C more in the mailbag series since there has been a lot of interest. Since Apple recently announced a new app sign-in button called ‘Sign In With Apple’, we’ve received questions whether it works with Azure AD B2C. Since B2C leverages open standards, the answer is Yes! Adam Stoffel is going to answer the most common questions we’ve heard so far around Sign In With Apple.
-Sue Bohn
---
Hi, I’m Adam Stoffel from the Identity Customer Experience team. I spend my time working with customers who are using or plan to use Azure AD B2C – our customer identity and access management solution. Recently, we received some questions about Apple’s announcement for their new single sign-on service. In this edition of Mailbag, we’ll look at what the ‘Sign in with Apple‘ service is and how you can get ready for its public debut later this year.
Q1: What is Sign in with Apple?
Sign in with Apple is a single sign-on service which allows users to use their Apple ID to sign into website and mobile applications. You can think of this the same way Facebook Sign-in works in many apps you might already use.
Users will also have the option to mask their email address when they sign into an application. Apple will maintain a mapping of these masked email addresses back to the actual user profile and relay email messages on the user’s behalf. Users will also need to setup multi-factor authentication to use Sign in with Apple – a feature of Apple ID that, today, requires a user to have an iOS or Mac device.
Q2: Do I need to care about Sign in with Apple?
Using Sign in with Apple will be soon be required for all apps in the Apple App Store which support third-party sign-in. This is indicated at the very bottom of Apple’s recent update to its App Store review guidelines. This requirement will be enforced once the service is out of beta and commercially available.
This new policy means that if you implement any third-party or social login (like Facebook, LinkedIn, or Twitter) in your iOS or Mac apps, those apps will also need to include Sign in with Apple as an option. By using Azure AD B2C to enable social login in your applications, you can be ready for this requirement when it becomes mandatory later this year.
Q3: What protocol does Sign in with Apple use?
Although the service is in beta, Apple has published some documentation on how to integrate Sign in with Apple into mobile and web applications. This documentation reveals that the service implements endpoints that are similar to OAuth2 or OpenID Connect. Our investigations have experimentally revealed that it is possible to build a basic OIDC flow atop the current Sign in with Apple API surface.
Q4: How can I get ready for Sign in with Apple?
Azure AD B2C can help you enable this service in your applications. Since Sign in with Apple implements the basics of OpenID Connect, that’s enough to configure it as an OpenID Connect identity provider in Azure AD B2C.
To configure Azure AD B2C to use Sign in with Apple, you’ll need to have an Apple Developer account, setup your application in the Apple Developer portal, and collect some configuration values. Because Apple’s implementation of the authentication protocol is somewhat incomplete, there are some steps which deviate from a typical OpenID Connect identity provider configuration process.
For more information on how to obtain the appropriate OpenID Connect configuration values from the Apple Developer portal and for instructions on how to integrate Azure AD B2C with Sign in with Apple, check out the guide on GitHub.
For any questions, you can reach us at AskAzureADBlog@microsoft.com, Tech Communities or on Twitter @AzureAD, @MarkMorow and @Alex_A_Simons. You can also ask questions in the comments of this post. Check out our previous mailbag posts!