It’s been a bit of a challenge but I’ve made somewhat some progress. I do need some expert help however, perhaps somebody has already tackled this issue!
So far I can authorise users with their biometrics and retrieve an authorisation grant code from Apple’s servers. However I’ve been stuck at trying to validate this grant code.
In my request authorisation URL I have included:
- name+email as scope,
- nonce and state which which are both SHA256 strings.
- reverse domain service id as client_id
- response type: code%20id_token with form_post as a response mode
- redirect_uri=https://projectName.firebaseapp.com/__/auth/handler
I generated the necessary Auth key and key ID then used it to sign a JWT secret key with elliptic curve digital signature Algorithm, P-256 curve and the SHA-256 hash algorithm(documentation). However when I try validate the grant code, I keep catching an “Invalid_client” error even though the same client_id successfully returned that grant code. So far I’m handling this step as an HTTPS request but I think the validation URL can also be handled via curl?
Upon successful validation, according to apple’s documentation, I would then retrieve an id_Token as well as a refresh token. I would then use the id_token to sign the user up through Firebase OAuth REST API.
I guess I could also be a bit more efficient but I’m also learning as I go, I’m not sure if its possible to skip REST Api implementing and use Firebase’s SDK with some JavaScript code to handle the authorisation process according to this documentation but I’m not sure how much of the SDK is available to us
Hoping to get any insight 🙂