苹果apple账号授权登录第三方APP
Apple官方文档
前言:由于公司最近有个业务需求是要进行Apple账号授权登录,于是我看边看文档边借鉴其他人的写法,发现好多文章都有一个共性,一个是在解析JWT的时候自己设置参数后进行判断,这样做没什么意义,另外一个就是大多数人直接取苹果公钥的第二个值进行验证,这样写法是错的,正常做法是将jwt的hender进行解开,得到kid,然后根据kid对苹果公钥进行匹配得到正确的keys。下面分享我自己的写法。
一:获取苹果公钥
https://appleid.apple.com/auth/keys
公钥建议去请求得到最新的,因为公钥会经常换,当公钥不是最新时,在解析时会因为匹配不上而导致登录不成功，具体实现看文章下面的getAuthKeys方法。
二:验证JWT
引入JWT所需Maven包
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.8.3</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>jwks-rsa</artifactId>
<version>0.12.0</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.0</version>
</dependency>
@Autowired
protected RestTemplate restTemplate;
/**
* identityToken授权判断
* 这里代码只展示验证整个过程,具体其他业务得结合自己的公司去实现
*/
public Response<AppleUserDetailsVo > appleLoginVerify(String fullName,String identityToken) throws Exception {
log.info("登录接受参数----->fullName:" + fullName);//这里要求传fullName是因为苹果在第一次登陆的时候才会返回fullName,而且在验证通过后还获取不到fullName,邮箱的话在验证通过后可以获取到,所以不需要App传邮箱
if (!verify(identityToken)) {//验证identityToken
return Response.failure(100001, "Apple identity token expired.");
}
//identityToken验证通过之后进行解码,再结合自己所需的参数返回给App,
AppleUserDetailsVo appleUserDetailsVo = parserIdentityToken(identityToken);
if (null != appleUserDetailsVo) {
appleUserDetailsVo.setFullName(fullName);
appleUserDetailsVo.setFullEmail(appleUserDetailsVo.getEmail());
appleUserDetailsVo.setGender(0);
appleUserDetailsVo.setIdentityType(1);
appleUserDetailsVo.setSource(2);
appleUserDetailsVo.setPicture(Const.PICTURE);
} else {
return Response.failure(200001, "Apple identity token decoding failed.");
}
log.info("AppleUserDetailsVo值" + appleUserDetailsVo);
return Response.data(appleUserDetailsVo);
}
/**
* 对前端传来的JWT字符串identityToken的Payload(第二段)进行解码
* 主要获取其中的aud和sub，aud大概对应ios前端的包名，sub大概对应当前用户的授权的openID
*/
private AppleUserDetailsVo parserIdentityToken(String identityToken) throws IOException {
String[] arr = identityToken.split("\\.");
String decode = new String(Base64.decodeBase64(arr[1]));
log.info("苹果登录后获取到的值:" + decode);
ObjectMapper objectMapper = new ObjectMapper();
objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
return objectMapper.readValue(decode, AppleUserDetailsVo.class);
}
private Boolean verify(String jwt) throws Exception {
List<ApplePublicKeyVo> arr = getAuthKeys();
if (arr == null) {
return false;
}
try {
//先取jwt中的header来匹配苹果公钥的kid
String header = new String(Base64.decodeBase64(jwt.split("\\.")[0]));
ObjectMapper objectMapper = new ObjectMapper();
ApplePublicKeyVo applePublicKeyVo = objectMapper.readValue(header, ApplePublicKeyVo.class);
Optional<ApplePublicKeyVo> target;
target = arr.stream().filter(apple -> apple.equals(applePublicKeyVo)).findFirst();
return verifyExc(jwt, target.get());
} catch (Exception e) {
return false;
}
/**
* 对前端传来的identityToken进行验证
*
* @param jwt 对应前端传来的 identityToken
* @param authKey 苹果的公钥 authKey
*/
private static Boolean verifyExc(String jwt, ApplePublicKeyVo authKey) throws InvalidPublicKeyException {
try {
PublicKey publicKey;
if (!"RSA".equalsIgnoreCase(authKey.getKty())) {
throw new InvalidPublicKeyException("The key is not of type RSA", (Throwable) null);
} else {
KeyFactory kf = KeyFactory.getInstance("RSA");
BigInteger modulus = new BigInteger(1, Base64.decodeBase64(authKey.getN()));
BigInteger exponent = new BigInteger(1, Base64.decodeBase64(authKey.getE()));
publicKey = kf.generatePublic(new RSAPublicKeySpec(modulus, exponent));
}
Claims parse = Jwts.parser().setSigningKey(publicKey).parseClaimsJws(jwt).getBody();
String iss = parse.getIssuer();//苹果官方链接
String audience = parse.getAudience();//app设置的包名
int expiration = (int) (parse.getExpiration().getTime() / 1000);//过期时间
Integer authTime = (Integer) parse.get("auth_time");//签发时间
if (iss.contains(Const.ISS) && audience.equals(Const.AUD) && authTime < expiration) {//按照苹果官方来做,iss要存在https://appleid.apple.com，audience要与App设置的一致,签发时间要小于过期时间
return true;
} else {
return false;
}
} catch (InvalidKeySpecException var4) {
throw new InvalidPublicKeyException("Invalid public key", var4);
} catch (NoSuchAlgorithmException var5) {
throw new InvalidPublicKeyException("Invalid algorithm to generate key", var5);
} catch (ExpiredJwtException e) {
log.error("[AppleServiceImpl.verifyExc] [error] [apple identityToken expired]", e);
return false;
} catch (Exception e) {
log.error("[AppleServiceImpl.verifyExc] [error] [apple identityToken illegal]", e);
return false;
}
}
/**
* 获取苹果的公钥
*/
private static List<ApplePublicKeyVo> getAuthKeys() throws IOException {
String url = "https://appleid.apple.com/auth/keys";//获取苹果公钥
JSONObject json;
try {
json = restTemplate.getForObject(url, JSONObject.class);
log.info("苹果公钥" + json);
} catch (Exception e) {
log.info("AppleLogin获取公钥发生错误，先用本地的公钥" + e);
json = JSONObject.fromObject(Const.APPLE_KEYS);
}
if (json != null && json.optJSONArray("keys") != null) {
ObjectMapper objectMapper = new ObjectMapper();
return objectMapper.readValue(json.getJSONArray("keys").toString(), new TypeReference<List<ApplePublicKeyVo>>() {
});
}
return null;
}
@Data
@EqualsAndHashCode(callSuper = false)
@Accessors(chain = true)
@ApiModel(value = "授权登录后返回的对象")
public class AppleUserDetailsVo implements Serializable {
private static final long serialVersionUID = 1L;
@ApiModelProperty(value = "签发者")
private String iss;
@ApiModelProperty(value = "目标受众")
private String aud;
@ApiModelProperty(value = "过期时间")
private Integer exp;
@ApiModelProperty(value = "签发时间")
private Integer iat;
@ApiModelProperty(value = "苹果userId")
private String sub;
@ApiModelProperty(value = "哈希数列")
private String c_hash;
@ApiModelProperty(value = "邮箱")
private String email;
@ApiModelProperty(value = "邮箱验证")
private String email_verified;
@ApiModelProperty(value = "是否是私有邮箱")
private String is_private_email;
@ApiModelProperty(value = "验证时间")
private Integer auth_time;
private boolean nonce_supported;
private Integer real_user_status;
@ApiModelProperty(value = "自定义参数:第三方拿到的名称")
private String fullName;
@ApiModelProperty(value = "自定义参数:第三方拿到的邮箱")
private String fullEmail;
@ApiModelProperty(value = "自定义参数:第三方拿到的性别")
private Integer gender;
@ApiModelProperty(value = "自定义参数:头像")
private String picture;
@ApiModelProperty(value = "自定义参数:身份类型(0邮箱 1是苹果 2是Google 3是 Facebook 4是Twitter)")
private Integer identityType;
@ApiModelProperty(value = "自定义参数:注册来源 1是安卓 2是IOS")
private Integer source;
@ApiModelProperty(value = "自定义参数:app标识")
private Integer ascription;
}
@Accessors(chain = true)
@ApiModel(value = "苹果公钥")
public class ApplePublicKeyVo implements Serializable {
private static final long serialVersionUID = 1L;
private String kty;
private String kid;
private String use;
private String alg;
private String n;
private String e;
public static long getSerialVersionUID() {
return serialVersionUID;
}
public String getKty() {
return kty;
}
public void setKty(String kty) {
this.kty = kty;
}
public String getKid() {
return kid;
}
public void setKid(String kid) {
this.kid = kid;
}
public String getUse() {
return use;
}
public void setUse(String use) {
this.use = use;
}
public String getAlg() {
return alg;
}
public void setAlg(String alg) {
this.alg = alg;
}
public String getN() {
return n;
}
public void setN(String n) {
this.n = n;
}
public String getE() {
return e;
}
public void setE(String e) {
this.e = e;
}
@Override
public boolean equals(Object o) {
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
ApplePublicKeyVo that = (ApplePublicKeyVo) o;
return Objects.equals(kid, that.kid) &&
Objects.equals(alg, that.alg);
}
@Override
public int hashCode() {
return Objects.hash(kty, kid, use, alg, n, e);
}
}
以上就是Apple登陆实现的整个流程。