How to link Apple provider using native auth?

[omBratteng]

I'm trying to use native auth while linking Apple to an existing identity, but it always wants to redirect in the browser. For login/registration, I have followed the steps as outlined here, and I pass id_token and id_token_nonce to Kratos.

Does the self-service linking work with Apple native auth? Does it accept the id_token at all?

[vinckr]

Hey @omBratteng
I am not sure if the native auth flow is fully supported for account linking yet; @jonas-jonas do you know maybe?

[jonas-jonas]

but it always wants to redirect in the browser

Could you share what steps you're doing here? And what are the conditions? E.g. does the account have a password and you're trying to link apple?

[omBratteng]

Yeah, the user have a password.

1. Call /self-service/settings/browser
2. POST to https://sso.daily.dev/self-service/settings?flow=16bd100c-04be-4971-b7fc-6a793209c7ac with payload

{
  "link": "apple",
  "csrf_token": "some csrf token",
  "id_token": "some id token",
  "id_token_nonce": "some nonce"
}

3. Get response

{
    "error": {
        "id": "browser_location_change_required",
        "code": 422,
        "status": "Unprocessable Entity",
        "reason": "In order to complete this flow please redirect the browser to: https://appleid.apple.com/auth/authorize?claims=%7B%22id_token%22%3A%7B%22email%22%3A%7B%22essential%22%3Atrue%7D%2C%22email_verified%22%3A%7B%22essential%22%3Atrue%7D%2C%22name%22%3A%7B%22essential%22%3Atrue%7D%7D%7D\u0026client_id=dev.daily\u0026redirect_uri=https%3A%2F%2Fsso.daily.dev%2Fself-service%2Fmethods%2Foidc%2Fcallback%2Fapple\u0026response_mode=form_post\u0026response_type=code\u0026scope=email+name+openid\u0026state=MTZiZDEwMGMtMDRiZS00OTcxLWI3ZmMtNmE3OTMyMDljN2FjOkeYzlV4ZEHOt-N-BFxP4Ic",
        "message": "browser location change required"
    },
    "redirect_browser_to": "https://appleid.apple.com/auth/authorize?claims=%7B%22id_token%22%3A%7B%22email%22%3A%7B%22essential%22%3Atrue%7D%2C%22email_verified%22%3A%7B%22essential%22%3Atrue%7D%2C%22name%22%3A%7B%22essential%22%3Atrue%7D%7D%7D\u0026client_id=dev.daily\u0026redirect_uri=https%3A%2F%2Fsso.daily.dev%2Fself-service%2Fmethods%2Foidc%2Fcallback%2Fapple\u0026response_mode=form_post\u0026response_type=code\u0026scope=email+name+openid\u0026state=MTZiZDEwMGMtMDRiZS00OTcxLWI3ZmMtNmE3OTMyMDljN2FjOkeYzlV4ZEHOt-N-BFxP4Ic"
}

[omBratteng]

Sign up with Apple native auth works fine. But I think the linking part just lacks the part to accept id_token and do its thing with it. At least from what I could gather from the source code.

[jonas-jonas]

Ah, so this is about the settings flow?

I don't think the native auth path is implemented there, yet. See also #3344

[omBratteng]

Ah, so this is about the settings flow?

That could be 🙈

I don't think the native auth path is implemented there, yet.

That's what I found too, just wasn't too sure and had to check.