C# Sign In With Apple苹果登陆后端验证

苹果App授权登录

苹果官方的授权文档：

生成Token：https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
JWT：https://developer.apple.com/documentation/sign_in_with_apple/fetch_apple_s_public_key_for_verifying_token_signature

苹果的授权登录

APP内苹果授权登陆会提供如下几个参数：userID、email、fullName、authorizationCode、identityToken
userID：授权的用户唯一标识
email、fullName：授权的用户资料
authorizationCode：授权code
identityToken：授权用户的JWT凭证

针对后端验证苹果提供了两种验证方式，一种是基于JWT的算法验证，另外一种是基于授权码的验证

JWT验证

identityToken参考：

// jwt 格式
eyJraWQiOiJBSURPUEsxIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnNreW1pbmcuZGV2aWNlbW9uaXRvciIsImV4cCI6MTU2NTY2ODA4NiwiaWF0IjoxNTY1NjY3NDg2LCJzdWIiOiIwMDEyNDcuOTNiM2E3OTlhN2M4NGMwY2I0NmNkMDhmMTAwNzk3ZjIuMDcwNCIsImNfaGFzaCI6Ik9oMmFtOWVNTldWWTNkcTVKbUNsYmciLCJhdXRoX3RpbWUiOjE1NjU2Njc0ODZ9.e-pdwK4iKWErr_Gcpkzo8JNi_MWh7OMnA15FvyOXQxTx0GsXzFT3qE3DmXqAar96nx3EqsHI1Qgquqt2ogyj-lLijK_46ifckdqPjncTEGzVWkNTX8uhY7M867B6aUnmR7u-cf2HsmhXrvgsJLGp2TzCI3oTp-kskBOeCPMyTxzNURuYe8zabBlUy6FDNIPeZwZXZqU0Fr3riv2k1NkGx5MqFdUq3z5mNfmWbIAuU64Z3yKhaqwGd2tey1Xxs4hHa786OeYFF3n7G5h-4kQ4lf163G6I5BU0etCRSYVKqjq-OL-8z8dHNqvTJtAYanB3OHNWCHevJFHJ2nWOTT3sbw
 
// header 解码
{"kid":"AIDOPK1","alg":"RS256"} 其中kid对应上文说的密钥id
 
// claims 解码
{
"iss":"https://appleid.apple.com",
"aud":"com.skyming.devicemonitor",
"exp":1565668086,"iat":1565667486,
"sub":"001247.93b3a799a7c84c0cb46cd08f100797f2.0704",
"c_hash":"Oh2am9eMNWVY3dq5JmClbg",
"auth_time":1565667486
}
 
ss标识是苹果签发的，aud是接收者的APP ID，sub就是用户的唯一标识

解析的sub和前端传过来的比较是否一致；

基于授权码的后端验证

创建Secret

private string CreateSecret()
        {

            var handler = new JwtSecurityTokenHandler();
            var subject = new Claim("sub", Client_Id);//找IOS要 
            var tokenDescriptor = new SecurityTokenDescriptor()
            {
                Audience = "https://appleid.apple.com",//固定值
                Issuer = Team_Id,//team ID,找IOS要                                 
                IssuedAt = DateTime.Now.AddDays(-1),
                NotBefore = DateTime.Now.AddDays(-1),
                Subject = new ClaimsIdentity(new[] { subject }),
            };

            var algorithm = new ECDsaCng(GetPrivateKey());
            {
                tokenDescriptor.SigningCredentials = CreateSigningCredentials(Key_Id, algorithm);//p8私钥文件得Key，找IOS要
                var clientSecret = handler.CreateEncodedJwt(tokenDescriptor);
                return clientSecret;
            }

        }

        /// <summary>
        /// 获取P8
        /// </summary>
        /// <returns></returns>
        private CngKey GetPrivateKey()
        {
            using (var reader = new StringReader("p8文件内容"))
            {
                var ecPrivateKeyParameters = (ECPrivateKeyParameters)new PemReader(reader).ReadObject();
                var x = ecPrivateKeyParameters.Parameters.G.AffineXCoord.GetEncoded();
                var y = ecPrivateKeyParameters.Parameters.G.AffineYCoord.GetEncoded();
                var d = ecPrivateKeyParameters.D.ToByteArrayUnsigned();
                return EccKey.New(x, y, d);
            }
        }

参考文献：https://stackoverflow.com/questions/42514289/how-to-use-apns-auth-key-p8-file-in-c

网上还有另外一种P8文件的内容

     private static ECDsa GetPrivateKey()
        {
            CngKey privateKey = null;

            //p8文件内容
            string content = @"-----BEGIN PRIVATE KEY-----
                              ****
                              -----END PRIVATE KEY-----";

            // 这里直接用去头去尾的方法：
            var lines = content.Split('
');
            var trimmed = string.Join("", lines.Skip(1).Take(lines.Length - 2).Select(l => l.Trim()));
            var keyBlob = Convert.FromBase64String(trimmed);

            _Log.Info("test1");

            privateKey = CngKey.Import(keyBlob, CngKeyBlobFormat.Pkcs8PrivateBlob, CngProvider.MicrosoftSoftwareKeyStorageProvider);

            _Log.Info("test2");


            return new ECDsaCng(privateKey);
        }

这是一个坑深坑：

本地调试没问题，发布到服务器上就报错：System.Security.Cryptography.CryptographicException: 系统找不到指定的文件。

度娘个的解决方案就是：在服务器上的IIS修改一些配置。（ex:服务能随便改配置吗？万一把其他接口搞挂了呢）；

根据生成的Secret和授权码AuthorizationCode来验证是否正确

var newToken = CreateSecret();
                var datas = new Dictionary<string, string>()
                {
                    { "client_id", Client_Id },
                    { "grant_type", "authorization_code"},//固定authorization_code
                    { "code", authLoginModel.AuthorizationCode },//授权码，前端验证登录给予 
                    { "client_secret", newToken } //client_secret，后面方法生成
                };

                var formdata = new FormUrlEncodedContent(datas);
                using (var httpclient = new HttpClient())
                {
                    httpclient.Timeout = TimeSpan.FromSeconds(30);
                    var result = await httpclient.PostAsync(Apple_Token_Url, formdata);
                    var re = await result.Content.ReadAsStringAsync();
                    if (result.IsSuccessStatusCode)
                    {
                        var deserializeObject = JsonConvert.DeserializeObject<AppleTokenResult>(re);
                        var jwtPlayload = DecodeJwtPlayload(deserializeObject.IdToken);
                        if (jwtPlayload.Aud.Equals(Client_Id) && !string.IsNullOrEmpty(jwtPlayload.Sub))
                        {
                            appleUserId = jwtPlayload.Sub;
                        }
                    }
                    else
                    {
                        return OperationResult.FromError<AuthLoginBindResponse>($"{(int)BizCodeEnum.SING_FAIL}", re);
                    }
                }

验证成功后会返回

{
"access_token":"a0996b16cfb674c0eb0d29194c880455b.0.nsww.5fi5MVC-i3AVNhddrNg7Qw",
"token_type":"Bearer",
"expires_in":3600,
"refresh_token":"r9ee922f1c8b048208037f78cd7dfc91a.0.nsww.KlV2TeFlTr7YDdZ0KtvEQQ",
"id_token":"eyJraWQiOiJBSURPUEsxIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnNreW1pbmcuYXBwbGVsb2dpbmRlbW8iLCJleHAiOjE1NjU2NjU1OTQsImlhdCI6MTU2NTY2NDk5NCwic3ViIjoiMDAwMjY2LmRiZTg2NWIwYWE3MjRlMWM4ODM5MDIwOWI5YzdkNjk1LjAyNTYiLCJhdF9oYXNoIjoiR0ZmODhlX1ptc0pqQ2VkZzJXem85ZyIsImF1dGhfdGltZSI6MTU2NTY2NDk2M30.J6XFWmbr0a1hkJszAKM2wevJF57yZt-MoyZNI9QF76dHfJvAmFO9_RP9-tz4pN4ua3BuSJpUbwzT2xFD_rBjsNWkU-ZhuSAONdAnCtK2Vbc2AYEH9n7lB2PnOE1mX5HwY-dI9dqS9AdU4S_CjzTGnvFqC9H5pt6LVoCF4N9dFfQnh2w7jQrjTic_JvbgJT5m7vLzRx-eRnlxQIifEsHDbudzi3yg7XC9OL9QBiTyHdCQvRdsyRLrewJT6QZmi6kEWrV9E21WPC6qJMsaIfGik44UgPOnNnjdxKPzxUAa-Lo1HAzvHcAX5i047T01ltqvHbtsJEZxAB6okmwco78JQA"
}

其中id_token就是JWT文件，然后对JWT文件进行解析

    /// <summary>
        /// 解析jwt第二部分
        /// </summary>
        /// <param name="jwtString"></param>
        /// <returns></returns>
        private JwtPlayloadModel JwtPlayload(string jwtString)
        {
            try
            {
                var code = jwtString.Split('.')[1];
                code = code.Replace('-', '+').Replace('_', '/').PadRight(4 * ((code.Length + 3) / 4), '=');
                var bytes = Convert.FromBase64String(code);
                var decode = Encoding.UTF8.GetString(bytes);
                return JsonConvert.DeserializeObject<JwtPlayloadModel>(decode);
            }
            catch (Exception e)
            {
                throw new Exception(e.Message);
            }
        }