Sign in with Apple

Enable privacy-focused WiFi authentication on your captive portal using Sign in with Apple, supporting email relay and built-in two-factor authentication for iOS, macOS, and web users.

Overview

Sign in with Apple provides:

• Privacy-focused authentication for Apple users
• Email relay option for privacy
• Cross-platform support (iOS, macOS, web)
• Two-factor authentication built-in

Prerequisites

• IronWifi account with captive portal
• Apple Developer account ($99/year)
• App ID with Sign in with Apple capability

Why Sign in with Apple?

Benefits

• Required by Apple for apps with social login on iOS
• High trust among Apple users
• Real email or relay - user choice
• Built-in 2FA security
• No tracking by Apple

User Privacy

Users can choose:

• Share real email address
• Use Apple's private relay email
• Hide My Email generates unique address

Apple Developer Setup

Step 1: Create App ID

1. Go to developer.apple.com
2. Navigate to Certificates, Identifiers & Profiles
3. Go to Identifiers > App IDs
4. Click + to create new App ID
5. Select App type
6. Configure:
   • Description: WiFi Portal
   • Bundle ID: com.yourcompany.wifiportal
7. Enable Sign in with Apple capability
8. Click Continue and Register

Step 2: Create Service ID

For web authentication:

1. Go to Identifiers > Service IDs
2. Click + to create new Service ID
3. Configure:
   • Description: WiFi Portal Web
   • Identifier: com.yourcompany.wifiportal.web
4. Enable Sign in with Apple
5. Click Configure
6. Add:
   • Primary App ID: Select your App ID
   • Domains: auth.ironwifi.com
   • Return URLs: https://auth.ironwifi.com/callback/apple
7. Save and register

Step 3: Create Key

1. Go to Keys
2. Click + to create new key
3. Name: "WiFi Portal Sign in with Apple"
4. Enable Sign in with Apple
5. Configure and link to your App ID
6. Register and download the key file (.p8)
7. Note the Key ID

Step 4: Get Team ID

1. In developer account, click account name
2. Note your Team ID (10 characters)

IronWifi Configuration

Step 1: Add Apple Provider

1. Log in to IronWifi Console
2. Navigate to Networks > Captive Portals
3. Select your captive portal
4. Go to Authentication Providers
5. Click Add Provider > Sign in with Apple

Step 2: Configure Credentials

Enter Apple credentials:

• Service ID: Your Service ID identifier
• Team ID: Your Apple Developer Team ID
• Key ID: Your Sign in with Apple key ID
• Private Key: Contents of the .p8 file
• Redirect URI: https://auth.ironwifi.com/callback/apple

Step 3: Configure Options

Settings:

• Request Email: Ask for email address
• Request Name: Ask for name (first login only)

Data Collection

Available Data

Sign in with Apple provides:

Field	Description
sub	Unique user identifier
email	Real or relay email
email_verified	Email verification status
is_private_email	Whether using relay
name	First and last name (first auth only)

Important Notes

• Name only provided once: On first authorization
• Store the name: Won't be provided again
• Email may be relay: Handle @privaterelay.appleid.com

Handling Private Relay Email

What is Private Relay?

Apple's Hide My Email creates unique addresses:

abc123def@privaterelay.appleid.com

Sending to Relay Addresses

To send emails to relay addresses:

1. Register your domain with Apple
2. Add sending domain in Apple Developer
3. Configure SPF/DKIM for your domain

Registration

1. In Apple Developer, go to Services
2. Find Sign in with Apple for Email Communication
3. Register your domains and email addresses
4. Configure DNS records as specified

Authentication Flow

User Experience

1. Guest connects to WiFi
2. Captive portal shows "Sign in with Apple" button
3. Guest clicks, Apple login appears
4. Authenticates with Apple ID (Face ID/Touch ID/password)
5. Chooses to share or hide email
6. Redirected back, access granted

Web vs Native

Web (Captive Portal):

• JavaScript SDK or redirect
• Works on any device with browser

Native iOS:

• AuthenticationServices framework
• Best experience on Apple devices

Splash Page Integration

Add Apple Button

<div class="social-login">
  <a href="{{apple_auth_url}}" class="btn-apple">
    <svg class="apple-logo"><!-- Apple logo --></svg>
    Sign in with Apple
  </a>
</div>

<style>
.btn-apple {
  background: #000000;
  color: white;
  padding: 12px 24px;
  border-radius: 4px;
  font-family: -apple-system, BlinkMacSystemFont, sans-serif;
}
</style>

Apple Button Guidelines

Follow Apple's Human Interface Guidelines:

• Use official button styles
• Don't modify the Apple logo
• Maintain button proportions
• See Apple Design Resources

Token Handling

ID Token

Apple returns a JWT ID token:

{
  "iss": "https://appleid.apple.com",
  "sub": "001234.abc123...",
  "aud": "com.yourcompany.wifiportal.web",
  "exp": 1234567890,
  "email": "user@example.com",
  "email_verified": true,
  "is_private_email": false
}

Token Validation

IronWifi validates:

• Token signature (using Apple's public keys)
• Issuer (appleid.apple.com)
• Audience (your Service ID)
• Expiration

Troubleshooting

Authorization Failed

Invalid Client:

• Verify Service ID matches
• Check Team ID
• Confirm key is correct

Invalid Redirect URI:

• URL must match exactly
• Check domain is registered
• Verify HTTPS

No Email Received

1. User may have declined email sharing
2. Store email from first authorization
3. Email only provided on initial auth

Private Relay Issues

1. Register domain with Apple
2. Configure email authentication (SPF/DKIM)
3. Verify sending domain approved

Security

Key Security

• Keep .p8 private key secure
• Don't commit to version control
• Rotate keys periodically
• Limit key access

Token Security

• Validate all tokens server-side
• Don't trust client-provided data
• Check token expiration
• Verify audience claim

Best Practices

1. Store user data from first auth
2. Handle relay emails properly
3. Follow Apple guidelines for buttons
4. Secure key storage
5. Graceful fallbacks for errors
6. Test on Apple devices

Related Topics

• Google Integration
• Authentication Providers
• Captive Portals