Creating jwt after signing with apple in php

Question

I've a question about signing with apple more precisely how to create the jw token in php after logging, here is what I do:

$pem_content = 
"-----BEGIN PRIVATE KEY-----".
"XXXX".
"-----END PRIVATE KEY-----";
$header = json_encode(array(
  'kid' => $keyId,
  'alg'  => 'ES256'
));
$decodedTokenData =  json_decode(base64_decode(str_replace('_', '/', str_replace('-','+',explode('.', $_POST['id_token'])[1]))),true);

$payload = json_encode(array(
    'iss' => $teamid,
    'iat' => time(),
    'exp' => time() + 86400*180,
     'aud' => $decodedTokenData['aud'],
    'sub' => $decodedTokenData['sub'],
));
$base64UrlHeader = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($header));
$base64UrlPayload = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($payload));
$key = //I don't know how to use $pem_content here
$signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $key, true);
$base64UrlSignature = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($signature));
$jwt = $base64UrlHeader . "." . $base64UrlPayload . "." . $base64UrlSignature;

And to test transaction I do

curl -X POST https://appleid.apple.com/auth/token -d  '{"client_id":$CLIENTID,"client_secret":$jwt,"code": $_POST['code'],"grant_type":"authorization_code","redirect_uri":$URL}'

But I get

{"error":"invalid_client"}

Two constraints here: I must use only php and avoid external libs

Thanks in advance

EDIT I generate jwt like this:

$signature = '';
openssl_sign($base64UrlHeader . "." . $base64UrlPayload, $signature,openssl_get_privatekey($pem_content),'SHA256');
$signature = $this->signatureFromDER($signature, 256);

the functions used are from here https://github.com/firebase/php-jwt/blob/d2113d9b2e0e349796e72d2a63cf9319100382d2/src/JWT.php#L172

and now curl command is

curl -X POST "https://appleid.apple.com/auth/token" -H 'content-type: application/x-www-form-urlencoded' -d"client_id=CLIENT_ID&client_secret=CLIENT_SECRET&code=CODE&grant_type=authorization_code&redireect_uri=https%3A%2F%2Fsite.com%2Findex.php"

But I still get invalid_client

EDIT2: I've nom implemented this solution: Apple Sign In "invalid_client", signing JWT for authentication using PHP and openSSL

But I keep having invalid_client error

EDIT3 even with https://github.com/firebase/php-jwt I get the error

user_16353848 · Answer

So the problem was the the sub value

Here is the code for generating jwt:

function generateJWT() {
        $kid =  "...";
        $iss = '...';
        $sub = '...';
        $header = [
            'alg' => 'ES256',
            'kid' => $kid
        ];
        $body = [
            'iss' => $iss,
            'iat' => time(),
            'exp' => time() + 3600,
            'aud' => 'https://appleid.apple.com',
            'sub' => $sub
    ];

    $pem_content = <<encode(json_encode($header)).'.'.$this->encode(json_encode($body));

        $signature = '';
        $success = openssl_sign($payload, $signature, $privKey, OPENSSL_ALGO_SHA256);
        if (!$success) return false;

        $raw_signature = $this->fromDER($signature, 64);

        return $payload.'.'.$this->encode($raw_signature);
    }

    public function encode($data){
        return str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($data)); 
    }      

    public static function fromDER(string $der, int $partLength)
    {
        $hex = unpack('H*', $der)[1];
        if ('30' !== mb_substr($hex, 0, 2, '8bit')) { // SEQUENCE
            throw new \RuntimeException();
        }
        if ('81' === mb_substr($hex, 2, 2, '8bit')) { // LENGTH > 128
            $hex = mb_substr($hex, 6, null, '8bit');
        } else {
            $hex = mb_substr($hex, 4, null, '8bit');
        }
        if ('02' !== mb_substr($hex, 0, 2, '8bit')) { // INTEGER
            throw new \RuntimeException();
        }
        $Rl = hexdec(mb_substr($hex, 2, 2, '8bit'));
        $R = self::retrievePositiveInteger(mb_substr($hex, 4, $Rl * 2, '8bit'));
        $R = str_pad($R, $partLength, '0', STR_PAD_LEFT);
        $hex = mb_substr($hex, 4 + $Rl * 2, null, '8bit');
        if ('02' !== mb_substr($hex, 0, 2, '8bit')) { // INTEGER
            throw new \RuntimeException();
        }
        $Sl = hexdec(mb_substr($hex, 2, 2, '8bit'));
        $S = self::retrievePositiveInteger(mb_substr($hex, 4, $Sl * 2, '8bit'));
        $S = str_pad($S, $partLength, '0', STR_PAD_LEFT);
        return pack('H*', $R.$S);
    }
    /**
     * @param string $data
     *
     * @return string
     */
    private static function preparePositiveInteger(string $data)
    {
        if (mb_substr($data, 0, 2, '8bit') > '7f') {
            return '00'.$data;
        }
        while ('00' === mb_substr($data, 0, 2, '8bit') && mb_substr($data, 2, 2, '8bit') <= '7f') {
            $data = mb_substr($data, 2, null, '8bit');
        }
        return $data;
    }
    /**
     * @param string $data
     *
     * @return string
     */
    private static function retrievePositiveInteger(string $data)
    {
        while ('00' === mb_substr($data, 0, 2, '8bit') && mb_substr($data, 2, 2, '8bit') > '7f') {
            $data = mb_substr($data, 2, null, '8bit');
        }
        return $data;
    }

Creating jwt after signing with apple in php

1 Answers