Quickstart-unity: Sign in with Apple authentication flow issues.

[fmorenogg]

Please fill in the following fields:

Unity editor version: 2018.4.16f1
Firebase Unity SDK version: 6.10.0
Firebase plugins in use (Auth, Database, etc.): Auth, Database, RemoteConfig, Messaging
Additional SDKs you are using (Facebook, AdMob, etc.): Facebook
Platform you are using the Unity editor on (Mac, Windows, or Linux): Mac and Windows
Platform you are targeting (iOS, Android, and/or desktop): iOS
Scripting Runtime (Mono, and/or IL2CPP): IL2CPP

Please describe the issue here:

Sign in with Apple authentication flow issues.

The only way of authenticating with firebase with sign in with apple credentials is to force the user to go through sign in with apple login flow in every game session.

The goal is to replicate the authentication flow that other auth providers already provide in Firebase in our case Facebook. With Facebook the user only login in Facebook once and in next game sessions we authenticate with Firebase using:

Credential credential = FacebookAuthProvider.GetCredential(AccessToken.CurrentAccessToken.TokenString);
var task = firebaseAuth.SignInWithCredentialAsync(credential);

This way the Facebook authentication happens without user intervention.

We can’t replicate this behaviour with OauthProvier that sign in with Apple requires, when we use our idToken and authToken the second time and onwards we get this IOS native error:

Error Domain=FIRAuthErrorDomain Code=17094 "Duplicate credential received. Please try again with a new credential."

Digging in the Apple documentation we found this flow. This points that when you successfully authenticate with Apple you get back a refresh token for the next authentication. This refresh token is exposed in the Firebase iOS SDK as this post from Chuan Ren confirms:

https://github.com/firebase/firebase-ios-sdk/issues/4434#issuecomment-564776016

But unfortunately this refresh token is not exposed in the Firebase Unity SDK, in the task result we only get an object of type FirebaseUser and we cannot get the refresh token we need for login.

There is any way to get this refresh token in the Unity SDK?
There is another way to replicate the Facebook auth behaviour that doesn’t force the user to go through all the login process every single time that a firebase auth is needed?

Thanks.

Please answer the following, if applicable:

Have you been able to reproduce this issue with just the Firebase Unity quickstarts (this GitHub project)? Yes

What's the issue repro rate? 100%

[paulinon]

Thank you for your question @fmorenogg. According to the docs, you can use a third-party plugin such as Unity's Sign In With Apple Asset Storage Package for nonce and token generation.

[fmorenogg]

Hi paulion, the issue is not about how to get the token (witch I already have using this implementation)
It's about how the refresh token works in the Unity SDK of Firebase.
Thanks.

[DellaBitta]

Hi @fmorenogg,

we're looking at how we can plumb the refresh token information from the iOS SDK to the Unity SDK. I hope to have an update soon.

[fmorenogg]

Hi @fmorenogg,

we're looking at how we can plumb the refresh token information from the iOS SDK to the Unity SDK. I hope to have an update soon.

Great!

With the current implementation of Unity SDK we can't enable Sign in with Apple to our users. Looking forward to the new update.

Thanks.

[kimjy0202]

any update on this?

[fmorenogg]

Hi DellaBitta,

Apple is no longer accepting new apps that doesn't provide Sign In With Apple when they use authenticate or set up user accounts as stated here https://developer.apple.com/app-store/review/guidelines/#sign-in-with-apple

Furthermore updated apps that require Sign In With Apple and don't have this feature will be accepted until June 30, 2020.

Hi @fmorenogg,

we're looking at how we can plumb the refresh token information from the iOS SDK to the Unity SDK. I hope to have an update soon.

There is any update on this? Do you think that this will be ready before June 30 deadline?

Thanks.

[DellaBitta]

Hi all,

I posted in Issue #576 that version 6.14.1 went out yesterday which includes a change in the flows for retreiving an updated credential in failed linked attempts with Apple. This should facilaite the functionality pointed to by firebase/firebase-ios-sdk#4434 (comment) mentioned above.

Please let me know if this solves our issue. Thanks!

[fmorenogg]

Hi @DellaBitta,

Thanks for the update, appreciate it. We have been working with the updated version and unfortunately this doesn't solve our issue.
My understanding is that the new release now exposes the updated credential in a linking flow, (this is a great feature and we will use it when we have several providers) but we need this updated credential in a login flow.

Right now in 6.14.1 we can do this as you stated in Issue 576

auth.CurrentUser.LinkAndRetrieveDataWithCredentialAsync(Firebase.Auth.OAuthProvider.GetCredential("apple.com", idToken, rawNonce, null)).ContinueWithOnMainThread( task => {
   if (task.IsCompleted) {
      // Link Success
   } else {
      if (task.Exception != null) {
         foreach (Exception exception in task.Exception.Flatten().InnerExceptions) {
            Firebase.Auth.FirebaseAccountLinkException firebaseEx = 
               exception as Firebase.Auth.FirebaseAccountLinkException;          
            if (firebaseEx != null && firebaseEx.UserInfo.UpdatedCredential.IsValid()) {
               // Attempt to sign in with the updated credential.
               auth.SignInWithCredentialAsync(firebaseEx.UserInfo.UpdatedCredential).ContinueWithOnMainThread(HandleSignInWithUser);
            } else {
               DebugLog("Link with Apple failed:" + firebaseEx );     
            }
         } // end for loop
      } 
   }
});

What would solve our issue is something like this:

auth.SignInWithCredentialAsync(Firebase.Auth.OAuthProvider.GetCredential("apple.com", idToken, rawNonce, null)).ContinueWithOnMainThread( task => {
   if (task.IsCompleted) {
      // Link Success
   } else {
      if (task.Exception != null) {
         foreach (Exception exception in task.Exception.Flatten().InnerExceptions) {
            Firebase.Auth.FirebaseAccountLinkException firebaseEx = 
               exception as Firebase.Auth.FirebaseAccountLinkException;          
            if (firebaseEx != null && firebaseEx.UserInfo.UpdatedCredential.IsValid()) {
               // Attempt to sign in with the updated credential.
               auth.SignInWithCredentialAsync(firebaseEx.UserInfo.UpdatedCredential).ContinueWithOnMainThread(HandleSignInWithUser);
            } else {
               DebugLog("Link with Apple failed:" + firebaseEx );     
            }
         } // end for loop
      } 
   }
});

Please note the login method in the second block of code instead of the linking method.

Thanks.

[DellaBitta]

Hi @fmorenogg,

The Unity SDK is based on the iOS Firebase SDK. I don't believe that there's a method in the iOS SDK to reuse a Nonce-based Apple Sign In Credential for signing in users. However, after the user account is signed in the first time, the User object should be persisted and may be used for subsequent auth operations even between sessions.

Generally this is handled by configuring the .StateChanged and the .IDTokenChanged listener properties on the FirebaseAuth object. An example of this is in the InitializeFirebase method of the Auth Quickstart where a force refresh of the token is made via TokenAync().

As a test I was able to update the display name of an account that was signed in a week ago via Apple Sign In, but using the refreshed tokens retrieved from the service via User.TokenAsync and not requiring a new Apple Sign In token to be generated.

Please let me know if this helps you or if you run into any problems If there's a specific need to call SignInWithApple for the user on every execution of the application then please let me know. Thanks!

[DellaBitta]

It's not possible to reuse a nonce so I'm removing the feature request label. Additionally since we haven't heard from you I'm closing this isusue for now. Please see Issue #576 for more information, and mention me if you have any questions.