苹果APP授权登录

一、前置说明

苹果App开发完成后支持微信QQ一键登录，审核时要求具备Apple登录以防万一，苹果登录有两种方式，一种是jwt，二是授权码模式，这里采用jwt模式，开发语言为java

 

二、代码实现

使用相关技术：jwt+restTemplate+fastjson

/**
     * 解析apple授权token
     * @param jwt
     * @return
     * @throws Exception
     */
    @Override
    public JSONObject appleAuth(String jwt) throws Exception {
        //解析identityToken
        String[] jwtArray = jwt.split("\\.");
        String claim = new String(Base64.decodeBase64(jwtArray[1]));
        JSONObject claimJson = JSONObject.parseObject(claim);
        // 解析头部 kid
        String header = new String(Base64.decodeBase64(jwtArray[0]));
        JSONObject headerJson = JSONObject.parseObject(header);
        // 请求获取苹果公钥
        String body = restTemplate.getForObject("https://appleid.apple.com/auth/keys",String.class);
        JSONObject jsonObject = JSONObject.parseObject(body);
        String keys = jsonObject.getString("keys");
        JSONArray arr = JSONObject.parseArray(keys);
        JSONObject appleKey1 = JSONObject.parseObject(arr.getString(0));
        JSONObject appleKey2 = JSONObject.parseObject(arr.getString(1));
        JSONObject appleKey = appleKey1;
        if( !headerJson.getString("kid").equals(appleKey1.getString("kid")) ){
            appleKey = appleKey2;
        }
        // 生成苹果公钥
        BigInteger modulus = new BigInteger(1, Base64.decodeBase64(appleKey.getString("n")));
        BigInteger publicExponent = new BigInteger(1, Base64.decodeBase64(appleKey.getString("e")));
        RSAPublicKeySpec rsaPublicKeySpec = new RSAPublicKeySpec(modulus, publicExponent);

        //生成 PublicKey
        KeyFactory kf = KeyFactory.getInstance("RSA");
        PublicKey publicKey = kf.generatePublic(rsaPublicKeySpec);
        //校验有效
        return verify(publicKey,jwt,claimJson);
    }

    public JSONObject verify(PublicKey key, String jwt, JSONObject claimJson){
        //构造返回数据
        JSONObject result = new JSONObject();
        boolean status = false;
        //校验
        JwtParser jwtParser = Jwts.parser().setSigningKey(key);
        jwtParser.requireIssuer(claimJson.getString("iss"))
                .requireAudience(claimJson.getString("aud"))
                .requireSubject(claimJson.getString("sub"));
        try {
            Jws<Claims> claim = jwtParser.parseClaimsJws(jwt);
            if (claim != null && claim.getBody().containsKey("auth_time")) {
                //校验成功
                status = true;
                //返回 用户的唯一标识
                result.put("sub",claimJson.getString("sub"));
            }
        }catch (Exception e) {
            log.error("校验失败");
        }
        result.put("status",status);
        return result;
    }