Apple IdP Adapter settings reference

Team ID

The Team ID that you noted in Registering an Apple app.

This is used as iss in the client secret.

Services ID

The Identifier that you registered in Registering an Apple service.

This is used as the client_id when the adapter requests access and refresh tokens. It is also used as sub when the adapter creates the client secret JWT.

Key ID

The Key ID that you noted in Creating an Apple private key.

This is used as kid in the client secret.

Client Secret Signing Key

The private key .p8 file that you downloaded in Creating an Apple private key.

PingFederate encrypts this file when you add it to your configuration.

Error Redirect URL

When an error occurs in the adapter, PingFederate redirects the browser to this URL instead of the default error page.

This field is blank by default.

Authorization Callback Endpoint

The PingFederate endpoint that Apple uses to respond to authorization requests. If you set a custom endpoint in the Authorization callback URL field in Registering an Apple service, change this field to match.

This default value is /apple-authn.

Apple Authorization URL

The URL that PingFederate uses to send authorization requests to Apple. If Apple changes this endpoint, enter the new URL.

The default value is https://appleid.apple.com/auth/authorize.

Apple Access Token URL

The URL that PingFederate uses to retrieve access tokens from Apple. If Apple changes this endpoint, enter the new URL.

The default value is https://appleid.apple.com/auth/token.

Apple ID URL

The URL that PingFederate uses to communicate with Apple ID.

The default value is https://appleid.apple.com.

Apple Public Key URL

The URL that PingFederate uses to retrieve the Apple public key.

The default value is https://appleid.apple.com/auth/keys.

Client Secret Expiration

The amount of time in minutes that the client secret is valid. Enter a value between 1 and 262950 (6 months).

The default value is 5.

Scopes

The scopes that you want to request from Apple. Separate scopes with a space. See the note about scopes in Known issues and limitations.

Valid scopes include openid, email, and name.

The default value is openid email name.

Apple Sign-On Presentation

Determines how the adapter presents the Apple sign-on form.

This setting has no effect when using the adapter through the PingFederate authentication API.

Apple Pop-Up Template

The template file that presents the Apple sign-on form. Applies only when Apple Login Presentation is set to Pop-up window.

The default value is apple-pop-up-template.html.

Apple Post-Auth Template

The template file that the adapter presents after the user signs on. Applies only when Apple Login Presentation is set to Pop-up window.

The default value is apple-post-auth-template.html.

Apple Messages File

The language-pack file associated with the Apple pop-up template.

The default value is pingfederate-apple-adapter-messages.

Retry Request

Determines whether PingFederate will retry requests after it receives a response with a failure code.

This check box is cleared by default.

Maximum Retries Limit

Determines how many times PingFederate retries a request.

The default value is 5.

Retry Error Codes

A list of response codes that you want to trigger a retry. Separate response codes with a comma.

The default value is 400.

API Request Timeout

The amount of time in milliseconds that PingFederate waits for Apple to respond to requests. A value of 0 disables the timeout.

The default value is 2000.

Connection Timeout

The amount of time in milliseconds that PingFederate allows to establish a connection with Apple. A value of 0 disables the timeout.

The default value is 2000.

Proxy Settings

Defines proxy settings for outbound HTTP requests.

The default value is System Defaults.

Custom Proxy Host

The proxy server host name to use when Proxy Settings is set to Custom.

This field is blank by default.

Custom Proxy Port

The proxy server port to use when Proxy Settings is set to Custom.

This field is blank by default.