Authenticate Using OpenID Connect on Apple platforms

If you've upgraded to Firebase Authentication with Identity Platform, you can authenticate your users with Firebase using the OpenID Connect (OIDC) compliant provider of your choice. This makes it possible to use identity providers not natively supported by Firebase.

Before you begin

To sign in users using an OIDC provider, you must first collect some information from the provider:

Client ID: A string unique to the provider that identifies your app. Your provider might assign you a different client ID for each platform you support. This is one of the values of the aud claim in ID tokens issued by your provider.
Client secret: A secret string that the provider uses to confirm ownership of a client ID. For every client ID, you will need a matching client secret. (This value is required only if you're using the auth code flow, which is strongly recommended.)
Issuer: A string that identifies your provider. This value must be a URL that, when appended with /.well-known/openid-configuration, is the location of the provider's OIDC discovery document. For example, if the issuer is https://auth.example.com, the discovery document must be available at https://auth.example.com/.well-known/openid-configuration.

After you have the above information, enable OpenID Connect as a sign-in provider for your Firebase project:

Add Firebase to your iOS project.
If you haven't upgraded to Firebase Authentication with Identity Platform, do so. OpenID Connect authentication is only available in upgraded projects.
On the Sign-in providers page of the Firebase console, click Add new provider, and then click OpenID Connect.
Select whether you will be using the authorization code flow or the implicit grant flow.

You should use always the code flow if your provider supports it. The implicit flow is less secure and using it is strongly discouraged.
Give a name to this provider. Note the provider ID that's generated: something like oidc.example-provider. You'll need this ID when you add sign-in code to your app.
Specify your client ID and client secret, and your provider's issuer string. These values must exactly match the values your provider assigned to you.
Save your changes.

Handle the sign-in flow with the Firebase SDK

The easiest way to authenticate your users with Firebase using your OIDC provider is to handle the entire sign-in flow with the Firebase SDK.

To handle the sign-in flow with the Firebase Apple platforms SDK, follow these steps:

Add custom URL schemes to your Xcode project:
1. Open your project configuration: double-click the project name in the left tree view. Select your app from the TARGETS section, then select the Info tab, and expand the URL Types section.
2. Click the + button, and add your Encoded App ID as a URL scheme. You can find your Encoded App ID on the General Settings page of the Firebase console, in the section for your iOS app. Leave the other fields blank.
  When completed, your config should look something similar to the following (but with your application-specific values):

Create an instance of an OAuthProvider using the provider ID you got in the Firebase console.

Swift

var provider = OAuthProvider(providerID: "oidc.example-provider")

Objective-C

FIROAuthProvider *provider = [FIROAuthProvider providerWithProviderID:@"oidc.example-provider"];

Optional: Specify additional custom OAuth parameters that you want to send with the OAuth request.
Swift
```
provider.customParameters = [
  "login_hint": "user@example.com"
]
```
Objective-C
```
[provider setCustomParameters:@{@"login_hint": @"user@example.com"}];
```
Check with your provider for the parameters it supports. Note that you can't pass Firebase-required parameters with setCustomParameters. These parameters are client_id, response_type, redirect_uri, state, scope and response_mode.
Optional: Specify additional OAuth 2.0 scopes beyond basic profile that you want to request from the authentication provider.
Swift
```
provider.scopes = ["mail.read", "calendars.read"]
```
Objective-C
```
[provider setScopes:@[@"mail.read", @"calendars.read"]];
```
Check with your provider for the scopes it supports.
Optional: If you want to customize the way your app presents the SFSafariViewController or UIWebView when displaying the reCAPTCHA to the user, create a custom class that conforms to the AuthUIDelegate protocol.

Authenticate with Firebase using the OAuth provider object.

Swift

// If you created a custom class that conforms to AuthUIDelegate,
// pass it instead of nil:
provider.getCredentialWith(nil) { credential, error in
  if error != nil {
    // Handle error.
  }
  if credential != nil {
    Auth().signIn(with: credential) { authResult, error in
      if error != nil {
        // Handle error.
      }
      // User is signed in.
      // IdP data available in authResult.additionalUserInfo.profile.
      // OAuth access token can also be retrieved:
      // (authResult.credential as? OAuthCredential)?.accessToken
      // OAuth ID token can also be retrieved:
      // (authResult.credential as? OAuthCredential)?.idToken
    }
  }
}

Objective-C

// If you created a custom class that conforms to AuthUIDelegate,
// pass it instead of nil:
[provider getCredentialWithUIDelegate:nil
                            completion:^(FIRAuthCredential *_Nullable credential, NSError *_Nullable error) {
  if (error) {
    // Handle error.
  }
  if (credential) {
    [[FIRAuth auth] signInWithCredential:credential
                              completion:^(FIRAuthDataResult *_Nullable authResult, NSError *_Nullable error) {
      if (error) {
        // Handle error.
      }
      // User is signed in.
      // IdP data available in authResult.additionalUserInfo.profile.
      // OAuth access token can also be retrieved:
      // ((FIROAuthCredential *)authResult.credential).accessToken
      // OAuth ID token can also be retrieved:
      // ((FIROAuthCredential *)authResult.credential).idToken
    }];
  }
}];

While the above examples focus on sign-in flows, you also have the ability to link an OIDC provider to an existing user using linkWithCredential. For example, you can link multiple providers to the same user allowing them to sign in with either.

Swift

Auth().currentUser.link(withCredential: credential) { authResult, error in
  if error != nil {
    // Handle error.
  }
  // OIDC credential is linked to the current user.
  // IdP data available in authResult.additionalUserInfo.profile.
  // OAuth access token can also be retrieved:
  // (authResult.credential as? OAuthCredential)?.accessToken
  // OAuth ID token can also be retrieved:
  // (authResult.credential as? OAuthCredential)?.idToken
}

Objective-C

[[FIRAuth auth].currentUser
    linkWithCredential:credential
            completion:^(FIRAuthDataResult * _Nullable authResult, NSError * _Nullable error) {
  if (error) {
    // Handle error.
  }
  // OIDC credential is linked to the current user.
  // IdP data available in authResult.additionalUserInfo.profile.
  // OAuth access token can also be retrieved:
  // ((FIROAuthCredential *)authResult.credential).accessToken
  // OAuth ID token can also be retrieved:
  // ((FIROAuthCredential *)authResult.credential).idToken
}];

The same pattern can be used with reauthenticateWithCredential which can be used to retrieve fresh credentials for sensitive operations that require recent login.

Swift

Auth().currentUser.reauthenticateWithCredential(withCredential: credential) { authResult, error in
  if error != nil {
    // Handle error.
  }
  // User is re-authenticated with fresh tokens minted and
  // should be able to perform sensitive operations like account
  // deletion and email or password update.
  // IdP data available in result.additionalUserInfo.profile.
  // Additional OAuth access token can also be retrieved:
  // (authResult.credential as? OAuthCredential)?.accessToken
  // OAuth ID token can also be retrieved:
  // (authResult.credential as? OAuthCredential)?.idToken
}

Objective-C

[[FIRAuth auth].currentUser
    reauthenticateWithCredential:credential
                      completion:^(FIRAuthDataResult * _Nullable authResult, NSError * _Nullable error) {
  if (error) {
    // Handle error.
  }
  // User is re-authenticated with fresh tokens minted and
  // should be able to perform sensitive operations like account
  // deletion and email or password update.
  // IdP data available in result.additionalUserInfo.profile.
  // Additional OAuth access token can also be retrieved:
  // ((FIROAuthCredential *)authResult.credential).accessToken
  // OAuth ID token can also be retrieved:
  // ((FIROAuthCredential *)authResult.credential).idToken
}];

Handle the sign-in flow manually

If you've already implemented the OpenID Connect sign-in flow in your app, you can use the ID token directly to authenticate with Firebase:

Swift

let credential = OAuthProvider.credential(
    withProviderID: "oidc.example-provider",  // As registered in Firebase console.
    idToken: idToken,  // ID token from OpenID Connect flow.
    rawNonce: nil
)
Auth.auth().signIn(with: credential) { authResult, error in
    if error {
        // Handle error.
        return
    }
    // User is signed in.
    // IdP data available in authResult?.additionalUserInfo?.profile
}

Objective-C

FIROAuthCredential *credential =
    [FIROAuthProvider credentialWithProviderID:@"oidc.example-provider"  // As registered in Firebase console.
                                       IDToken:idToken  // ID token from OpenID Connect flow.
                                      rawNonce:nil];
[[FIRAuth auth] signInWithCredential:credential
                          completion:^(FIRAuthDataResult * _Nullable authResult,
                                      NSError * _Nullable error) {
    if (error != nil) {
        // Handle error.
        return;
    }
    // User is signed in.
    // IdP data available in authResult.additionalUserInfo.profile
}];

Next steps

After a user signs in for the first time, a new user account is created and linked to the credentials—that is, the user name and password, phone number, or auth provider information—the user signed in with. This new account is stored as part of your Firebase project, and can be used to identify a user across every app in your project, regardless of how the user signs in.

In your apps, you can get the user's basic profile information from the User object. See Manage Users.
In your Firebase Realtime Database and Cloud Storage Security Rules, you can get the signed-in user's unique user ID from the auth variable, and use it to control what data a user can access.

You can allow users to sign in to your app using multiple authentication providers by linking auth provider credentials to an existing user account.

To sign out a user, call signOut:.

Swift

let firebaseAuth = Auth.auth()
do {
  try firebaseAuth.signOut()
} catch let signOutError as NSError {
  print("Error signing out: %@", signOutError)
}

Objective-C

NSError *signOutError;
BOOL status = [[FIRAuth auth] signOut:&signOutError];
if (!status) {
  NSLog(@"Error signing out: %@", signOutError);
  return;
}

You may also want to add error handling code for the full range of authentication errors. See Handle Errors.