selfservice:
  methods:
    oidc:
      enabled: true
      config:
        providers:
          - id: apple
            provider: apple
            client_id: ....
            apple_team_id: ....
            apple_private_key_id: ....
            apple_private_key: |
              -----BEGIN PRIVATE KEY-----
              ....
              -----END PRIVATE KEY-----
            mapper_url: file:///etc/config/kratos/mappers/oidc.apple.jsonnet
            scope:
              - email

local claims = {
  email_verified: false,
} + std.extVar('claims');

{
  identity: {
    traits: {
      // Allowing unverified email addresses enables account
      // enumeration attacks,  if the value is used for
      // verification or as a password login identifier.
      //
      // Therefore we only return the email if it (a) exists and (b) is marked verified
      // by Apple.
      [if 'email' in claims && claims.email_verified then 'email' else null]: claims.email,
    },
  },
}

unsupported protocol scheme ""