Authorize using Firebase CLI credentials #2214

samtstern · 2020-05-06T17:40:51Z

Description

Fixes #1940

TODO:

Add pre-execution warnings about accessing prod
Add a description of how auth works in the README

This change will allow the Firebase emulators to pass the credentials from firebase login as Cloud application default credentials.

Currently the emulators rely on picking up gcloud auth application-default login credentials on the machine which is at best annoying and at worst means that the emulators are authorized as the wrong user.

Here's the new behavior matrix:

#	Firebase Login	Application Default	`GAC` Env	Result
1	❌	❌	❌	Emulator has no auth at all
2	✅	❌	❌	CLI passes `GAC` env to emulator with user credential
3	❌	✅	❌	ADC may be discovered and used
4	❌	❌	✅	Emulator will use explicit `GAC` credential
5	✅	✅	❌	CLI passes `GAC` env, ADC is ignored
6	✅	❌	✅	CLI does not pass cred, Emulator will use explicit `GAC` credential
7	❌	✅	✅	Emulator will use explicit `GAC` credential, ADC is ignored
8	✅	✅	✅	Emulator will use explicit `GAC` credential, all others

Note: we can/should change the behavior of Scenario 3 when this bug is fixed:
firebase/firebase-js-sdk#3144

Scenarios Tested

Functions used for all tests:

const functions = require('firebase-functions');
const admin = require('firebase-admin');
admin.initializeApp();

async function tryRtdbWrite() {
  const db = admin.database();
  try {
    await db.ref().child('test').set({
      date: new Date().toISOString()
    });
    return true;
  } catch (e) {
    console.warn(e);
    return false;
  }
}

exports.helloWorld = functions.https.onRequest(async (request, response) => {
  response.json({
    creds: process.env.GOOGLE_APPLICATION_CREDENTIALS || null,
    canWriteToDatabase: await tryRtdbWrite()
  });
});

Scenario 1

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld

http: error: Request timed out (30s).

Emulator logs

>  [2020-07-07T18:30:07.387Z]  @firebase/database: FIREBASE WARNING: {"code":"app/invalid-credential","message":"Credential implementation provided to initializeApp() via the \"credential\" property failed to fetch a valid Google OAuth2 access token with the following error: \"Error fetching access token: Error while making request: getaddrinfo ENOTFOUND metadata.google.int

Scenario 2

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 127
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:32:07 GMT
etag: W/"7f-QwapyiMrFDzSQjxgEK52zAhX9pU"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/.config/firebase/samstern_google_com_application_default_credentials.json"
}

Scenario 3

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 40
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:40:37 GMT
etag: W/"28-0p3KpSLf1GtAozwuGH12/ekZOZY"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": null
}

Scenario 4

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 104
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:36:43 GMT
etag: W/"68-YwHpi6KFuPjLagvh8WBTCXYvjUY"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/service-accounts/fir-dumpster/service-account.json"
}

Scenario 5

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 127
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:38:08 GMT
etag: W/"7f-QwapyiMrFDzSQjxgEK52zAhX9pU"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/.config/firebase/samstern_google_com_application_default_credentials.json"
}

Scenario 6

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 104
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:34:23 GMT
etag: W/"68-YwHpi6KFuPjLagvh8WBTCXYvjUY"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/service-accounts/fir-dumpster/service-account.json"
}

Scenario 7

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 104
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:39:34 GMT
etag: W/"68-YwHpi6KFuPjLagvh8WBTCXYvjUY"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/service-accounts/fir-dumpster/service-account.json"
}

Scenario 8

See logs

$ http http://localhost:5001/fir-dumpster/us-central1/helloWorld
HTTP/1.1 200 OK
connection: keep-alive
content-length: 104
content-type: application/json; charset=utf-8
date: Tue, 07 Jul 2020 18:38:46 GMT
etag: W/"68-YwHpi6KFuPjLagvh8WBTCXYvjUY"
x-powered-by: Express

{
    "canWriteToDatabase": true,
    "creds": "/Users/samstern/service-accounts/fir-dumpster/service-account.json"
}

Sample Commands

N/A

yuchenshi

Approval for TypeScript readability. Please add more folks for the context of the change if possible.

src/emulator/controller.ts

src/defaultCredentials.ts

hiranya911

Implementation LGTM, although I'm not familiar with how these different components are wired together in the emulator suite.

hiranya911 · 2020-05-21T20:01:42Z

src/defaultCredentials.ts

+
+  // We could use fs.writeFileSync() here but it's important that the caller understands
+  // that this is a somewhat expensive operation so we make it a Promise.
+  return new Promise((res, rej) => {


Wouldn't this overwrite whatever is currently in that path? Is that the behavior we want?

Yes that's the behavior we want. I'm willing to pay this small extra cost to avoid the whole class of bugs that come with potentially out of date credentials.

Co-authored-by: Yuchen Shi <[email protected]>

src/emulator/functionsEmulatorRuntime.ts

…ools into ss-fix-emulator-auth

Changes made

mbleigh

A couple tactical comments, also here's some broad thinking:

This is a broadly useful thing in terms of making it possible for your local environment to be application default credentialed for the things you want to access. It's also a little dangerous in that regard, and I know gcloud is moving away from using user-based credentials for anything. If I have a major reservation about doing it at all, it's that -- the credentials associated with the Firebase CLI are broad.

Separately though, the fact that you can do this at all might unblock firebase shell and could be really useful for developers who want to write firebase-admin scripts. Having a command like firebase account:credentials that populates this file for non-emulator use might be worth considering.

src/defaultCredentials.ts

bkendall

You have my 👍 , pending your TODOs - let me know if you want me to come back and look at this again.

Talked in chat

Authorize using Firebase CLI credentials

c274a8a

googlebot added the cla: yes Manual indication that this has passed CLA. label May 6, 2020

samtstern marked this pull request as draft May 6, 2020 17:41

samtstern mentioned this pull request May 6, 2020

Allow FIREBASE_EMULATOR_CREDENTIALS firebase/firebase-admin-node#876

Closed

yuchenshi approved these changes May 8, 2020

View reviewed changes

samtstern added 2 commits May 18, 2020 17:28

Merge branch 'master' into ss-fix-emulator-auth

bbdc3bb

Switch to using GOOGLE_APPLICATION_CREDENTIALS

86e9397

samtstern requested a review from yuchenshi May 19, 2020 12:49

Changelog

793ff55

samtstern marked this pull request as ready for review May 19, 2020 12:51

Merge branch 'master' into ss-fix-emulator-auth

afaab46

samtstern requested review from mbleigh and hiranya911 May 19, 2020 18:37

samtstern assigned mbleigh and hiranya911 May 19, 2020

yuchenshi reviewed May 19, 2020

View reviewed changes

src/emulator/controller.ts Outdated Show resolved Hide resolved

bkendall previously requested changes May 19, 2020

View reviewed changes

src/defaultCredentials.ts Outdated Show resolved Hide resolved

src/defaultCredentials.ts Outdated Show resolved Hide resolved

src/defaultCredentials.ts Outdated Show resolved Hide resolved

samtstern added 2 commits May 19, 2020 17:29

De-class

aa473d3

Eslint shhhhh

b100444

hiranya911 approved these changes May 21, 2020

View reviewed changes

hiranya911 removed their assignment May 21, 2020

hiranya911 reviewed May 21, 2020

View reviewed changes

samtstern mentioned this pull request May 26, 2020

Functions shell/emulator unable to load default credentials #1940

Closed

Update src/emulator/controller.ts

9d4d6a8

Co-authored-by: Yuchen Shi <[email protected]>

samtstern commented May 27, 2020

View reviewed changes

src/emulator/functionsEmulatorRuntime.ts Show resolved Hide resolved

samtstern added 4 commits May 27, 2020 09:07

Merge branch 'master' into ss-fix-emulator-auth

f225dc8

Merge branch 'master' into ss-fix-emulator-auth

1fe6af0

Add unit tests

ccd51f3

Merge branch 'ss-fix-emulator-auth' of github.com:firebase/firebase-t…

07004c2

…ools into ss-fix-emulator-auth

samtstern requested a review from bkendall May 28, 2020 16:08

More warnings, cleaner JSON

77ee910

mbleigh previously requested changes May 28, 2020

View reviewed changes

src/defaultCredentials.ts Outdated Show resolved Hide resolved

src/defaultCredentials.ts Outdated Show resolved Hide resolved

Delete on logout, put user email in file name

9e9c813

samtstern requested a review from mbleigh May 28, 2020 17:42

samtstern mentioned this pull request Jun 17, 2020

firebase deploy return an empty object {} #2373

Closed

bkendall approved these changes Jul 6, 2020

View reviewed changes

samtstern added 4 commits July 7, 2020 11:26

Merge branch 'master' into ss-fix-emulator-auth

5a7eae0

Add section to README

76ea7d6

Add new warning

2535d26

Final fixes

f807508

samtstern merged commit 26eb74e into master Jul 7, 2020

bkendall deleted the ss-fix-emulator-auth branch August 4, 2021 19:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authorize using Firebase CLI credentials #2214

Authorize using Firebase CLI credentials #2214

samtstern commented May 6, 2020 •

edited

Loading

yuchenshi left a comment

hiranya911 left a comment

hiranya911 May 21, 2020

samtstern May 27, 2020

mbleigh left a comment

bkendall left a comment

Authorize using Firebase CLI credentials #2214

Authorize using Firebase CLI credentials #2214

Conversation

samtstern commented May 6, 2020 • edited Loading

Description

Scenarios Tested

Sample Commands

yuchenshi left a comment

Choose a reason for hiding this comment

hiranya911 left a comment

Choose a reason for hiding this comment

hiranya911 May 21, 2020

Choose a reason for hiding this comment

samtstern May 27, 2020

Choose a reason for hiding this comment

mbleigh left a comment

Choose a reason for hiding this comment

bkendall left a comment

Choose a reason for hiding this comment

samtstern commented May 6, 2020 •

edited

Loading