[FR] Allow credential file type "external_account" when calling `admin.credential.applicationDefault()` #1377

thomasmburke · 2021-07-15T18:12:59Z

Is your feature request related to a problem? Please describe.

Developers would like the ability to initialize a Firebase app instance with a credential file type "external_account". An example of when credential file of type "external_account" is used is when following the instructions listed in the GCP public docs for using AWS Identify Federated Credentials. This credential file type is supported by other Google APIs (e.g. @google-cloud/storage, @google-cloud/firestore, etc...) and is also supported by the Firebase Admin SDK in other languages (e.g. Java)

Describe the solution you'd like

Allow the initialization of a Firebase app instance using credential file type "external_account". This will likely require an update to the credentialFromFile function

Describe alternatives you've considered

Developers are currently limited to:

Leveraging the Firebase Java Admin SDK instead
Using Secrets Manager/environment variables to store a service account key outside of code
Calling a corresponding RESTful endpoint from within node.js via something like http.request

Additional context

When a developer has configured GOOGLE_APPLICATION_CREDENTIALS to point to a credential file type of "external_account" (e.g. a AWS Identity Federation Credentials Config file) the below are the differences between the implementations for the Firebase Java Admin SDK and the Firebase Node.js Admin SDK:

Node.js Details:
Developer initializes Firebase app instance with code similar to the below:

const fbApp = admin.initializeApp({
        credential: admin.credential.applicationDefault(),
        projectId: 'GCP_PROJECT_ID',
        databaseURL: 'https://GCP_PROJECT_ID.firebaseio.com'
    });

Which in turn calls the credentialFromFile function and returns the following error: 'Invalid contents in the credentials file'

Java Details:
Developer initializes Firebase app instance with code similar to the below:

        GoogleCredentials credentials = GoogleCredentials.getApplicationDefault();

        FirebaseOptions options = FirebaseOptions.builder()
                .setCredentials(credentials)
                .setProjectId(GCP_PROJECT_ID)
                .setDatabaseUrl(FIREBASE_DB_URL)
                .build();

        FirebaseApp app = FirebaseApp.initializeApp(options);

Which in turn calls this function that has support for credential file type of "external_account"

The text was updated successfully, but these errors were encountered:

google-oss-bot · 2021-07-15T18:13:01Z

I found a few problems with this issue:

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
This issue does not seem to follow the issue template. Make sure you provide all the required information.

hiranya911 · 2021-07-16T20:43:19Z

Thanks for reporting this. We can try to prioritize this for in the coming months. You can also help speed things up by sending a PR if you have the time.

hiranya911 · 2021-07-29T20:27:18Z

Had a quick look at the external_account (federated authorization) support in GCP, and how libraries like https://github.com/googleapis/google-auth-library-nodejs have implemented it. Turns out it's actually quite a bit of code. Personally, I don't think we should duplicate this feature in the Admin Node.js SDK. Rather we should migrate all our credentials implementation to use google-auth-library-nodejs (we have already done similar migrations in other languages, which is why you can already use external_account support in Java Admin SDK).

I think doing this migration is going to be somewhat tricky. A rough plan would look something like:

Support https_proxy environment variable for proxy settings.
Update existing credentials to use google-auth-library-nodejs.
Add a new admin.credential.externalAccount() API.
Remove the token management logic currently in FirebaseApp.
Tie RTDB code to the tokens events fired by google-auth-library-nodejs.

andrewmclagan · 2022-11-30T10:14:24Z

Any movement on this issue? Currently not possible to use https://github.com/google-github-actions/auth as this is blocking it

Burekasim · 2022-12-14T18:38:21Z

I spend hours trying to figure out why it's not working until I encounter this issue,
I am very disappointed that this is not even documented, there is a service (workload identity federation) that is supposed to be the best practice and it is not supported by other GCP services :/

I give up, it's impossible to deal with Google's libraries :/

lhermann · 2023-02-16T05:20:58Z

I had the same experience as @Burekasim. I am trying to follow best practice and then find out that the lack of support is not documented.

Thank you @thomasmburke for this excellent and detailed issue.

Please Google Team, treat this issue as a priority so Firebase can be used with Github Actions in the recommended way.

erik-induro · 2023-02-28T18:55:56Z

This just ate a few hours of my life. The documentation is misleading when it says:

create_credentials_file: (Optional) If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs in other steps in the workflow. The default is true.

It should indicate that it doesn't work with the Firestore Node.js SDK.

Is there a work around?

lahirumaramba · 2023-02-28T21:25:04Z

I understand your frustration. Firebase Admin Node.js SDK uses a custom credentials implementation and does not currently support many features that are already supported in google-auth-library-nodejs including external accounts.

Migrating to https://github.com/googleapis/google-auth-library-nodejs is not a simple task, but we have started the process. Stay tuned! In the meantime, we will see what we can do to improve the docs. Thank you for your patience!

Mistic92 · 2023-03-13T13:32:42Z

How Workload Identity Federation can be not supported by GCP product. What is the roadmap to enable use of WIF?

enchorb · 2023-04-30T17:22:01Z

+1, how can an important feature like this be delayed/ not implemented for so long...

I'll just have to do it manually for now. It's not a huge deal since we check for new configs on load. The issue is that the admin sdk can't authenticate with workload identity federation yet. Ref: firebase/firebase-admin-node#1377

jordanebelanger · 2023-06-12T20:28:47Z

+1 seems like I was an other one of the chosen one selected for losing a couple hours on this while setuping my ci/cd. I get that it's now mentioned in the docu for google github action auth, but when you are doing this process you often end up with 50 different tabs of documentation open at once making the note easy to miss.

gkawin · 2023-06-23T19:06:09Z

Ok, I will stay tuned on this issue.

erlichmen · 2023-07-03T07:25:42Z

I urgently need to emphasize the severity of this particular issue. It presents itself when utilizing tools like Terraform, Pulumi, or when attempting to run local Firebase CLIs under application default credentials. Currently, the only feasible workaround is to employ a service account (SA) key.

This SA key has to be duplicated among the engineering team, and anyone who needs to operate one of the CLIs or any affected tool. Consequently, this poses a significant challenge for the CISO, necessitating the implementation of stringent processes - something that wouldn't be necessary if WIF was supported.

Furthermore, people are wasting innumerable hours attempting to decipher an issue that fundamentally stems from AdminSDK's neglect in using the most updated Google auth packages. There are numerous perplexing forum responses to odd errors like "missing quota project" or SERVICE_DISABLED (I mention these to potentially guide others in the right direction).

In spite of the complexity tied to integrating auth-library-nodejs, a span of two years ought to have been ample time. While I comprehend that @hiranya911 might no longer be a part of the team, this issue must be promptly assigned to a new lead.

dylanenabled · 2023-07-04T04:30:48Z

I wrote a script that works around this issue for our deployment pipeline by generating an expiring service account key (using the workload identity federation credentials) before it runs the node scripts. The key expires after a day, but the script also tries to delete it if everything goes right.

https://gist.github.com/dylanenabled/5fd0128afe362343cf2a8e9628c4218e

lox · 2023-08-31T07:38:28Z

Folks, any updates on this? This is also blocking the use of service impersonation (e.g. #2169).

k2wanko · 2023-09-17T21:41:14Z

This is an important topic for me.
I would like to be provided with a solution that does not require this workaround.

theunlitshadow · 2023-10-10T23:17:05Z

We are also awaiting an update on this issue. It's not apparent if this issue is being prioritized or even worked on.

lox · 2023-10-10T23:18:12Z

One could say that about almost all Firebase development work from what I can tell @theunlitshadow.

lahirumaramba · 2023-10-12T14:49:57Z

Hey folks, thanks again for your patience! We are actively working on this feature! Stay tuned for updates.

josekasna · 2023-10-24T07:42:54Z

We are also facing the same issue

breathe · 2023-10-26T18:19:12Z

Also ran into this issue ... Strugglefest!

In my case I'm deploying a nextjs firebase webapp which needs to use the firebase-admin sdk at build time within ci ... We only needed/wanted to use external account auth when running in ci so I ended up modifying one of the prior mentioned workarounds to get firebase-admin sdk auth to happen against external account only when in ci -- and otherwise follow a normal path ...

Workaround snippets for anyone else who comes into this pain ... https://gist.github.com/breathe/5b73c82f3ef3564b8b8f0641bf3e0a11

The error that tells you you need this workaround is that you get FirebaseAppError: Invalid contents in the credentials file when running the firebase deploy from a github action during the portion of the process that builds the nextjs cloud-functions/client-side bundles ...

Could be some dragons as should be aware of two levels of authz that exist here -- the identity to use to actually deploy the firebase project via the firebase cli -- and then the identity to use when running the nextjs build during that process ... (ideally you would have a way to communicate these two authz contexts to the firebase cli tooling directly ...)

lox · 2023-11-10T00:00:40Z

I have a more generic workaround that I am using for service account impersonation, should work for external_account without needing to import the internal credential classes (which is hard with ESModules).

https://gist.github.com/lox/8bff5607c3e713c92a03a631796ab3f3

rapuckett · 2023-12-23T23:45:29Z

Any... progress?

mitchkoby · 2024-02-06T04:19:15Z

Also awaiting an update on this.

hdpz · 2024-02-08T15:28:28Z

Would be great to see some progress on this issue 🙏

BenJackGill · 2024-02-11T07:31:08Z

In case anyone is using Firebase resources in Terraform with Github Actions google-github-actions/auth then you will also get strange unknown authentication errors because of this bug.

You have to use the Service Account JSON method as described in the docs instead of the Workload Identity Federation methods and that will avoid the strange errors.

To be fair the docs do warn about this error when working with Firebase Admin SDK but I didn't realise that also means Terraform resources will fail, which I assume is because the Terraform resources are interacting with the Firebase Admin SDK.

Burekasim · 2024-02-11T07:35:27Z

In another 20 or so years, in some documentary that will review why Google collapsed. They will present this GitHub Issue, to demonstrate Google's behavior towards paying users who just want to be treated.

In the meantime, they only have 10 more years left until this issue celebrates Bar Mitzvah.

lebenitza · 2024-02-19T14:43:35Z

Hey folks, thanks again for your patience! We are actively working on this feature! Stay tuned for updates.

Can we get an update on this? Maybe a separate issues at least with required steps that this change might need so at least we have an idea where to start, if one would want to implement this themselves.

A good documented workaround would also be nice in the meantime.

lahirumaramba · 2024-02-29T17:21:04Z

Hey folks, thank you again for your patience on this!

We have made progress on the credentials migration work and we have a custom build to share with you for testing purposes.

If you are interested in trying out the custom build and give us some feedback, please find the steps below!

Download the custom build from here (link updated)

You can use npm install to install the custom module

npm install path/to/firebase-admin-12.0.0.tgz

Or upload the custom build along with your test code and add the following in the package.json

  "dependencies": {
    "firebase-admin": "file:firebase-admin-12.0.0.tgz"
  }

NOTE: Use this custom build for testing purposes only! Do not use in production.

jars · 2024-03-07T17:48:49Z

We have made progress on the credentials migration work and we have a custom build to share with you for testing purposes.

It works for me, thanks for the patch and look forward to the release. 🎉

andrewmbenton · 2024-03-19T05:55:01Z

Hoping to see this resolved soon. Is there anything blocking merge and release for #2466?

balloman · 2024-04-21T15:25:36Z

Is there anything blocking #2466 , it hasn't had any activity for almost two months now?

mitchkoby · 2024-04-23T03:17:14Z

Also hoping for the release soon. Please provide an update.

thomasmburke added the type: feature request label Jul 15, 2021

google-oss-bot added the needs-triage label Jul 15, 2021

hiranya911 added api: auth and removed needs-triage labels Jul 16, 2021

This comment was marked as spam.

Sign in to view

lahirumaramba self-assigned this Jun 13, 2022

lahirumaramba mentioned this issue Oct 18, 2022

feat: Fix impersonated service account parsing exception #1862

Merged

lahirumaramba mentioned this issue Jan 25, 2023

[FR] Is it possible to use impersonated service account? #1861

Closed

kevinthecheung mentioned this issue Mar 1, 2023

Note that Firebase Admin Node.js SDK doesn't support WLIF google-github-actions/auth#268

Merged

lahirumaramba mentioned this issue Mar 10, 2023

quota_project_id ignored when loading local credentials file containing authorized_user credentials. #2106

Open

This was referenced May 1, 2023

[FR] Workload Identify Federation #2168

Closed

Auth does not work with ADC #2169

Closed

sethvargo mentioned this issue May 10, 2023

firebase deploy google-github-actions/auth#307

Closed

lahirumaramba removed the api: auth label Aug 9, 2023

lahirumaramba added the api: core label Aug 9, 2023

lahirumaramba linked a pull request Feb 29, 2024 that will close this issue

feat: Migrate credentials to use google-auth-library #2466

Draft

BenJackGill mentioned this issue Mar 16, 2024

What is the point? w9jds/firebase-action#221

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FR] Allow credential file type "external_account" when calling `admin.credential.applicationDefault()` #1377

[FR] Allow credential file type "external_account" when calling `admin.credential.applicationDefault()` #1377

thomasmburke commented Jul 15, 2021

google-oss-bot commented Jul 15, 2021

hiranya911 commented Jul 16, 2021

hiranya911 commented Jul 29, 2021 •

edited

This comment was marked as spam.

andrewmclagan commented Nov 30, 2022

Burekasim commented Dec 14, 2022

lhermann commented Feb 16, 2023

erik-induro commented Feb 28, 2023 •

edited

lahirumaramba commented Feb 28, 2023

Mistic92 commented Mar 13, 2023

enchorb commented Apr 30, 2023

jordanebelanger commented Jun 12, 2023 •

edited

gkawin commented Jun 23, 2023

erlichmen commented Jul 3, 2023 •

edited

dylanenabled commented Jul 4, 2023 •

edited

lox commented Aug 31, 2023

k2wanko commented Sep 17, 2023

theunlitshadow commented Oct 10, 2023

lox commented Oct 10, 2023

lahirumaramba commented Oct 12, 2023

josekasna commented Oct 24, 2023

breathe commented Oct 26, 2023 •

edited

lox commented Nov 10, 2023

rapuckett commented Dec 23, 2023

mitchkoby commented Feb 6, 2024

hdpz commented Feb 8, 2024

BenJackGill commented Feb 11, 2024

Burekasim commented Feb 11, 2024

lebenitza commented Feb 19, 2024

lahirumaramba commented Feb 29, 2024 •

edited

jars commented Mar 7, 2024

andrewmbenton commented Mar 19, 2024

balloman commented Apr 21, 2024

mitchkoby commented Apr 23, 2024

[FR] Allow credential file type "external_account" when calling admin.credential.applicationDefault() #1377

[FR] Allow credential file type "external_account" when calling admin.credential.applicationDefault() #1377

Comments

thomasmburke commented Jul 15, 2021

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Additional context

google-oss-bot commented Jul 15, 2021

hiranya911 commented Jul 16, 2021

hiranya911 commented Jul 29, 2021 • edited

This comment was marked as spam.

andrewmclagan commented Nov 30, 2022

Burekasim commented Dec 14, 2022

lhermann commented Feb 16, 2023

erik-induro commented Feb 28, 2023 • edited

lahirumaramba commented Feb 28, 2023

Mistic92 commented Mar 13, 2023

enchorb commented Apr 30, 2023

jordanebelanger commented Jun 12, 2023 • edited

gkawin commented Jun 23, 2023

erlichmen commented Jul 3, 2023 • edited

dylanenabled commented Jul 4, 2023 • edited

lox commented Aug 31, 2023

k2wanko commented Sep 17, 2023

theunlitshadow commented Oct 10, 2023

lox commented Oct 10, 2023

lahirumaramba commented Oct 12, 2023

josekasna commented Oct 24, 2023

breathe commented Oct 26, 2023 • edited

lox commented Nov 10, 2023

rapuckett commented Dec 23, 2023

mitchkoby commented Feb 6, 2024

hdpz commented Feb 8, 2024

BenJackGill commented Feb 11, 2024

Burekasim commented Feb 11, 2024

lebenitza commented Feb 19, 2024

lahirumaramba commented Feb 29, 2024 • edited

jars commented Mar 7, 2024

andrewmbenton commented Mar 19, 2024

balloman commented Apr 21, 2024

mitchkoby commented Apr 23, 2024

[FR] Allow credential file type "external_account" when calling `admin.credential.applicationDefault()` #1377

[FR] Allow credential file type "external_account" when calling `admin.credential.applicationDefault()` #1377

hiranya911 commented Jul 29, 2021 •

edited

erik-induro commented Feb 28, 2023 •

edited

jordanebelanger commented Jun 12, 2023 •

edited

erlichmen commented Jul 3, 2023 •

edited

dylanenabled commented Jul 4, 2023 •

edited

breathe commented Oct 26, 2023 •

edited

lahirumaramba commented Feb 29, 2024 •

edited