FirbaseAdmin.Auth().verifyIdToken not tenant aware

Aperta

#2,803 aperta il 6/12/2024 1 commento 1 reazione 1 assegnatario Vedi su GitHub

@Xiaoshouzi-gh ci sta già lavorando.

Dal 19/12/2024.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

api: auth

Operating System version: run.googleapis.com (linux)
Firebase SDK version: 5.1.0
Firebase Product: Admin auth
Node.js version: 20
NPM version: 10.8.2

Verify id tokens in firebase functions will fail when using tenants in Google Identity platform

Steps to reproduce:

1 Create a app in Firebase and enable google identitiy platform.
2 Add tenant to identities platform
3 Add user to tenant
4 Log into app using user and tenant id
5 call google function from app
6 in function attempt to verify id token with FirebaseAdmin.auth().verifyIdToken('tokenString')

error
Error: There is no user record corresponding to the provided identifier.

Relevant Code:

  var token = await admin.auth() .verifyIdToken(req.rawRequest.header('Authorization').substring(7),true);

I could use the TenantAuth but to get that I would need the TennantId which is in the token, which you can access by verifying the token but like I said you need to know the tenant for that. I could manually scrape the tenantId from the jet by parsing it myself but then I have to hard code its location in the jwt firebase attribute with could change.

    var tenantAuth = await admin.auth().tenantManager().authForTenant(token.firebase.tenant);
    var token = await tenantAuth.verifyIdToken(req.rawRequest.header('Authorization').substring(7),true);

Expected functionality would be that it detect the presence of a tenant in the firebase attribute and attempt to get the correct tenantAuth instance and use that to verify.

Lingua principale: TypeScript
Stelle: 1.7k
Fork: 419
Merge medio: 4g 20h
PR unite (30g): 16

Guida per i contributori

Apri la guida per i contributori

Come iniziare

Leggi tutta la issue e poi la guida ai contributi del progetto.
Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
Fai un fork del repository e lavora su un branch.
Apri una pull request che faccia riferimento al numero della issue.