Support for creating custom tokens without service account credentials #175
Conversation
firebase_admin/_token_gen.py
Outdated
|
|
||
| # If the SDK was initialized with a service account email, use it with the IAM service | ||
| # to sign bytes. | ||
| service_account = self.app.options.get('service_account_id') |
There was a problem hiding this comment.
So we don't want them to be able to override the default GCE credentials?
There was a problem hiding this comment.
If this option is not specified, we fall back to discovering the serviceAccountId from the environment. So this is the case when a developer is overriding the default serviceAccountId with an explicitly specified one.
| return token_generator.create_custom_token(uid, developer_claims) | ||
|
|
||
| try: | ||
| return token_generator.create_custom_token(uid, developer_claims) |
There was a problem hiding this comment.
It looks like we are wrapping some calls with try catch (I assume because we now no longer assume that IAM calls work). How confident are you that you caught all the cases. This feels like it would be easy to miss one of these cases.
There was a problem hiding this comment.
IAM dependency is introduced with this PR. create_custom_token() is the only method that uses it.
| @@ -194,6 +198,61 @@ def test_noncert_credential(self, user_mgt_app): | |||
| with pytest.raises(ValueError): | |||
| auth.create_custom_token(MOCK_UID, app=user_mgt_app) | |||
|
|
|||
| def test_sign_with_iam(self): | |||
There was a problem hiding this comment.
None of these test exercise the new error cases you added, right?
There was a problem hiding this comment.
test_sign_with_iam_error below tests the failure case with a mock IAM error. I've added one more to emulate a service account ID discovery failure.
Currently the SDK must be initialized with service account credentials in order to be able to call FirebaseAuth.createCustomToken(). With this PR, the SDK will attempt to sign custom tokens by calling the IAM service in the cloud when the service account credentials are not provided.
go/firebase-admin-sign
go/firebase-admin-iam-sign