auth.create_user() not using application default credentials, gives 403

[firebase]

auth.create_user() not using application default credentials, gives 403

[crunk1]

Related: firebase/codelab-friendlychat-web#252

[crunk1]

It should be noted that project 764086051850 != my dev project. I've seen similar problems when the library requires a service account credentials file instead of accepting application default credentials (which is stupid :) IMO).

[hiranya911]

When running locally you must set up application default credentials (ADC) by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable. That's the only way to make this scenario work.

Identity toolkit backend API identifies the project based on the credential and credential only. When you use ADC locally without setting the environment variable, it will default to whatever project configured with the gcloud SDK.

[hiranya911]

It might also work if you just set the correct project in your gcloud config:

gcloud config set project <MY_PROJECT_ID>

Haven't tested this personally though.

[crunk1]

"Identity toolkit backend API identifies the project based on the credential and credential only."

I thought that would be the response. Do we have anything in the works to change that? Or is there a reason why we aren't?

[hiranya911]

The credential is sufficient to identify the project. You can (and should) continue to use Application Default Credentials (ADC) for this scenario, but when testing locally you must set up ADC via the environment variable. When deployed to the cloud (App Engine, Compute Engine), no service account file is needed and your code will just work without any changes.

There is probably a bug here where the backend API ignores the project ID set locally via the gcloud SDK (I tested this since my last comment, and no joy). It always defaults to 764086051850, whatever that is. I've created an internal bug for the Auth team to track that.

>>> import firebase_admin
>>> from firebase_admin import auth
>>> app = firebase_admin.initialize_app()
>>> app.credential.project_id
'xxxxxxxx-xx' # Prints the project ID set via gcloud SDK
>>> auth.get_user('foo')
Traceback (most recent call last):
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/firebase_admin/_user_mgt.py", line 241, in get_user
    response = self._request('post', 'getAccountInfo', json=payload)
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/firebase_admin/_user_mgt.py", line 372, in _request
    resp.raise_for_status()
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/requests/models.py", line 935, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://www.googleapis.com/identitytoolkit/v3/relyingparty/getAccountInfo

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/firebase_admin/auth.py", line 117, in get_user
    response = user_manager.get_user(uid=uid)
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/firebase_admin/_user_mgt.py", line 244, in get_user
    self._handle_http_error(INTERNAL_ERROR, msg, error)
  File "/Users/hkj/Projects/ml/env/lib/python3.6/site-packages/firebase_admin/_user_mgt.py", line 336, in _handle_http_error
    raise ApiCallError(code, msg, error)
firebase_admin._user_mgt.ApiCallError: Failed to get user by user ID: foo.
Server response: {
 "error": {
  "errors": [
   {
    "domain": "usageLimits",
    "reason": "accessNotConfigured",
    "message": "Access Not Configured. Google Identity Toolkit API has not been used in project 764086051850 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=764086051850 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
    "extendedHelp": "https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=764086051850"
   }
  ],
  "code": 403,
  "message": "Access Not Configured. Google Identity Toolkit API has not been used in project 764086051850 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=764086051850 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."
 }
} 

Notice the 764086051850 in the error, which is what you got as well. And the API has ignored the project ID set on the default credential. Hopefully, the Auth team will fix this, and then you will be able to avoid having to set the environment variable.

[hiranya911]

It turns out 764086051850 is a special project associated with the gcloud SDK itself. You will find this configured in the client_id field of ~/.config/gcloud/application_default_credentials.json (on Mac and Linux). When no service account is configured locally, the ADC obtains a token that is actually attached to this project. I don't think there's much the backend Auth team can do here, unless they decide to support specifying project ID via some other means.

[crunk1]

"The credential is sufficient to identify the project." I did try setting the gcloud project id as you suggested, to no avail. Couldn't it also be argued that specifying the project within the code (as we have done in my example) is sufficient to solve the ambiguity?

This is probably not a discussion for you and me, so sorry about pestering. I'd be happy to contribute to any discussion with the Auth team. I'm sad you said "internal bug"; I just left Google last month :( haha. Out of the club, haha.