forked from bamnet/firebase-admin-go
-
Notifications
You must be signed in to change notification settings - Fork 0
/
auth.go
269 lines (244 loc) · 8.93 KB
/
auth.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
// Copyright 2017 Google Inc. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Package auth contains functions for minting custom authentication tokens, and verifying Firebase ID tokens.
package auth
import (
"crypto/rsa"
"crypto/x509"
"encoding/json"
"encoding/pem"
"errors"
"fmt"
"strings"
"firebase.google.com/go/internal"
"golang.org/x/net/context"
"google.golang.org/api/transport"
)
const firebaseAudience = "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit"
const googleCertURL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
const idToolKitURL = "https://www.googleapis.com/identitytoolkit/v3/relyingparty/"
const issuerPrefix = "https://securetoken.google.com/"
const tokenExpSeconds = 3600
var reservedClaims = []string{
"acr", "amr", "at_hash", "aud", "auth_time", "azp", "cnf", "c_hash",
"exp", "firebase", "iat", "iss", "jti", "nbf", "nonce", "sub",
}
var clk clock = &systemClock{}
// Token represents a decoded Firebase ID token.
//
// Token provides typed accessors to the common JWT fields such as Audience (aud) and Expiry (exp).
// Additionally it provides a UID field, which indicates the user ID of the account to which this token
// belongs. Any additional JWT claims can be accessed via the Claims map of Token.
type Token struct {
Issuer string `json:"iss"`
Audience string `json:"aud"`
Expires int64 `json:"exp"`
IssuedAt int64 `json:"iat"`
Subject string `json:"sub,omitempty"`
UID string `json:"uid,omitempty"`
Claims map[string]interface{} `json:"-"`
}
// Client is the interface for the Firebase auth service.
//
// Client facilitates generating custom JWT tokens for Firebase clients, and verifying ID tokens issued
// by Firebase backend services.
type Client struct {
hc *internal.HTTPClient
ks keySource
projectID string
snr signer
url string
version string
}
type signer interface {
Email() (string, error)
Sign(b []byte) ([]byte, error)
}
// NewClient creates a new instance of the Firebase Auth Client.
//
// This function can only be invoked from within the SDK. Client applications should access the
// the Auth service through firebase.App.
func NewClient(ctx context.Context, c *internal.AuthConfig) (*Client, error) {
var (
err error
email string
pk *rsa.PrivateKey
)
if c.Creds != nil && len(c.Creds.JSON) > 0 {
var svcAcct struct {
ClientEmail string `json:"client_email"`
PrivateKey string `json:"private_key"`
}
if err := json.Unmarshal(c.Creds.JSON, &svcAcct); err != nil {
return nil, err
}
if svcAcct.PrivateKey != "" {
pk, err = parseKey(svcAcct.PrivateKey)
if err != nil {
return nil, err
}
}
email = svcAcct.ClientEmail
}
var snr signer
if email != "" && pk != nil {
snr = serviceAcctSigner{email: email, pk: pk}
} else {
snr, err = newSigner(ctx)
if err != nil {
return nil, err
}
}
hc, _, err := transport.NewHTTPClient(ctx, c.Opts...)
if err != nil {
return nil, err
}
return &Client{
hc: &internal.HTTPClient{Client: hc},
ks: newHTTPKeySource(googleCertURL, hc),
projectID: c.ProjectID,
snr: snr,
url: idToolKitURL,
version: "Go/Admin/" + c.Version,
}, nil
}
// Passes the request struct, returns a byte array of the json
func (c *Client) makeHTTPCall(ctx context.Context, serviceName string, payload interface{}, result interface{}) error {
versionHeader := internal.WithHeader("X-Client-Version", c.version)
request := &internal.Request{
Method: "POST",
URL: c.url + serviceName,
Body: internal.NewJSONEntity(payload),
Opts: []internal.HTTPOption{versionHeader},
}
resp, err := c.hc.Do(ctx, request)
if err != nil {
return err
}
return resp.Unmarshal(200, result)
}
// CustomToken creates a signed custom authentication token with the specified user ID. The resulting
// JWT can be used in a Firebase client SDK to trigger an authentication flow. See
// https://firebase.google.com/docs/auth/admin/create-custom-tokens#sign_in_using_custom_tokens_on_clients
// for more details on how to use custom tokens for client authentication.
func (c *Client) CustomToken(uid string) (string, error) {
return c.CustomTokenWithClaims(uid, nil)
}
// CustomTokenWithClaims is similar to CustomToken, but in addition to the user ID, it also encodes
// all the key-value pairs in the provided map as claims in the resulting JWT.
func (c *Client) CustomTokenWithClaims(uid string, devClaims map[string]interface{}) (string, error) {
iss, err := c.snr.Email()
if err != nil {
return "", err
}
if len(uid) == 0 || len(uid) > 128 {
return "", errors.New("uid must be non-empty, and not longer than 128 characters")
}
var disallowed []string
for _, k := range reservedClaims {
if _, contains := devClaims[k]; contains {
disallowed = append(disallowed, k)
}
}
if len(disallowed) == 1 {
return "", fmt.Errorf("developer claim %q is reserved and cannot be specified", disallowed[0])
} else if len(disallowed) > 1 {
return "", fmt.Errorf("developer claims %q are reserved and cannot be specified", strings.Join(disallowed, ", "))
}
now := clk.Now().Unix()
payload := &customToken{
Iss: iss,
Sub: iss,
Aud: firebaseAudience,
UID: uid,
Iat: now,
Exp: now + tokenExpSeconds,
Claims: devClaims,
}
return encodeToken(c.snr, defaultHeader(), payload)
}
// VerifyIDToken verifies the signature and payload of the provided ID token.
//
// VerifyIDToken accepts a signed JWT token string, and verifies that it is current, issued for the
// correct Firebase project, and signed by the Google Firebase services in the cloud. It returns
// a Token containing the decoded claims in the input JWT. See
// https://firebase.google.com/docs/auth/admin/verify-id-tokens#retrieve_id_tokens_on_clients for
// more details on how to obtain an ID token in a client app.
func (c *Client) VerifyIDToken(idToken string) (*Token, error) {
if c.projectID == "" {
return nil, errors.New("project id not available")
}
if idToken == "" {
return nil, fmt.Errorf("ID token must be a non-empty string")
}
h := &jwtHeader{}
p := &Token{}
if err := decodeToken(idToken, c.ks, h, p); err != nil {
return nil, err
}
projectIDMsg := "Make sure the ID token comes from the same Firebase project as the credential used to" +
" authenticate this SDK."
verifyTokenMsg := "See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to " +
"retrieve a valid ID token."
issuer := issuerPrefix + c.projectID
var err error
if h.KeyID == "" {
if p.Audience == firebaseAudience {
err = fmt.Errorf("VerifyIDToken() expects an ID token, but was given a custom token")
} else {
err = fmt.Errorf("ID token has no 'kid' header")
}
} else if h.Algorithm != "RS256" {
err = fmt.Errorf("ID token has invalid incorrect algorithm. Expected 'RS256' but got %q. %s",
h.Algorithm, verifyTokenMsg)
} else if p.Audience != c.projectID {
err = fmt.Errorf("ID token has invalid 'aud' (audience) claim. Expected %q but got %q. %s %s",
c.projectID, p.Audience, projectIDMsg, verifyTokenMsg)
} else if p.Issuer != issuer {
err = fmt.Errorf("ID token has invalid 'iss' (issuer) claim. Expected %q but got %q. %s %s",
issuer, p.Issuer, projectIDMsg, verifyTokenMsg)
} else if p.IssuedAt > clk.Now().Unix() {
err = fmt.Errorf("ID token issued at future timestamp: %d", p.IssuedAt)
} else if p.Expires < clk.Now().Unix() {
err = fmt.Errorf("ID token has expired. Expired at: %d", p.Expires)
} else if p.Subject == "" {
err = fmt.Errorf("ID token has empty 'sub' (subject) claim. %s", verifyTokenMsg)
} else if len(p.Subject) > 128 {
err = fmt.Errorf("ID token has a 'sub' (subject) claim longer than 128 characters. %s", verifyTokenMsg)
}
if err != nil {
return nil, err
}
p.UID = p.Subject
return p, nil
}
func parseKey(key string) (*rsa.PrivateKey, error) {
block, _ := pem.Decode([]byte(key))
if block == nil {
return nil, fmt.Errorf("no private key data found in: %v", key)
}
k := block.Bytes
parsedKey, err := x509.ParsePKCS8PrivateKey(k)
if err != nil {
parsedKey, err = x509.ParsePKCS1PrivateKey(k)
if err != nil {
return nil, fmt.Errorf("private key should be a PEM or plain PKSC1 or PKCS8; parse error: %v", err)
}
}
parsed, ok := parsedKey.(*rsa.PrivateKey)
if !ok {
return nil, errors.New("private key is not an RSA key")
}
return parsed, nil
}