Error when serving Firebase functions on localhost in combination with Firebase Auth

[arthurvi]

When serving a Firebase Functions on localhost, Firebase Auth does not work. When running the same code on "the cloud", it produces no errors.

We initialize the Firebase Admin SDK as follows: admin.initializeApp(functions.config().firebase);

Version info

3.16.0

Steps to reproduce

Run firebase serve --only functions
Create a functions that uses admin.auth().createUser

Expected behavior

It creates a user in the Firebase Authentication module without errors.

Actual behavior

error: { Error: Credential implementation provided to initializeApp() via the "credential" property has insufficient permission to access the requested resource. See https://firebase.google.com/docs/admin/setup for details on how to authenticate this SDK with appropriate permissions.
    at FirebaseAuthError.FirebaseError [as constructor] (/Users/frank/Development/planl/formagic-server/functions/node_modules/firebase-admin/lib/utils/error.js:39:28)
    at FirebaseAuthError.PrefixedFirebaseError [as constructor] (/Users/frank/Development/planl/formagic-server/functions/node_modules/firebase-admin/lib/utils/error.js:85:28)
    at new FirebaseAuthError (/Users/frank/Development/planl/formagic-server/functions/node_modules/firebase-admin/lib/utils/error.js:143:16)
    at Function.FirebaseAuthError.fromServerError (/Users/frank/Development/planl/formagic-server/functions/node_modules/firebase-admin/lib/utils/error.js:173:16)
    at /Users/frank/Development/planl/formagic-server/functions/node_modules/firebase-admin/lib/auth/auth-api-request.js:523:45
    at <anonymous>
    at process._tickCallback (internal/process/next_tick.js:160:7)
  errorInfo:
   { code: 'auth/insufficient-permission',
     message: 'Credential implementation provided to initializeApp() via the "credential" property has insufficient permission to access the requested resource. See https://firebase.google.com/docs/admin/setup for details on how to authenticate this SDK with appropriate permissions.' },
  codePrefix: 'auth' }

[laurenzlong]

Thanks for filing! This is a known issue that will take some time to address. In the meanwhile, I recommend initializing firebase-admin with a service account key. See https://firebase.google.com/docs/admin/setup#initialize_the_sdk

[Bringoff]

Hello. I'm wondering how's the progress with this issue?

[laurenzlong]

We have documented how to do this: https://firebase.google.com/docs/functions/local-emulator#set_up_admin_credentials_optional

[cjmling]

Initializing with service account key as mentioned above still giving me the same error.

[laurenzlong]

@cjmling Please double check that the project that you downloaded the service account key from actually has auth enabled (you do this from the Firebase Console)

[mparpaillon]

@laurenzlong I've followed the instructions and made sure the envvar "GOOGLE_APPLICATION_CREDENTIALS " was declared but still getting the issue. Something I'm missing ? Thanks

[hurungang]

manage to get it working differently in cmd and powershell

cmd

set GOOGLE_APPLICATION_CREDENTIALS=src/serviceAccountKey.json
firebase functions:shell

firebase > getUsers.post('').json({data:null});

Powershell

$Env:GOOGLE_APPLICATION_CREDENTIALS = "src/serviceAccountKey.json"
firebase functions:shell

firebase > getUsers.post('').json({data:null});

Notice that path is relative path to where you run the command.

[thechenky]

Closing this out since there is a documented way to set this up. Please file a new issue if you are experiencing any other problems. Thanks!

[matheo]

@laurenzlong for some weird reason, my GOOGLE_APPLICATION_CREDENTIALS env var is empty (checking it from my Firebase Function, perhaps the absolute path looks ok from my ubuntu console when I print it via echo $GOOGLE_APPLICATION_CREDENTIALS.

I am missing something?
Something related to node > 8 messing this up?

[samtstern]

Are you on the latest version of the CLI? That issue sounds like the one that was fixed here: #1340

…

On Mon, Jun 10, 2019, 6:03 PM Mateo Tibaquirá ***@***.***> wrote: @laurenzlong <https://github.com/laurenzlong> for some weird reason, my GOOGLE_APPLICATION_CREDENTIALS env var is empty (checking it from my Firebase Function, perhaps the absolute path looks ok from my ubuntu console when I print it via echo $GOOGLE_APPLICATION_CREDENTIALS. I am missing something? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#595?email_source=notifications&email_token=ACATB2S45QAYTRLCOUFH5XLPZ32XBA5CNFSM4ELEV6ZKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXLUGAQ#issuecomment-500646658>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACATB2WSXUTMOBGRZN2ZJG3PZ32XBANCNFSM4ELEV6ZA> .

[matheo]

@samtstern yeah, I'm using v6.11.0. That fix seems related to emulators:exec.

I'm trying to run emulators:start and it's not loading my account-key json, stored at the GOOGLE_APPLICATION_CREDENTIALS env var. I wonder if there's something to do with the node version, but I cannot execute it with Node 8 because the latest Angular requires Node 10+.

[samtstern]

@matheo is it just this one variable or is your process.env not populated properly inside your functions?

[matheo]

@samtstern I just printed another one, like NVM_BIN and printed the path correctly.
In the other hand, I'm able to echo $GOOGLE_APPLICATION_CREDENTIALS in the CLI (it's an absolute path outside the project folder), but the var is empty inside the function. So I'm not able to load firebase-admin with the account-key JSON file and I'm getting:

Credential implementation provided to initializeApp() via the "credential"
property failed to fetch a valid Google OAuth2 access token with the following error:
"Error fetching access token: Error while making request:
getaddrinfo ENOTFOUND metadata.google.internal metadata.google.internal:80.
Error code: ENOTFOUND".

Note that I'm following these instructions https://firebase.google.com/docs/functions/local-emulator#set_up_admin_credentials_optional, and I've tried many things to initialize the firebase-admin with no joy, and I'm printing the empty GOOGLE_APPLICATION_CREDENTIALS just before my code:

admin.initializeApp({
  credential: admin.credential.applicationDefault(),
  databaseURL: 'https://<DATABASE_NAME>.firebaseio.com'
});

https://firebase.google.com/docs/admin/setup#initialize_the_sdk

The firebase-CLI is reporting

i  functions: Beginning execution of "UsersList"
i  Your code has been provided a "firebase-admin" instance.
i  functions: Finished "UsersList" in ~1s

but the response is the mentioned ENOTFOUND error:

>  { Error: Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "Error fetching access token: Error while making request: getaddrinfo ENOTFOUND metadata.google.internal metadata.google.internal:80. Error code: ENOTFOUND".
>      at FirebaseAppError.FirebaseError [as constructor] (/dist/functions/node_modules/firebase-admin/lib/utils/error.js:42:28)
>      at FirebaseAppError.PrefixedFirebaseError [as constructor] (/dist/functions/node_modules/firebase-admin/lib/utils/error.js:88:28)
>      at new FirebaseAppError (/dist/functions/node_modules/firebase-admin/lib/utils/error.js:122:28)
>      at /dist/functions/node_modules/firebase-admin/lib/firebase-app.js:121:23
>      at process._tickCallback (internal/process/next_tick.js:68:7)
>    errorInfo:
>     { code: 'app/invalid-credential',
>       message:
>        'Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "Error fetching access token: Error while making request: getaddrinfo ENOTFOUND metadata.google.internal metadata.google.internal:80. Error code: ENOTFOUND".' },
>    codePrefix: 'app' }

[matheo]

@samtstern I found it!
https://github.com/firebase/firebase-tools/pull/1252/files/882b9e6f658aa0fad943217ff06081c872a900fe#diff-8325e765bfd80d890325d78e645da32d

The protect_env feature is enabled for serve and it's sole purpose is to:

function ProtectEnvironmentalVariables() {
    process.env.GOOGLE_APPLICATION_CREDENTIALS = "";
}

so the documentation and the solution pointed out by @laurenzlong previously, doesn't work with this feature. Is there a way to disable it from my config?

[yairopro]

Another solution:
#1708 (comment)