Add support for R-GCIP tenant configuration #14979

srushtisv · 2025-06-13T19:29:19Z

Description

This PR introduces support for Regional GCIP (R-GCIP) within the Firebase Auth iOS SDK. Developers can now initialize an Auth instance tied to a specific tenant ID and location.

The key changes are:

New TenantConfig Struct: A Sendable struct TenantConfig has been added to hold the tenantId and location (defaulting to "prod-global").
New Auth Factory Method: A new static method Auth.auth(app: FirebaseApp, tenantConfig: TenantConfig) allows initialization with R-GCIP parameters.
Updated AuthRequestConfiguration: The internal AuthRequestConfiguration class now includes location and tenantId properties, populated during initialization if a TenantConfig is provided.

These changes enable applications to work with regionalized Firebase Authentication backends.

Changelog

[FirebaseAuth] - Added support for Regional GCIP (R-GCIP) by introducing TenantConfig and a new Auth initializer to specify tenant ID and location.

gemini-code-assist · 2025-06-13T19:29:23Z

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

google-oss-bot · 2025-06-13T19:30:32Z

	1 Warning
⚠️	Did you forget to add a changelog entry? (Add #no-changelog to the PR description to silence this warning.)

Generated by 🚫 Danger

FirebaseAuth/Sources/Swift/Auth/Auth.swift

ncooke3 · 2025-06-18T02:46:50Z

FirebaseAuth/Sources/Swift/Auth/Auth.swift

@@ -140,6 +140,22 @@ extension Auth: AuthInterop {
  }
 }

+/// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.
+public struct TenantConfig: Sendable {


Because this type is defined within class Auth { ... }, clients outside the module would access it like:

let tenant = Auth.TenantConfig(...)

I was thinking this should be moved into the top-level scope of the module, WDYT?

The latest refactoring doesn't move it outside of the Auth scope. I'll make a suggestion below that demonstrates.

FirebaseAuth/Sources/Swift/Auth/Auth.swift

pashanka · 2025-06-19T06:36:15Z

FirebaseAuth/Sources/Swift/Auth/Auth.swift

@@ -140,6 +140,22 @@ extension Auth: AuthInterop {
  }
 }

+/// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.
+public struct TenantConfig: Sendable {


FirebaseAuth/Sources/Swift/Auth/Auth.swift

pashanka · 2025-06-19T06:40:20Z

FirebaseAuth/Sources/Swift/Backend/AuthRequestConfiguration.swift

+  /// The Regional Google Cloud Identity Platform (R-GCIP) location.
+  /// This is set when the `Auth` instance is initialized with a `TenantConfig`.
+  var location: String?
+
+  /// The Regional Google Cloud Identity Platform (R-GCIP) tenant ID.
+  /// This is set when the `Auth` instance is initialized with a `TenantConfig`.
+  var tenantId: String?
+


Can we not have this as TenantConfig type instead of splitting them separately? Any reason to keep it separate? Ideally these should not be separately set by themselves, so IMO we should not keep it separate.

Sure Pavan, addressed this change in recent commit

… tenant properties

ncooke3 · 2025-06-24T22:23:50Z

FirebaseAuth/Sources/Swift/Auth/Auth.swift

+/// Regionalized auth
+@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
+public extension Auth {
+  /// Gets the Auth object for a `FirebaseApp` configured for a specific Regional Google Cloud
+  /// Identity Platform (R-GCIP) tenant.
+  ///
+  /// Use this method to create an `Auth` instance that interacts with a regionalized
+  /// authentication backend instead of the default endpoint.
+  ///
+  /// - Parameters:
+  ///   - app: The Firebase app instance.
+  ///   - tenantConfig: The configuration for the R-GCIP tenant, specifying the tenant ID and its
+  /// location.
+  /// - Returns: The `Auth` instance associated with the given app and tenant config.
+  static func auth(app: FirebaseApp, tenantConfig: TenantConfig) -> Auth {
+    return Auth(app: app, tenantConfig: tenantConfig)
+  }
+
+  /// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.
+  struct TenantConfig: Sendable {
+    public let tenantId: String
+    public let location: String
+
+    /// Initializes a `TenantConfig` instance.
+    ///
+    /// - Parameters:
+    ///   - tenantId: The ID of the tenant.
+    ///   - location: The location of the tenant. Defaults to "prod-global".
+    public init(tenantId: String, location: String = "prod-global") {
+      self.location = location
+      self.tenantId = tenantId
+    }
+  }
+}


Suggested change

/// Regionalized auth

@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)

public extension Auth {

/// Gets the Auth object for a `FirebaseApp` configured for a specific Regional Google Cloud

/// Identity Platform (R-GCIP) tenant.

///

/// Use this method to create an `Auth` instance that interacts with a regionalized

/// authentication backend instead of the default endpoint.

///

/// - Parameters:

/// - app: The Firebase app instance.

/// - tenantConfig: The configuration for the R-GCIP tenant, specifying the tenant ID and its

/// location.

/// - Returns: The `Auth` instance associated with the given app and tenant config.

static func auth(app: FirebaseApp, tenantConfig: TenantConfig) -> Auth {

return Auth(app: app, tenantConfig: tenantConfig)

}

/// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.

struct TenantConfig: Sendable {

public let tenantId: String

public let location: String

/// Initializes a `TenantConfig` instance.

///

/// - Parameters:

/// - tenantId: The ID of the tenant.

/// - location: The location of the tenant. Defaults to "prod-global".

public init(tenantId: String, location: String = "prod-global") {

self.location = location

self.tenantId = tenantId

}

}

}

// MARK: - Regionalized Auth

/// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.

public struct TenantConfig: Sendable {

public let tenantId: String

public let location: String

/// Initializes a `TenantConfig` instance.

///

/// - Parameters:

/// - tenantId: The ID of the tenant.

/// - location: The location of the tenant. Defaults to "prod-global".

public init(tenantId: String, location: String = "prod-global") {

self.location = location

self.tenantId = tenantId

}

}

/// Regionalized auth

@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)

public extension Auth {

/// Gets the Auth object for a `FirebaseApp` configured for a specific Regional Google Cloud

/// Identity Platform (R-GCIP) tenant.

///

/// Use this method to create an `Auth` instance that interacts with a regionalized

/// authentication backend instead of the default endpoint.

///

/// - Parameters:

/// - app: The Firebase app instance.

/// - tenantConfig: The configuration for the R-GCIP tenant, specifying the tenant ID and its

/// location.

/// - Returns: The `Auth` instance associated with the given app and tenant config.

static func auth(app: FirebaseApp, tenantConfig: TenantConfig) -> Auth {

return Auth(app: app, tenantConfig: tenantConfig)

}

}

@srushtisv Can we do this change as suggested by Nick?

Sure Pavan, commiting suggestion. Thankyou Nick.

ncooke3

LGTM with the one code suggestion above.

pashanka

LGTM, apart from one comment.

pashanka · 2025-06-25T07:47:56Z

FirebaseAuth/Sources/Swift/Auth/Auth.swift

+/// Regionalized auth
+@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
+public extension Auth {
+  /// Gets the Auth object for a `FirebaseApp` configured for a specific Regional Google Cloud
+  /// Identity Platform (R-GCIP) tenant.
+  ///
+  /// Use this method to create an `Auth` instance that interacts with a regionalized
+  /// authentication backend instead of the default endpoint.
+  ///
+  /// - Parameters:
+  ///   - app: The Firebase app instance.
+  ///   - tenantConfig: The configuration for the R-GCIP tenant, specifying the tenant ID and its
+  /// location.
+  /// - Returns: The `Auth` instance associated with the given app and tenant config.
+  static func auth(app: FirebaseApp, tenantConfig: TenantConfig) -> Auth {
+    return Auth(app: app, tenantConfig: tenantConfig)
+  }
+
+  /// Holds configuration for a Regional Google Cloud Identity Platform (R-GCIP) tenant.
+  struct TenantConfig: Sendable {
+    public let tenantId: String
+    public let location: String
+
+    /// Initializes a `TenantConfig` instance.
+    ///
+    /// - Parameters:
+    ///   - tenantId: The ID of the tenant.
+    ///   - location: The location of the tenant. Defaults to "prod-global".
+    public init(tenantId: String, location: String = "prod-global") {
+      self.location = location
+      self.tenantId = tenantId
+    }
+  }
+}


@srushtisv Can we do this change as suggested by Nick?

…14981)

srushtisv self-assigned this Jun 13, 2025

google-oss-bot added the api: auth label Jun 13, 2025

srushtisv requested a review from pashanka June 16, 2025 07:52

srushtisv marked this pull request as ready for review June 16, 2025 07:52

srushtisv requested a review from ncooke3 June 16, 2025 07:56

ncooke3 approved these changes Jun 18, 2025

View reviewed changes

ncooke3 reviewed Jun 18, 2025

View reviewed changes

FirebaseAuth/Sources/Swift/Auth/Auth.swift Outdated Show resolved Hide resolved

pashanka requested changes Jun 19, 2025

View reviewed changes

srushtisv requested review from pashanka and ncooke3 June 23, 2025 21:09

srushtisv added 5 commits June 24, 2025 03:31

Add support for R-GCIP tenant configuration

47261fb

Moving TenantConfig to (regionalized) auth extension

5515e6f

Adding tenantConfig in AuthRequestConfiguration instead of individual…

391eebb

… tenant properties

updating static factory method

f8753b1

add missing availability to regional Auth extension

bd95317

srushtisv force-pushed the auth-rgcip branch from 8a9e6a6 to bd95317 Compare June 23, 2025 22:01

ncooke3 reviewed Jun 24, 2025

View reviewed changes

ncooke3 approved these changes Jun 24, 2025

View reviewed changes

pashanka approved these changes Jun 25, 2025

View reviewed changes

srushtisv added 5 commits June 26, 2025 20:36

Add internal support for regionalized OIDC token exchange (BYO-CIAM) (#…

ffb6302

…14981)

moving tenantConfig outside Auth

0ebd25b

lint fixes

ae947bc

fixing failed checks

b995a69

fixing failed check

c3f05d1

srushtisv merged commit 3da5a6d into byociam-sv Jun 26, 2025
53 checks passed

srushtisv deleted the auth-rgcip branch June 26, 2025 20:34

Add support for R-GCIP tenant configuration #14979

Add support for R-GCIP tenant configuration #14979

Uh oh!

Conversation

srushtisv commented Jun 13, 2025

Description

Changelog

Uh oh!

gemini-code-assist bot commented Jun 13, 2025

Uh oh!

google-oss-bot commented Jun 13, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ncooke3 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pashanka left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ncooke3 left a comment •

edited

Loading