Firebase app distribution using account service not working if FIREBASE_TOKEN variable deleted

[bernat-gomez]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

1. Add firebase account service to the "Environment variables" section in the console

2. Configure the pipeline so the firebase distribution uses the previous account service instead of the firebase token

firebase:
firebase_service_account: $GOOGLE_APPLICATION_CREDENTIALS
android:
app_id: <some_android_app_id>
groups:
- <some_group_in_firebase_distr>
artifact_type: 'apk'

3. Delete the FIREBASE_TOKEN variable from the console, since it is no longer needed

4. Launch a new build

Expected results

Distribution successful to Firebase App Distribution

Actual results

Error when distributing:

Publishing failed :|
Failed to publish /Users/builder/clone/build/app/outputs/flutter-apk/app-release.apk to Firebase App Distribution:
Error: Failed to authenticate, have you run firebase login?

The error goes away if we restore the FIREBASE_TOKEN variable in the console. Either way, that makes no sense, since we are not using token anymore.

Build id (optional)

64ae803afe0df6462bc5e7eb

[kulakarla]

Hello @bernat-gomez,

I was not able to reproduce this. When I delete the token and use the service account, everything gets published to firebase.
I noticed in your code, you have firebase service account set as $GOOGLE_APPLICATION_CREDENTIALS.

firebase:
  firebase_service_account: $GOOGLE_APPLICATION_CREDENTIALS 
  android:
    app_id: <some_android_app_id>
    groups:
    - <some_group_in_firebase_distr>
    artifact_type: 'apk'

Maybe you have your variables and their names messed up in some way, try following the naming guide precisely like in the docs here and let me know if you are still having the issue.

[bernat-gomez]

Hi @kulakarla thanks for your response.

I would say that account service authorization falls back to token authorization whenever the account service is not properly configured (for instance, if it does not have the proper role). That's why some of my distributions failed after deleting the token in the console. In fact, it's a nice enhancement, though may it can be added to the docs.

If you want to give it a try, just follow the previous steps, but using an "incorrect" service account.

Thx!

Bernat

[kulakarla]

Hi @bernat-gomez

In the docs it's indeed mentioned that the service account for Firebase App Distribution must have the role of "Firebase App Distribution Admin", though it can be highlighted better. Will take into account the other notice too, thanks.

Nevertheless, I'm glad you got it working!

Best of luck!

[mjolnir91]

The docs are confusing on how to use a service account because they mention GOOGLE_APPLICATION_CREDENTIALS and ADC and then also mention using GCLOUD_SERVICE_ACCOUNT_CREDENTIALS if you have service account that is both for firebase app distribute and publishing to goolge play. And then the documentation shows in the example: firebase_service_account: $FIREBASE_SERVICE_ACCOUNT.

I got the same error as the OP and the documentation is unclear what the difference between GOOGLE_APPLICATION_CREDENTIALS, GCLOUD_SERVICE_ACCOUNT_CREDENTIALS is. If there is a difference how to make the GOOGLE_APPLICATION_CREDENTIALS and set them up in codemagic and use them in the .yaml config file?

I have a service account with all the appropriate permissons and I got the key.json for it and copied it into a secured variables named GOOGLE_APPLICATION_CREDENTIALS, GCLOUD_SERVICE_ACCOUNT_CREDENTIALS so both have it. Neither works.

[kulakarla]

@mjolnir91

I will take a look at the docs, thank you for the feedback.
As for your situation, set up 2 environment variables:
FIREBASE_SERVICE_ACCOUNT, value = Service account JSON key contents, group = firebase_credentials
GOOGLE_APPLICATION_CREDENTIALS, value = $CM_BUILD_DIR/firebase_credentials.json, group = firebase_credentials

Under environment, import the variable group firebase_credentials. After that, you can just follow the YAML template here.

[mjolnir91]

YAML FILE:
example.txt

I did exactly as you said. Still getting login error.

FIREBASE_SERVICE_ACCOUNT, value = Service account JSON key contents, group = firebase_credentials
GOOGLE_APPLICATION_CREDENTIALS, value = $CM_BUILD_DIR/firebase_credentials.json, group = firebase_credentials

[bernat-gomez]

Hi @mjolnir91,

a few things you can try to narrow down the issue:

1. You can use this script to rule out issues with the service account. You will have to set the value for the PACKAGE_NAME, GOOGLE_PLAY_TRACK and GCLOUD_SERVICE_ACCOUNT_CREDENTIALS variables.

If the account is properly configured, you should be able to retrieve latest build number for instance:

`
#!/bin/sh

# Usage
#./test_store.sh

PACKAGE_NAME='some_package'
GOOGLE_PLAY_TRACK='alpha'
GCLOUD_SERVICE_ACCOUNT_CREDENTIALS='{
"type": "service_account",
"project_id": ...
}'
ENCODED=$(echo -n "$GCLOUD_SERVICE_ACCOUNT_CREDENTIALS" | base64)

echo $PACKAGE_NAME
echo $GOOGLE_PLAY_TRACK
echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
echo $ENCODED

if ! command -v python3 &> /dev/null; then
echo "Python is not installed. Installing Python..."

sudo apt update
sudo apt install python3

else
echo "Python is already installed."
fi

if ! command -v python3 &> /dev/null; then
echo "Python 3 is required to install codemagic-cli-tools"
exit 1
fi

if ! python3 -m pip show codemagic-cli-tools &> /dev/null; then
echo "Installing codemagic-cli-tools..."
python3 -m pip install codemagic-cli-tools
else
echo "codemagic-cli-tools is already installed"
fi

BUILD_NUMBER=$(($(google-play get-latest-build-number --credentials "$GCLOUD_SERVICE_ACCOUNT_CREDENTIALS" --package-name "$PACKAGE_NAME" --tracks="$GOOGLE_PLAY_TRACK") + 1))

echo $BUILD_NUMBER
`

If the script works, then service account is definitely ok, so the issue has to do with codemagic.yaml configuration

2. If you add the firebase_token variable to codemagic console, does it work then? If so, it means that service account, when failing, falls back to authentication with token. Either way, this is only a workaround, since token will be deprecated soon.

Hope it sheds some light

[mjolnir91]

Thank you everyone I got it working. My key was just out of date. However, I'm still confused what the purose of the below step is since my config is working without it.

      - name: Decode Google credentials
        script: | 
          echo $FIREBASE_SERVICE_ACCOUNT > $GOOGLE_APPLICATION_CREDENTIALS