Firebase authentication and authorization

[defrimhasani]

Hi everyone,

Wanted to ask if anyone has tried adding firebase authn & authz in a qurakus app? If yes, can you please point me to any valid resource?

Thanks,
Defrim

[sberyozkin]

Hi @defrimhasani I'll try to look at smallrye/smallrye-jwt#382 as soon as I can

[sberyozkin]

@defrimhasani I've finally had a chance to look a bit deeper into this issue. The answer has been found in this stacktrace post.

Specifically, all you need to do is to configure smallrye-jwt to point to the JWK store format:

https://www.googleapis.com/service_accounts/v1/jwk/[email protected].

If you have a Firebase ID token with a kid header then it will work. Can you try it ?

[md-consulting]

@sberyozkin Thank you for providing this answer. Curiously I found that after including Google API Gateway in the communication between Firebase and quarkus back-end (Google Cloud Run), this no longer seems to work.

Could you please check my question on StackOverflow?

(Everything worked before adding API Gateway the way you suggested it)

Thank you very much in advance and best regards

[sberyozkin]

@md-consulting Np, if I understand it correctly, the Gateway authenticates the token itself and then forwards the authentication results to the endpoint. Unless I'm mistaken, in this case you should register a custom factory accepting an already authenticated token:
https://quarkus.io/guides/security-jwt#custom-factories

You should probably configure smallrye-jwt to expect X-Apigateway-Api-Userinfo to keep a token

Can you try it please ?
Let me add the same comment in the SO question

[md-consulting]

Hi @sberyozkin,
That worked like a charm. I set mp.jwt.token.header=X-Apigateway-Api-Userinfo and created a custom JWTCallerPrincipalFactory. However I did not need to split the token before decoding (...token.split(*\\.*)[1] threw an error because the length of the array was 1), so I simply decoded the token without splitting.
Thank you very much!

[sberyozkin]

Sounds good, thanks @md-consulting