Firebase Auth - list of users by Custom Claims

Question

We're using Custom Claims in Firebase Auth to manage access in Firebase and allow custom UI experience.

We're now working on the User Admin part and we can't find a way to retrieve users by the custom claims.

For example, a user belongs to an organisation and have different access level - admin or user. We need to allow the organisation's admin to see all their organisation's users.

We'd like to avoid using a separate database to manage organisation users to not double up the data.

Is it possible? Can we retrieve all Auth users while filtering them by specific Custom Claim?

Thanks!

How did you solve this? Did you save that information in your database and kept it all in sync with your user's customClaims ? Like, every time you set `admin: true` to one of your users, you would go and save his `userId` under an `admin` node/collection in your database? Something like that? Or did you think of something better? Thanks. — cbdeveloper, Feb 27 '19 at 17:57
For now, we just load the entire users' list and filter it by the required claims. But as the list will grow, we'll probably add a doubling DB table. — xims, Feb 27 '19 at 22:30

score 17 · Accepted Answer · answered Oct 20 '18 at 14:21

17

There is no built-in API to get a list of all users that have a specific claim.

There is an API to get a list of all users in the Admin SDK. So you could use that and then filter the users that have the claim you're looking for.

But performance of this will not be spectacular. So if listing all users with a specific claim is a common use-case for your app, you'll want to reconsider your concern about using an additional place to store the data. Duplicating data to achieve (well performing) use-cases is quite common in NoSQL.

answered Oct 20 '18 at 14:21

Frank van Puffelen

565,676
79
828
807

1

Is there a way to inspect (using the Firebase console) the claims that have been set for a specific user? – cbdeveloper Feb 27 '19 at 17:53
1

You can do it with a function. const user = await admin.auth().getUserByEmail(email); if (user.customClaims) { console.log(user.customClaims) } @cbdeveloper – FabricioG Nov 21 '19 at 08:13
is this still true? – Johnny Nov 08 '21 at 18:42
Yes. If there was a new API that allows getting only users with a specific claim, it'd be mentioned in the documentation I linked in my answer. – Frank van Puffelen Nov 08 '21 at 18:55
This solution performs well, and might be of interest: https://stackoverflow.com/a/71255525/12763464 – Nils Heumer Feb 28 '22 at 11:19

Firebase Auth - list of users by Custom Claims

1 Answers1

Linked