Is it possible to initialize the Firebase Admin SDK with an impersonated service account?

Question

I'm trying to build a system where I can access the Firestore database in another Google Cloud project by impersonating a service account that has access to that project's Firestore database using generating short-lived access tokens instead of service account keys for a more secure integration. When I try to use this kind of credential I get the following error:

Must initialize the SDK with a certificate credential or application default credentials to use Cloud Firestore API.

I'm wondering if I'm missing something here because it seems weird to me that it's just impossible to access Firestore with an impersonated account.

Thanks!

Answer 1

Just had a similar problem during development. I needed to use a service account to authenticate firebase admin to generate a email sign in link with const link = await auth.generateSignInWithEmailLink(email, actionCodeSettings); I go the error here that Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the identitytoolkit.googleapis.com

My solution is now:

1. Impersonate the service account, by getting an Impersonated Client:

    const auth = new GoogleAuth();
    const client = await auth.getClient();
    const targetClient = new Impersonated({
      sourceClient: client,
      targetPrincipal: 'myaccount@myproject.iam.gserviceaccount.com',
      lifetime: 3600,
      delegates: [],
      targetScopes: ['https://www.googleapis.com/auth/cloud-platform'],
    });

2. Extract the Oauth2 credentials

    const credentials = await targetClient.getAccessToken();

3. Feed the credentials to initializeApp()

    initializeApp({
      credential: {
        getAccessToken: async () => {
          return {
            access_token: credentials.res.data.accessToken,
            expires_in: Date.parse(credentials.res.data.expireTime) / 1000,
          };
        },
      },
    });

• initializeApp(appOptions)
• Credential
• GoogleOAuthToken
• Example with Impersonated Credentials

Some notes:

• What I didn't want to do is create a service account key, download it and use that to authenticate (this would have been the easiest way).

• The contents of getAccessToken() response is not documented and I've pieced it together from looking at the content and tried out the token I've found in there.

Answer 2

Yes, it is possible to initialize the Firebase Admin SDK with an impersonated service account. The following steps are to be followed:

1. Using admin SDK and service account initialize Firebase app backend with:

    admin.initializeApp({ 
           credential: admin.credential.cert(service_account_json), 
          })

2. Obtain authentication token for the user you wish to impersonate:

    const userId = "[impersonating user uid string]" 
    const token = await admin.auth().createCustomToken(userId)

3. Using frontend Firebase SDK authenticate user with:

    const token = "[token string obtained in step 2]" 
    firebase.auth().signInWithCustomToken(token)