Does Authenticated Cloud Run instance natively support Firebase Authentication?

2
votes

I have read this page a few times it implies and does not imply that if I enable authentication when deploying a Cloud Run instance I can use Firebase Auth to get through to the service.

I tried passing in a valid Firebase user idToken and did not get through. Was I doing something wrong or is the only way to get through to Cloud Run when Authentication is enabled to use google sign in?

Steps to reproduce:

  1. When deploying to Cloud Run select Yes for authenticated

  2. Generate a firebase auth token using REST call from here

  3. make api call to Cloud run instance using header bellow and ID_TOKEN from step 2 above

Authorization: Bearer ID_TOKEN

1
firebasegoogle-cloud-platformfirebase-authenticationgoogle-cloud-run
Please edit the question to share all relevant code that you're using, both client and server, as well as any configuration. We should be able to see exactly what you're doing and what you're observing at every stage, and be able to reproduce for ourselves. – Doug Stevenson
@DougStevenson hope that's enough if not let me know – abe
Is the email address that you authenticate with Firebase is authorized to call Cloud Run endpoint? I mean, this email address have the role run.invoker? – guillaume blaquiere
@guillaumeblaquiere I did did not specifically add it but the cloud run instance is in the same project. I would assume that all the user in the firebase database in the same project would have access. Is that not correct? – abe
Are you using a Custom Domain with your Cloud Run app by any chance? I suspect id tokens might not be working there. – Ahmet Alp Balkan

1 Answers

0
votes

According with the comment, the use case is to authorize only the registered, and the authenticated user (with Firebase auth), to use a Cloud Run endpoint deployed privately.

You can't do it directly, you need to use an additional layer. Here I propose to use Cloud Endpoint. I wrote an article on this to set up an authentication with API Key.

You have the principles of Cloud Endpoint there. You simply have to change the security definition from API Key to Firebase auth. You can found documentation here

Note: The authentication methods can evolved the next quarters. Stay tuned