How to Secure Firebase Access when App does not use Firebase Authentication

Question

I'm dealing with an Angular app that authenticates users through a third party system.

I'm trying to figure out how to best secure the Firebase instance, which leverages Firestore and storage buckets.

I'm new to Firebase and when I look at the documentation I see security rules that look like this.

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

I can add authentication, is that's the best path forward. It seems redundant since they've already been authenticated by the other system.

On the other hand, the authentication provider is not currently supported as a Firebase authentication provider.

Is there a simpler way to limit access to Firestore and the storage buckets that doing Firebase Authentication?

Answer 1

The idiomatic approach is to implement a custom sign-in provider. That essentially puts your authentication data into the request.auth variable.