Firebase multi-tenancy has this error There is no user record corresponding to the provided identifier - firebase

Question

I have setup my firebase with multiple tenants using Google Identity Platform.
And through Identity Platform, I manually added a user acct to each tenant.
For example, test#abcdemo.com for abcdemo tenant
test#defdemo.com for defdemo tenant
In my Flutter Web client app, I was able to sign in with FirebaseAuth's signInWithEmailAndPassword successfully with user acct and tenantId.
After successful sign in, I want to set a custom claim by passing the idToken that I retrieved from successful sign-in to setCustomClaims cloud function below:
const express = require("express");
const functions = require("firebase-functions");
const admin = require("firebase-admin");
admin.initializeApp();
const app = express();
app.post("/setCustomClaims", async (req, res)=>{
// Get the ID token passed.
const idToken = req.body;
functions.logger.log("Here's idToken: ", idToken);
// Verify the ID token and decode its payload.
const claims = await admin.auth().verifyIdToken(idToken);
functions.logger.log("After verify ID Token");
// Verify user is eligible for additional privileges.
if (
typeof claims.email !== "undefined" &&
typeof claims.email_verified !== "undefined"
) {
functions.logger.log("Inside if condition");
//Result of code execution below:
//This shows thee correct project id, etc
functions.logger.log("Project ID is ", process.env.FIREBASE_CONFIG);
//Result of code execution below:
//Rejected: FirebaseAuthError: There is no user record corresponding to the provided identifier.
await admin.auth().getUserByEmail(claims.email).then(
(record) =>
functions.logger.log("Success: ", record)).catch(
(reasonStr) =>
functions.logger.log("Rejected: ",
reasonStr));
//Result of code execution below:
//Users: {"users":[]}
await admin.auth().listUsers().then((users) =>
functions.logger.log("Users: ", users));
//Result of code execution below:
//Error: There is no user record corresponding to the provided identifier.
await admin.auth().setCustomUserClaims(claims.sub, {
youcanaccess: true,
});
//Didn't even go to this line because the above code was erroring out.
functions.logger.log("after setCustomClaims");
// Tell client to refresh token on user.
res.end(JSON.stringify({
status: "success",
}));
functions.logger.log("after success");
} else {
// Return nothing.
res.end(JSON.stringify({status: "ineligible"}));
functions.logger.log("after ineligible");
}
});
exports.api = functions.https.onRequest(app);
The code above has some extra code for debugging purpose.
As you can see the code above, I put some comments till the last line
of executed statement.
It's erroring out in this line:
await admin.auth().setCustomUserClaims.
And the error message again is this:
Error: There is no user record corresponding to the provided identifier.
I don't know exactly why it stated that there's no user record even though I was able to sign in successfully.
My guess is the users in the tenant scope didn't get recognized by the admin.auth()?
By the way, this wasn't done in local emulator.
Looking forward for any advice. Thank you very much for the help

Answer 1

If you are using multi-tenant you must set the tenant id before you access it. if not it will check only outside of the tenant. So you should modify the code following:
first, you've to assign your user's tenant id like the following:
const tenantAuth = admin.auth().tenantManager().authForTenant("TENANT_ID");
Now you can access a particular tenant:
const claims = await tenantAuth.verifyIdToken(idToken);
then,
if (
typeof claims.email !== "undefined" &&
typeof claims.email_verified !== "undefined"
) {
functions.logger.log("Inside if condition");
functions.logger.log("Project ID is ", process.env.FIREBASE_CONFIG);
await tenantAuth.getUserByEmail(claims.email).then(
(record) =>
functions.logger.log("Success: ", record)).catch(
(reasonStr) =>
functions.logger.log("Rejected: ",
reasonStr));
await tenantAuth.listUsers().then((users) =>
functions.logger.log("Users: ", users));
await tenantAuth.setCustomUserClaims(claims.sub, {
youcanaccess: true,
});
functions.logger.log("after setCustomClaims");
// Tell client to refresh token on user.
res.end(JSON.stringify({
status: "success",
}));
functions.logger.log("after success");
} else {
// Return nothing.
res.end(JSON.stringify({status: "ineligible"}));
functions.logger.log("after ineligible");
}
Hope this solution will help you to solve the problem.