How to create Firebase Authentication claims? - firebase

Question

I am developing an Android app that needs to authenticate with a server application. The server application is a Spring Boot app that uses Spring Security. The server app uses a custom authentication provider to set the Granted Authorities for the user.
This is the code that I am using to retrieve the idToken:
FirebaseToken firebaseToken = null;
try {
FirebaseApp app = FirebaseUtil.getFirebaseApp();
firebaseToken = FirebaseAuth.getInstance(app).verifyIdTokenAsync(authenticationToken.getIdToken()).get();
} catch ( InterruptedException | ExecutionException | CancellationException e ) {
throw new AuthenticationServiceException(e.getMessage());
}
return firebaseToken;
One I have the Firebase Token I can retrieve the claims like this:
Map<String, Object> claims = token.getClaims();
I can then iterate over the claims and create the authorities like so:
List<GrantedAuthority> authorities = Lists.newArrayList();
authorities.add(new SimpleGrantedAuthority("some_role"));
What I can't figure out is how to create the claims using the Firebase Console. Is this possible? I suspect that I need to use the Firebase Database but can't find exactly what I'm looking for in the firebase docs.

Answer 1

Custom claims for Firebase Authentication can currently only be created through the Firebase Admin SDKs. From the documentation on creating custom claims:
// Set admin privilege on the user corresponding to uid.
admin.auth().setCustomUserClaims(uid, {admin: true}).then(() => {
// The new custom claims will propagate to the user's ID token the
// next time a new one is issued.
});
It's not a bad idea to allow creating claims from the console too, so I'd recommend you file a feature request.

Answer 2

If you've been working with the Firebase Emulator Suite on localhost, you've probably noticed that you can directly edit the user in that console to add a custom claim like {"role":"admin"}. Just go to the Authentication tab, click the overflow menu for a specific user, select "Edit User", and set the custom claim in a text box.
You're probably here because you've discovered that the "Edit User" option doesn't appear in the production Firebase console, so you need to figure out how to do the same thing with code. Here are the steps I took to set a custom claim from Windows using Python, a service account, and the Firebase admin tools. Steps should be similar on Linux or OSX. This assumes you already have python and pip installed.
Download your credentials for a service user by starting here. You'll use the file you download in step 3.
https://console.firebase.google.com/project/<your_project>/settings/serviceaccounts/adminsdk
Install the firebase-admin tools for Python from a terminal (For Linux or OSX, you probably need to precede this command with sudo):
pip install firebase-admin
Open a python terminal by running python from the command-line and execute these lines of code:
import firebase_admin
from firebase_admin import credentials, auth
cred = credentials.Certificate("c:\\Users\\<path_to_my_credentials_file>.json")
default_app = firebase_admin.initialize_app(cred)
user = auth.get_user_by_email('<user_email_address>')
auth.set_custom_user_claims(user.uid, {'role': 'admin'})
# Verify the change worked:
user = auth.get_user_by_email('<user_email_address>')
print(user.custom_claims)

Answer 3

You can also easily do it with Python with:
auth.set_custom_user_claims(user_id, {"admin":True}, app=None)