allow for client-safe authentication

[nbransby]

I am primarily after the ability to authenticate as a user for Cloud Firestore

See firebase/firebase-android-sdk#14 for more info

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[hiranya911]

Admin SDK is for authenticating as privileged, back-end services. It should not be used for desktop apps, and authenticating as individual users is really not in scope for us.

Having said that, there's a plan to support scoping Firestore requests down to individual users: firebase/firebase-admin-node#132. When that's implemented it will be exposed in Java as well. That, combined with Google authorized user credentials can probably be used to implement the type of things you're thinking about.

[hiranya911]

Closing, since there isn't anything that can be done in this repo to support this feature. Firestore auth override capability is developed in the google-cloud-firestore library.

[nbransby]

Hmm ok well as @samtstern rated my chances of forking firebase-android-sdk and remove the android specific code as somewhere between "very hard" and "impossible"

How would you rate my changes of forking firebase-admin-java and adding the client-safe authentication from the android client? Its all just java right? 😀

[hiranya911]

I'd say near impossible. Implementing this in our server SDKs require changes to Firestore service itself. Firestore server SDK code is here: https://github.com/GoogleCloudPlatform/google-cloud-java/tree/master/google-cloud-clients/google-cloud-firestore

It is not a simple clone/port of the Android code. It's a whole different beast.

[samtstern]

I believe the Firestore gRPC API (which the Java SDK uses) will "just work" if you pass it a Firebase Auth token. And you can get that token from the Firebase Auth REST API.

However the challenge here is threading that token through the google-cloud-java library (as @hiranya911 mentioned) and then managing the token lifecycle (they die each out).

[nbransby]

@samtstern I’m guessing you chose to respond here because you feel that this task is (substantially?) more viable that porting the Firestore and dependent code from the android sdk to pure java?

[samtstern]

Yeah @nbransby I don't think starting from the Android SDK will ever work, to be honest. I think building your own client on top of the gRPC or REST APIs would be easier than that.

[nbransby]

Ahh interesting thanks, and it appears this SDK is a very thin layer on top of google-cloud-java so I might as well focus my attention there