WithoutAuthentication client option seems to be ignored

[mitar]

• Operating System version: Ubuntu 18.04.4
• Firebase SDK version: (not sure what this is)
• Library version: v3.12.0
• Firebase Product: auth

Steps to reproduce:

I am trying to verify ID tokens. From me looking at the code it looks like that that does not need any API access (I am not checking for revocations), but I cannot really initialize the app like that.

Relevant Code:

	config := &firebase.Config{
		ProjectID: "foobar",
	}

	app, _ := firebase.NewApp(ctx, config, option.WithoutAuthentication())
        client, _ := app.Auth(ctx)

When I then call client.VerifyIDToken(ctx, jwt), I get:

google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

I would expect that passing WithoutAuthentication would not try to obtain default credentials. It looks like DialSettings.TokenSource is used even if DialSettings.NoAuth is set?

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[mitar]

My current workaround:

func (ts *DummyTokenSource) Token() (*oauth2.Token, error) {
	return nil, errors.New("This should never happen.")
}

	config := &firebase.Config{
		ProjectID: "foobar",
	}

	app, _ := firebase.NewApp(ctx, config, option.WithTokenSource(&DummyTokenSource{}))
	client, _ := app.Auth(ctx)
	_, err = client.VerifyIDToken(ctx, jwt)

[hiranya911]

Shouldn't happen unless you're using an old version of the SDK. Just tried the following which worked fine:

func TestMe(t *testing.T) {
	config := &firebase.Config{
		ProjectID: "foobar",
	}

	ctx := context.Background()
	app, err := firebase.NewApp(ctx, config, option.WithoutAuthentication())
	if err != nil {
		t.Fatal(err)
	}

	client, _ := app.Auth(ctx)
	if err != nil {
		t.Fatal(err)
	}

	_, err = client.VerifyIDToken(ctx, jwt)
	if err != nil {
		t.Fatal(err)
	}
}

[hiranya911]

New versions of the SDK defaults to WithoutAuthentication for public key fetch:

firebase-admin-go/auth/token_verifier.go

Lines 61 to 75 in e088f55

	func newIDTokenVerifier(ctx context.Context, projectID string) (*tokenVerifier, error) {
	noAuthHTTPClient, _, err := transport.NewHTTPClient(ctx, option.WithoutAuthentication())
	if err != nil {
	return nil, err
	}
	return &tokenVerifier{
	shortName: "ID token",
	articledShortName: "an ID token",
	docURL: "https://firebase.google.com/docs/auth/admin/verify-id-tokens",
	projectID: projectID,
	issuerPrefix: idTokenIssuerPrefix,
	keySource: newHTTPKeySource(idTokenCertURL, noAuthHTTPClient),
	clock: internal.SystemClock,
	}, nil
	}

[hiranya911]

Can you confirm whether the error is coming from VerifyIDToken() or some other initialization function? Perhaps NewApp(). That would make more sense.

[mitar]

Yes, it comes from NewApp already. I do not get to VerifyIDToken.

[hiranya911]

Ok, that's understandable. We have the following line of code:

firebase-admin-go/firebase.go

Lines 142 to 148 in e088f55

	func NewApp(ctx context.Context, config *Config, opts ...option.ClientOption) (*App, error) {
	o := []option.ClientOption{option.WithScopes(internal.FirebaseScopes...)}
	o = append(o, opts...)
	creds, err := transport.Creds(ctx, o...)
	if err != nil {
	return nil, err
	}

Given we don't always need creds we can change the above to not fail. I'll try to work that into a future release.

[mitar]

Awesome!

[mitar]

Awesome, thanks!

[mitar]

When will this be part of a release?