firebase - 使用 GCP API-Gateway 和 Firebase Auth 保护 App-Engine 后端

Question

我的目的是使用 Google 提供的 API 网关来保护我的后端，该后端部署为 GCP App Engine，只让经过 Firebase 身份验证的用户可以访问它。

如文档中所述，我设置了所有内容：

API网关配置：

{
  "swagger": "2.0",
  "info": {
    "title": "PROJECT_NAME",
    "version": "1.0"
  },
  "securityDefinitions": {
    "firebase": {
      "authorizationUrl": "",
      "flow": "implicit",
      "type": "oauth2",
      "x-google-issuer": "https://securetoken.google.com/PROJECT_ID",
      "x-google-jwks_uri": "https://www.googleapis.com/service_accounts/v1/metadata/x509/[e-mail]",
      "x-google-audiences": "PROJECT_ID"
    }
  },
  "security": [
    {
      "firebase": [ ]
    }
  ],
  "paths": {
    "/hello-spring": {
      "get": {
        "produces": [
          "application/json"
        ],
        "operationId": "helloSpring",
        "parameters": [],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "type": "string"
            }
          }
        },
        "x-google-backend": {
          "address": "https://URI-TO-APP-ENGINE-SERVICE",
          "path_translation": "APPEND_PATH_TO_ADDRESS"
          "jwt_audience": "API_CREDENTIALS_FROM_IAP_APP_ENGINE_APP"
        }
      }
    }
  },
  "definitions": {
    "User": {
      "properties": {
        "creationTimestamp": {
          "format": "date-time",
          "type": "string"
        },
        "id": {
          "format": "int32",
          "type": "integer"
        },
        "name": {
          "type": "string"
        },
        "updateTimestamp": {
          "format": "date-time",
          "type": "string"
        },
        "uuid": {
          "type": "string"
        }
      },
      "type": "object"
    }
  },
  "x-components": {}
}

当我向这个 api-gateways url 发送请求（没有 jwt 令牌）时，它会正确响应

{
    "message": "Jwt is missing",
    "code": 401
}

使用Firebase jwt
“默认”firebase 后端，不创建自定义令牌。Firebase 用于创建 JWT 令牌。来自客户端的以下代码片段用于接收有效的 JWT：

final FirebaseAuth _auth = FirebaseAuth.instance;
....

final GoogleSignInAccount googleSignInAccount = await googleSignIn.signIn();
final GoogleSignInAuthentication googleSignInAuthentication = await googleSignInAccount.authentication;

final AuthCredential credential = GoogleAuthProvider.credential(
    accessToken: googleSignInAuthentication.accessToken,
    idToken: googleSignInAuthentication.idToken,
  );

final UserCredential authResult = await _auth.signInWithCredential(credential);

final String token = await _auth.currentUser.getIdToken();

但是，只要我添加了由 firebase 客户端应用程序创建的 JWT（上面代码中的最终字符串令牌），并将其添加到请求标头中

Authorization: Bearer TOKEN_CODE 

网关响应

{
    "code": 401,
    "message": "Jwt verification fails"
}

我在 GCP 中可以看到的最详细的 LOG 是：

response_code_detail: jwt_authn_access_denied{Jwt_verification_fails}

我还创建了一个与此 API-Gateway 相关联的服务帐户，具有以下角色：

• 角色/appengine.appViewer
• 角色/iam.serviceAccountUser
• 角色/run.invoker
• 角色/apigateway.viewer

但是，同样的错误：“401 - Jwt 验证失败”。我错过了什么，如何在 GCP 中查看有关此问题的更多详细信息以及可能的解决方案？

标签： firebasegoogle-cloud-platformfirebase-authenticationjwtgoogle-cloud-api-gateway