36

TLDR; I'm having trouble assigning an IAM permission to a service account.

I'm building a test that involves minting custom tokens with firebase Auth. When I hit:

  const token = await admin.auth().createCustomToken('test', {
    isAdmin: true,
  })

the following error is thrown

Permission iam.serviceAccounts.signBlob is required to perform
this operation on service account 
projects/-/serviceAccounts/[email protected].;
Please refer to 
https://firebase.google.com/docs/auth/admin/create-custom-tokens
for more details on how to use and troubleshoot this feature

In the referenced documentation it says to add the Service Account Token Creator role to the service account. I have added that role (as well as tried Service Account Admin to no avail.
Image verifying permissions

I can verify that my permissions seem to be correctly set, when I run gcloud projects get-iam-policy project I can see my service account attached to the desired role

- members:
  - serviceAccount:[email protected]
  role: roles/iam.serviceAccountTokenCreator

However if I look at that specific service account, it seems to show up empty which would fall in line with my error:

gcloud iam service-accounts get-iam-policy [email protected]
etag: ACAB
  • Why would those two commands & cloud console show differing information?

I assume that whatever is causing my service account permissions to show up blank is the culprit, but I'm not sure where to debug further. It seems to me the only difference is one command is called with a project in it, but I initialize my firebase app with the project id, and have verified it with (firebase-admin).apps[0].options so it seems like a dead end.

6 Answers 6

33

The sign feature of a service account requires the iam.serviceAccounts.signBlob permission. This permission is included in the Service Account Token role roles/iam.serviceAccountTokenCreator

You can assign this role at the "project" level or at the "service account" level. This is why you see different results. Assigning roles at the project level affects permissions for all service accounts. Assigning roles at the service account only affects that service account.

The key to your problem is that the caller does not have this role on service account [email protected]. You have given the service account permission and NOT the caller. Look into your code for the service account that you used to setup the Firebase SDK.

Another option is to grant the role to {YOUR_PROJECT_NAME}@appspot.gserviceaccount.com (1st gen) or {RANDOM_NUMBER}[email protected] (2nd gen) but that grants permission to use any service account.

A service account is both an identity and a resource. You need permission for the resource. That permission can be granted via a service account's IAM policy or via the project's IAM policy.

7
  • 1
    Thank you so much for your reply! I'm a little confused though, is the supplied service account to initializeApp not the service account used by the code? I am using the same service account, and see it listed when I look at the initialized apps options. admin.initializeApp({ projectId:project, serviceAccountId: [email protected]', }); Commented Aug 20, 2019 at 0:54
  • Edit your question with your code. Include enough to see everything from initialization to usage of the service account Commented Aug 20, 2019 at 1:03
  • 2
    Where is your code running (Compute Engine, App Engine, your desktop)? Your initialization code will only work with a Google service as it relies upon ADC. Outside of Google, you will need to use a service account JSON key file to initialize Firebase. Commented Aug 20, 2019 at 1:36
  • My code is running on my desktop. I've used gcloud auth application default with my user account so this initialization looks similar to how I initialize storage, pubsub, etc. Does firebase admin have different restrictions than those other SDKs? Commented Aug 20, 2019 at 13:09
  • 1
    Ahh, that was it! My user account is an owner for the project and I assumed that would include all permissions but apparently not. Thank you for your help! Commented Aug 20, 2019 at 17:20
26

Firebase mentions about this error on its docs:

https://firebase.google.com/docs/auth/admin/create-custom-tokens#failed_to_determine_service_account

You must initialize your app correctly through a JSON config file.

A simple fix would be:

  1. Go to https://console.cloud.google.com/iam-admin/iam?project=PROJECT_NAME
  2. Edit your default service account.
  3. Add the role Service Account Token Creator

In a few minutes your project will be able to create signed tokens.

1
  • Is there a way to do this only for specific email addresses?
    – Zorayr
    Commented Jun 24, 2020 at 2:38
10

If you still get iam.serviceAccounts.signBlob required error message even after following what others have said and you are using Firebase Cloud Functions, here are a few things you need to keep in mind.

  • If you are running "Firebase Local Emulator" or non-Google environment (i.e. not using Google Cloud), then your best option is to use service account JSON file. Note that in this case, the service account defined in the JSON file (that would be firebase-adminsdk-*****@PROJECT_NAME.iam.gserviceaccount.com in my case) doesn't need to have Service Account Token Creator role, because JSON file itself contains the private key. Not a terribly secure way to handle things, but there aren't many other options.

  • Firebase Cloud Functions come in 2 different flavors: 1st gen and 2nd gen. 1st gen's service account is typically [email protected], and 2nd gen is [email protected]. If you are using 2nd gen Cloud Function, you need to give Service Account Token Creator to the 2nd gen's service account. You can find it in "Google Cloud Console -> Your Project -> Serverless (in left pane) -> Cloud Functions -> Select function -> Details (2nd tab) -> Look for Service account".

1
  • 5
    I just upgraded to 2nd gen cloud functions and this was exactly my problem. To add the Service Account Token Creator role to my 2nd gen cloud function's service accounts I went to my project's IAM page and found the ${rand()}[email protected] service account, then clicked the Edit Principal pencil icon on the right, then ADD ANOTHER ROLE, then searched for Service Account Token Creator and hit Save. I had to wait a few minutes for it to work.
    – cgenco
    Commented Jun 22, 2023 at 0:36
1

If you need to accomplish this task within a Firebase Cloud function using .onCall(), please follow the steps outlined below:

from firebase_admin import storage
from google.auth import compute_engine
from google.auth.transport.requests import Request
from datetime import timedelta

def your_function(parameter):
    # Create an authentication request
    auth_request = Request()

    # Get your IDTokenCredentials
    signing_credentials = compute_engine.IDTokenCredentials(
        auth_request,
        "",
        service_account_email='<ADD YOUR SERVICE ACCOUNT MAIL(Principal)>'
    )

    # Get your storage bucket
    data_bucket = storage.bucket('<YOUR BUCKET>')
    
    # Generate a signed URL for your bucket
    blob = data_bucket.blob(parameter)
    url = blob.generate_signed_url(
        expiration=timedelta(days=7),
        credentials=signing_credentials, 
        version="v4"
    )
    
    return url

Remember to replace '<ADD YOUR SERVICE ACCOUNT MAIL(Principal)>' and '' with your actual service account email and bucket name, respectively.

0

I was replacing reCaptcha with Turnstile for Firebase App Check and encountered the same error. It took me the whole day to figure out the solution: I needed to enable the token generation API.

https://cloud.google.com/docs/authentication/use-service-account-impersonation#enable-apis

1
  • Actaully that worked once, at staging environment - but not working now
    – MAZ
    Commented Aug 21 at 6:55
0

For some reason nothing worked for me till I added this permission via command line:

gcloud projects add-iam-policy-binding PROJECT_ID --member=serviceAccount:[email protected] --role='roles/iam.serviceAccountTokenCreator

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.