在Go中驗證Firebase實時數據庫的服務帳戶

我正在嘗試將新的Firebase實時數據庫用於簡單的日誌記錄應用程序。與數據庫的所有交互都將來自我的服務器，所以我只需要一個可以讀/寫任何內容的帳戶。在Go中驗證Firebase實時數據庫的服務帳戶

據我所知（文檔很糟糕 - 這裏有很多，但它自身矛盾，其中一半是針對「舊」Firebase的，並且通常使用一些隨機語言），我需要創建一個服務帳戶，然後使用OAuth創建一個JWT令牌。幸運的是，Go有一些很好的內置庫。這裏是我的代碼：

const firebasePostUrl = "https://my-product-logging.firebaseio.com/tests.json" 

// Obtained from the Google Cloud API Console 
var firebaseServiceAccount map[string]string = map[string]string{ 
    "type":      "service_account", 
    "project_id":     "my-product-logging", 
    "private_key_id":    "1c35ac0c501617b8f1610113c492a5d3321f4318", 
    "private_key":     "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoblahblahhwWlteuRDrsxmRq+8\ncDGMKcXyDHl3nWdIrWqJcDw=\n-----END PRIVATE KEY-----\n", 
    "client_email":    "[email protected]", 
    "client_id":     "101403085113430683797", 
    "auth_uri":     "https://accounts.google.com/o/oauth2/auth", 
    "token_uri":     "https://accounts.google.com/o/oauth2/token", 
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", 
    "client_x509_cert_url":  "https://www.googleapis.com/robot/v1/metadata/x509/log-user%40my-product-logging.iam.gserviceaccount.com", 
} 

func firebaseClient() *http.Client { 
    jwtConfig := jwt.Config{ 
     // Email is the OAuth client identifier used when communicating with 
     // the configured OAuth provider. 
     Email: firebaseServiceAccount["client_email"], 

     // PrivateKey contains the contents of an RSA private key or the 
     // contents of a PEM file that contains a private key. The provided 
     // private key is used to sign JWT payloads. 
     // PEM containers with a passphrase are not supported. 
     // Use the following command to convert a PKCS 12 file into a PEM. 
     // 
     // $ openssl pkcs12 -in key.p12 -out key.pem -nodes 
     // 
     PrivateKey: []byte(firebaseServiceAccount["private_key"]), 

     // PrivateKeyID contains an optional hint indicating which key is being 
     // used. 
     PrivateKeyID: firebaseServiceAccount["private_key_id"], 

     // Subject is the optional user to impersonate. 
     Subject: "", 

     // Scopes optionally specifies a list of requested permission scopes. 
     Scopes: []string{ 
      "https://www.googleapis.com/auth/devstorage.readonly", 
     }, 

     // TokenURL is the endpoint required to complete the 2-legged JWT flow. 
     TokenURL: firebaseServiceAccount["token_uri"], 

     // Expires optionally specifies how long the token is valid for. 
     Expires: 0, 
    } 

    ctx := context.Background() 
    return jwtConfig.Client(ctx) 
} 

func firebaseFunc() { 

    authedClient := firebaseClient() 

    msg := map[string]string{ 
     "hello": "there", 
     "every": "one", 
    } 

    data, err := json.Marshal(msg) 
    if err != nil { 
     log.Fatal("JSON Marshall Error: ", err) 
     continue 
    } 

    resp, err := authedClient.Post(firebasePostUrl, "application/json", bytes.NewReader(data)) 
    if err != nil { 
     log.Fatal("Firebase Error: ", err) 
     continue 
    } 

    log.Print("Firebase Response Code: ", resp.StatusCode) 
}

的問題是，我總是得到這樣的錯誤：

{ 
    "error" : "invalid_scope", 
    "error_description" : "https://www.googleapis.com/auth/devstorage.readonly is not a valid audience string." 
}

我想這是一種錯誤是invalid_scope，並描述說，這是無效audience（我假設JWT aud參數）。

作爲我的作用域，我可以使用什麼來讀取/寫入Firebase數據庫（使用默認的"auth != null"規則）？

編輯：我找到了答案here最後：

https://www.googleapis.com/auth/firebase

但是現在它給了我一個403的響應實際上做的文章時。

{ 
    "error" : "Permission denied." 
}

來源

2016-09-20 Timmmm

唉，我發現無證答案here。目前您還需要此範圍：

https://www.googleapis.com/auth/userinfo.email

來源

2016-09-20 16:25:04 Timmmm

在Go中驗證Firebase實時數據庫的服務帳戶

回答

相關問題