Enable OIDC Token Exchange for BYO-CIAM (R-GCIP) #14983
Conversation
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback. |
Generated by 🚫 Danger |
|
|
||
| /// Represents the result of a successful OIDC token exchange, containing a Firebase ID token | ||
| /// and its expiration. | ||
| public struct FirebaseToken: Sendable { |
There was a problem hiding this comment.
Same point in the TenantConfig PR, is the nesting (e.g. Auth.FirebaseToken) intentional?
| func exchangeToken(idToken: String, | ||
| idpConfigId: String, | ||
| useStaging: Bool = false, | ||
| completion: @escaping (FirebaseToken?, Error?) -> Void) { |
There was a problem hiding this comment.
I would prefer if we don't introduce new API that uses completion handlers. As least initially, new async API should be async/await only unless there a reason for completion handler (e.g. objc support, etc.)
| guard let _ = requestConfiguration.location, | ||
| let _ = requestConfiguration.tenantId | ||
| else { | ||
| throw AuthErrorUtils.operationNotAllowedError(message: "R-GCIP is not configured.") |
There was a problem hiding this comment.
Do you think this should instead cause a fatal error? When do we anticipate this case triggering, during development or possibly in live app's execution?
There was a problem hiding this comment.
This should be during development. Unless the developer pushes their app without testing :)
|
|
||
| /// Represents the result of a successful OIDC token exchange, containing a Firebase ID token | ||
| /// and its expiration. | ||
| public struct FirebaseToken: Sendable { |
| idToken: idToken, | ||
| idpConfigID: idpConfigId, | ||
| config: requestConfiguration, | ||
| useStaging: true |
There was a problem hiding this comment.
Shouldn't this value come from useStaging above?
| guard let _ = requestConfiguration.location, | ||
| let _ = requestConfiguration.tenantId | ||
| else { | ||
| throw AuthErrorUtils.operationNotAllowedError(message: "R-GCIP is not configured.") |
There was a problem hiding this comment.
This should be during development. Unless the developer pushes their app without testing :)
| idToken: idToken, | ||
| idpConfigID: idpConfigId, | ||
| config: requestConfiguration, | ||
| useStaging: true |
There was a problem hiding this comment.
Same as above, won't we end up always using staging here?
Description
This PR adds new public methods to
Authto support exchanging a third-party OIDC ID token for a Firebase ID token. This functionality is essential for the Bring Your Own CIAM (BYO-CIAM) feature, allowing integration with external OIDC providers within a Regionalized GCIP (R-GCIP) setup.New Public API:
struct FirebaseToken: Sendable: Holds the exchangedtoken(String) and itsexpirationDate(Date).Auth.exchangeToken(customToken: String, idpConfigId: String, useStaging: Bool, completion: @escaping (FirebaseToken?, Error?) -> Void): Method to exchange the token, taking a completion handler.Auth.exchangeToken(customToken: String, idpConfigId: String, useStaging: Bool) async throws -> FirebaseToken: Async/await version of the token exchange method.Details:
exchangeTokenmethods use theExchangeTokenRequestandExchangeTokenResponsetypes to interact with the regionalizedidentityplatform.googleapis.combackend.Authinstance has been configured with aTenantConfig(viaAuth.auth(app:tenantConfig:)), aslocationandtenantIdare necessary to construct the correct regional endpoint URL. An error is returned if these are not set.currentUseron theAuthinstance. It purely exchanges a token.Introduces new public API surface to
FirebaseAuth. This change depends on the previously introducedTenantConfig,ExchangeTokenRequest, andExchangeTokenResponse.