How to authenticate to a Firestore database using authentication from another Firestore project

Viewed 429

I have 2 firebase projects, project A and project B. Authentication is set up in project B, populated with registered users (email & password sign-in method).

My app (iOs, Swift) is configured with project A as the default firebase project. I am able to set up project B as a secondary firebase instance, successfully authenticate a user against project B, and get access to the Firestore database in project B (authentication controlled, checking request.auth.uid in the rules). So far so good.

I can access the (default) Firestore database in project A, so long as the Firestore database rules are left open (not checking request.auth.uid). When I add rules to check request.auth.uid, I am denied access, I expect because I am authenticated against project B, not project A.

I tried following this guide: https://firebase.googleblog.com/2016/12/working-with-multiple-firebase-projects-in-an-android-app.html , but fell into problems getting Google sign-in method to work due to what looks like firestore bug (see https://github.com/firebase/FirebaseUI-iOS/issues/670)

My project B Firestore rules are set up like:

service cloud.firestore {
  match /databases/{database}/documents {
    // Make sure the uid of the requesting user matches name of the user
    // document. The wildcard expression {userId} makes the userId variable
    // available in rules.
    match /users/{userId} {
      allow read, update, delete: if request.auth.uid == userId;
      allow create: if request.auth.uid != null;
    }
  }
}

I would like to set up my project A Firestore rules in a similar manner (restricting access to signed in users from project B)

For reference, here is how I am creating the secondary firebase instance:

//Setup the default firebase app 
FirebaseApp.configure()

//
//Set up a secondary firebase app that we want to authenticate against
//Acutal ID's etc altered for privacy reasons
//
let secondaryOptions = FirebaseOptions(googleAppID: "myAppId", gcmSenderID: "mySenderID")
secondaryOptions.bundleID = "myBundleID"
secondaryOptions.apiKey = "myAPIKey"
secondaryOptions.clientID = "myClientID"
secondaryOptions.databaseURL = "myDbUrl"
secondaryOptions.storageBucket = "myBucket"

// Configure an alternative FIRApp.
FirebaseApp.configure(name: "secondary", options: secondaryOptions)

// Retrieve a previous created named app.
guard let secondary = FirebaseApp.app(name: "secondary")
  else { assert(false, "Could not retrieve secondary app") }

// Retrieve the auth for the secondary app
let secondaryAuth = Auth.auth(app: secondary)
authUI = FUIAuth(uiWith: secondaryAuth)

// We need to adopt a FUIAuthDelegate protocol to receive callback
authUI?.delegate = self

//Set up providers
let providers: [FUIAuthProvider] = [
  FUIEmailAuth(authAuthUI: authUI, signInMethod: EmailPasswordAuthSignInMethod, forceSameDevice: false, allowNewEmailAccounts: true, actionCodeSetting: ActionCodeSettings())
]
authUI?.providers = providers

//After this, I can log users in using authUI, and access a db on secondary
//I can also access a db on the default Firebase instance, I just can't figure out how to authenticate using my secondary instance

I don't want to leave the database A without rules. I don't want the user to have to create 2 accounts, or sign in twice.

Is there any way I can authenticate to Firebase instance A using the already authenticated user from Firebase instance B?

0 Answers
Related