Firebase authentication is working but firestore is denying request as Missing or Insufficient permissions

user_4341998 0
Viewed 606

I have an android app running for the last few months. I upgraded to the Blaze plan yesterday and since then Firestore started denying requests with the following error (not sure if these two are related and I am well below my quota)

PERMISSION_DENIED: Missing or insufficient permissions.

Following is my security rule

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

Firebase authentication is working fine as I am using

fbUser = firebaseAuth.getCurrentUser();

and I am getting fbUser. but any request to Firestore from my android app is getting denied. Following is the stack trace

com.google.firebase.firestore.FirebaseFirestoreException: PERMISSION_DENIED: Missing or insufficient permissions.
    at com.google.firebase.firestore.util.Util.exceptionFromStatus(com.google.firebase:firebase-firestore@@21.4.3:117)
    at com.google.firebase.firestore.core.EventManager.onError(com.google.firebase:firebase-firestore@@21.4.3:166)
    at com.google.firebase.firestore.core.SyncEngine.removeAndCleanupTarget(com.google.firebase:firebase-firestore@@21.4.3:534)
    at com.google.firebase.firestore.core.SyncEngine.handleRejectedListen(com.google.firebase:firebase-firestore@@21.4.3:418)
    at com.google.firebase.firestore.core.FirestoreClient.handleRejectedListen(com.google.firebase:firebase-firestore@@21.4.3:317)
    at com.google.firebase.firestore.remote.RemoteStore.processTargetError(com.google.firebase:firebase-firestore@@21.4.3:557)
    at com.google.firebase.firestore.remote.RemoteStore.handleWatchChange(com.google.firebase:firebase-firestore@@21.4.3:441)
    at com.google.firebase.firestore.remote.RemoteStore.access$100(com.google.firebase:firebase-firestore@@21.4.3:53)
    at com.google.firebase.firestore.remote.RemoteStore$1.onWatchChange(com.google.firebase:firebase-firestore@@21.4.3:176)
    at com.google.firebase.firestore.remote.WatchStream.onNext(com.google.firebase:firebase-firestore@@21.4.3:108)
    at com.google.firebase.firestore.remote.WatchStream.onNext(com.google.firebase:firebase-firestore@@21.4.3:38)
    at com.google.firebase.firestore.remote.AbstractStream$StreamObserver.lambda$onNext$1(com.google.firebase:firebase-firestore@@21.4.3:119)
    at com.google.firebase.firestore.remote.AbstractStream$StreamObserver$$Lambda$2.run(Unknown Source:4)
    at com.google.firebase.firestore.remote.AbstractStream$CloseGuardedRunner.run(com.google.firebase:firebase-firestore@@21.4.3:67)
    at com.google.firebase.firestore.remote.AbstractStream$StreamObserver.onNext(com.google.firebase:firebase-firestore@@21.4.3:110)
    at com.google.firebase.firestore.remote.FirestoreChannel$1.onMessage(com.google.firebase:firebase-firestore@@21.4.3:124)
    at io.grpc.ForwardingClientCallListener.onMessage(ForwardingClientCallListener.java:33)
    at io.grpc.ForwardingClientCallListener.onMessage(ForwardingClientCallListener.java:33)
    at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1MessagesAvailable.runInContext(ClientCallImpl.java:563)
    at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
    at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:301)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
    at com.google.firebase.firestore.util.AsyncQueue$SynchronizedShutdownAwareExecutor$DelayedStartFactory.run(com.google.firebase:firebase-firestore@@21.4.3:229)
    at java.lang.Thread.run(Thread.java:919)
Caused by: io.grpc.StatusException: PERMISSION_DENIED: Missing or insufficient permissions.
    at io.grpc.Status.asException(Status.java:541)
    at com.google.firebase.firestore.util.Util.exceptionFromStatus(com.google.firebase:firebase-firestore@@21.4.3:115)
    ... 27 more
firebase-security google-cloud-firestore firebase android
2 Answers

Billing plan and security rules are not related.

Your rules reject any request that happens without a user sign-in. That's the only thing that needs to be satisfied in order to get your query to work. There's not enough information here to know why a user isn't signed in (if that's what you expect), but that's the only reason for "permission denied" in this, according to what you've shown here. You'll have to do some debugging to figure that out.

user_8071260

This is not a whole solution, but a step in a direction.

I was having the exact same problem with example application GuestBook link.

One fix was that I created from scratch a new firebase project... It worked... (the source code is the same, other than the project-Id in one file). same security rules as the old non-working project .. which to me says that the original problem does not lie in the security rules.

So the question is what is the difference in configurations? The only difference that I can imagine is the configuration of the service accounts ... do 'Roles' play a part? if so, in what way?

One thing I did notice was the in the firebase console, the service account was based on 'firebase-adminsdk-rk0ap'.. as opposed to the 'firebase-service-account' service account. With the old project, neither worked. For the new project I used 'firebase-adminsdk-xxxx' account

What also didn't work was reinitializing at the console (the steps in the GuestBook example):

gcloud auth login
gcloud init (reinitialized current project)
gcloud app create  (wasn't necessary, because already activated).

One error (don't know if related) upon the first call to the browser was:

WARNING: Failed to find a usable hardware address from the network interfaces; using random bytes: 94:a0:2d:dd:19:25:bf:f2
com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Missing or insufficient permissions.

Then when the application tries to access/write datastore:

"POST /sign HTTP/1.1" 302
"GET /index.jsp?guestbookName=default HTTP/1.1" 200
com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Missing or insufficient permissions.

(I would have put this in a comment, but I don't have permission).

user_76767960
Related