User conflict when using same Auth method for Admin and Normal users | Firebase Auth

问题

I'm working on Admin module of an android application. Admin module is a web-app based on Angular. Firebase auth(Email/password) is used to sign-In as a admin. I've added a manual credential entry to firebase and admin is using these credentials to login (Since there is no registration functionality for admin)

on other side Android developer has also used the same Auth method to sign in a user. So users of android application are able to login with their credentials to Admin module.

How do I prevent android users from login to web-app. Is there any method or rule that I can use to filter the incoming login request and allow login only if email belongs to Admin ?

回答1:

Firebase has no knowledge of what an "Admin" is here. That's a concept that is specific to your app, so you will have to enforce it.

There's no way to allow certain users to only sign in on a specific platform. This is because Firebase makes a clear split between authentication (the user proves who they are) and authorization (the user has access to a resource). You use Firebase Authentication for authenticating the users, but will the "who can use what app" is an authorization problem, so it is handled elsewhere.

If you're using Realtime Database, Cloud Firestore, or Cloud Storage through Firebase, you'll for example typically enforce our authorization logic in Firebase's server-side security rules. Since these are automatically enforced on the server, there's no way for a user to bypass them, and they apply equally no matter what platform the user is on.

---

For example, a common first security rule that I start my Firestore projects with is:

service cloud.firestore {
  match /databases/{database}/documents {
    match /chat/{document} {
      allow read;
      allow write: 
        if isAdmin()
    }

    function isAdmin() {
      return false;
    }
  }
}

This allows anyone to read the data, and no-one to write it, since isAdmin always returns false. With these rules the only way I can write data is by using an Admin SDK, since code using this SDK runs with elevated privileges and bypasses the security rules. A perfect way to get started, and safely populate my database with initial data from Node.js scripts (in my most common case).

---

Then at some point I do as you did, and add an application administrator. At that point I add their UID to the security rules:

    function isAdmin() {
      return request.auth.uid == "KqEizsqUQ6XMkUgLUpNxFnzLm4F3"
          || request.auth.uid == "zYXmog8ySOVRrSGVt9FHFr4wJb92";
    }

So the above function in my rules now gives two specific Firebase Authentication users write access to the data.

---

This approach works well for the first few users, but at some point adding UIDs to the rules gets tedious and error prone. At that point I have two main options:

1. Store the UIDs of the application administrators in the database.
2. Identify application administrators in another way.

For storing the UIDs in the database you'd typically either add those UIDs to the database manually, or allow administrators to identify other administrators, and write their UIDs from the app. Either way, the security rules for this are something like:

function isAdmin() {
  return request.auth.uid == "KqEizsqUQ6XMkUgLUpNxFnzLm4F3"
      || request.auth.uid == "zYXmog8ySOVRrSGVt9FHFr4wJb92"
      || exists(/databases/$(database)/documents/admins/$(request.auth.uid))
      ;
}

So the last line now also recognizes any authentication user whose UID is store in the admins collection as an application administrator.

Finally, say that I want everyone from my company to be an application administrator; I'd do that with:

function isAdmin() {
  return request.auth.uid == "KqEizsqUQ6XMkUgLUpNxFnzLm4F3"
      || request.auth.uid == "zYXmog8ySOVRrSGVt9FHFr4wJb92"
      || (request.auth.token.email_verified && request.auth.token.email.matches(".*@google.com"))
      || exists(/databases/$(database)/documents/admins/$(request.auth.uid))
      ;
}

So this means that any Firebase Authentication user who has a verified @google.com email address is now an also application administrator.

---

As you can see, I build these rules up in multiple steps, starting with simply identifying that I will have application administrators who have specific permissions and creating the isAdmin function.

来源：https://stackoverflow.com/questions/60449478/user-conflict-when-using-same-auth-method-for-admin-and-normal-users-firebase