using fusionauth to generate a jwt that is able to be used with google firebase customToken authentication.

nicholas.tsaoucis

Hi,

I'm trying to get fusionauth to be the authentication handler for my system.
I want to be able to use the token generated by fusionauth to be able to log into firebase using firebase.auth().signInWithCustomToken(token)

I have setup my public and private keys correctly and adjusted the require claims in the jwt populate lambda, however there is one thing that is blocking this from being possible now.

fusionauth has 3 claims that are unable to be modified.
exp, iat, sub
https://fusionauth.io/docs/v1/tech/lambdas/jwt-populate/

but firebase requires sub to be the google service account for your project.
https://firebase.google.com/docs/auth/admin/create-custom-tokens

From what I can see, sub in the jwt in fusionauth is the users unique id.

the google requirements provide uid as the unique identifier to be required in the jwt payload.

Is there a way to make fusionauth look for uid in the jwt instead of sub so I can get this to work? Or am I now at an impass?

Does anyone have any suggestions for a better way to do what im trying to do here?

nicholas.tsaoucis

I've been working with v1.29.4
I noticed in v1.30.0 the jwt vending machine api was added.
In the github topic for it, it states that the user defines the entire claim.
Are there any claims that are protected with this?

I'm thinking this might be a solution that I could use to do what I'm trying to do.

nicholas.tsaoucis

I experimented with the /api/jwt/vend and it does exactly what I need it to do.
creating a temporary JWT using a key saved in keymaster which allows access to all claims (only locked ones were the key life related ones)
solved perfectly.

joshua

@nicholas-tsaoucis

Glad you figured this out!

Thanks,
Josh
FusionAuth