[firebase_auth] Multi tenancy ( Identity Platform compatibility )

[darioielardi]

Identity Platform, which relies on Firebase Authentication SDKs for most of the operations ( from my understanding FBA is becoming an abstraction over Identity Platform ), provides multi tenancy support, essentially splitting users by tenantId, which must be provided at login time.
Is there any work in progress or ETA on this feature compatibility for the Flutter plugin?

Thank you for your time.

[ddomingues]

Hi guys!

Any news about it? 🙏

[cacianokroth]

Hi guys!

Any news about it? 🙏

Please! 🙏🙏🙏🙏🙏

[ddomingues]

@darioielardi FYI and anyone interested.

I discovered a workaround solution to make it work 😬

I move the authentication (login + password) to backend using custom token and return this token to my mobile apps using it as custom token authentication. After that, using the last version of the firebase_auth I can authenticate multi-tenancy on my mobile apps 🎉

[darioielardi]

@ddomingues thanks for letting us know!
May I ask you how are you handling credentials verification server side? I thought about the same solution, using the client REST APIs for that, but AFAIK there's a severe rate limit for those calls from the same IP.

[ddomingues]

@daikini of course.

We use cloud functions in nodeJS.

My authentication flow now has 2 steps, unfortunatelly:

1. Try to authenticate the user using the auth().signInWithEmailAndPassword(email, password) using the correct tenant
2. Generate a custom token with the user found: auth().createCustomToken(user.id)

If it works successfully I return this token as result of the request and authenticate the user with the custom token using the firebase_auth : firebaseAuth.signInWithCustomToken(token: token)

I don't think it a great solution, but until the implementation at firebase_auth to be delivered, it works 🤷‍♂

[darioielardi]

@ddomingues thank you very much for the explanation, I'm wondering if the rate limit applies for sign in operations.

[2ZeroSix]

link
ios: firebase/firebase-ios-sdk#5747
android: firebase/firebase-android-sdk#1616

[2ZeroSix]

@daikini of course.

We use cloud functions in nodeJS.

My authentication flow now has 2 steps, unfortunatelly:

1. Try to authenticate the user using the `auth().signInWithEmailAndPassword(email, password)` using the correct tenant

2. Generate a custom token with the user found: `auth().createCustomToken(user.id)`

If it works successfully I return this token as result of the request and authenticate the user with the custom token using the firebase_auth : firebaseAuth.signInWithCustomToken(token: token)

I don't think it a great solution, but until the implementation at firebase_auth to be delivered, it works 🤷‍♂

Unfortunately, this workaround is not complete, you will lose almost all the metadata, and the token won't contain tenantId. Therefore, if you use TenantAwareAuth in your backend, it will reject these tokens.

[ajbarry]

@2ZeroSix ... as you noted the API support is already there. Can you think of or point us to a reasonable work-around for flutter-web? This is a very important security consideration for us as we definitely want the tenantId on the user to secure our firebase/storage rules.

[2ZeroSix]

@ajbarry you can try to emulate TenatAwareAuth behavior using claims and custom tokens.

In this case if you want to let user use same credentials (email/phone/third party) for different accounts in your system (one per tenant):
You won’t be able to access almost all the user metadata and methods provided by the firebase_auth, so you’ll be forced to wrap anything you need in your own backend or cloud functions.

Else you don’t need tenants and can just use claims for restriction policies

[bencalnan]

Hi is there any update on this? Would be fantastic to be able to run a setTenant method like one can in other firebase language libraries without using the cloud function method described above?

[ConProgramming]

Yep, same question here. Any updates on this?

[tc]

Looks like android has it supported now https://firebase.google.com/support/release-notes/android#auth_v19-4-0
Will flutter be updated to support multi tenancy login?

[tc]

i saw https://github.com/FirebaseExtended/flutterfire/blob/master/packages/firebase_auth/firebase_auth/CHANGELOG.md#0183

is tenancy login supported?

[JonasJW]

i saw https://github.com/FirebaseExtended/flutterfire/blob/master/packages/firebase_auth/firebase_auth/CHANGELOG.md#0183

is tenancy login supported?

Seems like getting a tenent Id of a user is supported but setting a tenent Id for an auth instance is not yet supported or am I missing something here?

[tc]

Yes I think you are right. I can try to add this to the sdk but could welcome any pointers to where to add the set tenant id code.

…

On Sun, Dec 20, 2020, 9:36 AM JonasJW ***@***.***> wrote: i saw https://github.com/FirebaseExtended/flutterfire/blob/master/packages/firebase_auth/firebase_auth/CHANGELOG.md#0183 is tenancy login supported? Seems like getting a tenent Id of a user is supported but setting a tenent Id for an auth instance is not yet supported or am I missing something here? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1584 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAB6KAMQZ4MBTXQOB4OHB3SVYYZLANCNFSM4JYLSHHA> .

[Ehesp]

Hey all, started looking into this.

PR #4465 basically adds support for the following:

FirebaseAuth.instance.tenantId = 'foo';
String /*?*/ tenantId = FirebaseAuth.instance.tenantId;

On native, this variable is passed over to native with each method channel request and on web, it's set directly on the underlying web SDK via class overrides.

Still needs iOS work and tests.

[SpiegelSoft]

Does anyone have a rough idea of the time schedule to get these features into production? I need this feature, but I'll have to make a call on using a bridge and calling native SDKs or waiting for the feature.

[kmr299]

Hi all, any updates on this?

[SpiegelSoft]

@kmr299 I made a bridge to native. One caveat is that with the current SDK, you can't unset a tenant ID once you've set it. I had to maintain a keyed dictionary of app instances, each of which corresponds to a tenant ID, or to no tenant ID.

[kmr299]

Thanks @SpiegelSoft

Could you give an example of your implementation?

[isAlmogK]

Any news on this? Does anyone have any working workarounds?

[SogoGolf]

This seems to have been open for a long time, we need this too and after trying/debugging found it doesn't work (tenantId is ignored). Is there any plan to add multi-tenant support to the FlutterFire authentication api's ?