Error fetching access token. Not connecting to Firebase Auth Emulator if application_default_credentials.json not present

[READ] Step 1: Are you in the right place?

• For issues related to the code in this repository file a Github issue.
• If the issue pertains to Cloud Firestore, read the instructions in the “Firestore issue” template.
• For general technical questions, post a question on StackOverflow with the firebase tag.
• For general Firebase discussion, use the firebase-talk google group.
• For help troubleshooting your application that does not fall under one of the above categories, reach out to the personalized Firebase support channel.

[REQUIRED] Step 2: Describe your environment

• Operating System version: Debian 10 (but I think is OS independent). Runing in the container produced by this Dockerfile

ARG VARIANT="14-buster"
FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
   && apt-get -y install --no-install-recommends openjdk-11-jre-headless
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg  add - && apt-get update -y && apt-get install google-cloud-sdk -y
RUN sudo -u node npm install -g @nestjs/cli@7.4.0 firebase-tools@v8.14.0 nx@10.3.0

• Firebase SDK version: v8.14.0
• Firebase Product: auth
• Node.js version: v10.22.0
• NPM version: 6.14.6

[REQUIRED] Step 3: Describe the problem

If the ‘application_default_credentials.json’ is not present in the gcloud config path I get the error from below when I try to call any auth method even though the emulator is started, the FIREBASE_AUTH_EMULATOR_HOST env var is correctly set and the initializeApp is correctly called.

Based on my research this problem comes from the getApplicationDefault function inside the src/credential/credential-internal.ts file. I solved this by running gcloud auth application-default login (found on internet, don’t know exactly what it does) which generated a valid application_default_credentials.json file

I don’t completely understand the underlying mechanisms but I think this behaviour is not great for my use case which is probably very similar with a CI/CD pipeline use case. Also, there’s nothing mentioned in the Firebase Auth emulator about this and I really like to be able to run all emulators without a real project but, doing this gcloud config makes me worried not to interact by mistake with the real gcloud project.

 Error: Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "Error fetching access token: Error while making request: getaddrinfo ENOTFOUND metadata.google.internal metadata.google.internal:80. Error code: ENOTFOUND".
    at FirebaseAppError.FirebaseError [as constructor] (C:\Users\Marian\Desktop\test\tp\node_modules\firebase-admin\lib\utils\error.js:43:28)
    at FirebaseAppError.PrefixedFirebaseError [as constructor] (C:\Users\Marian\Desktop\test\tp\node_modules\firebase-admin\lib\utils\error.js:89:28)
    at new FirebaseAppError (C:\Users\Marian\Desktop\test\tp\node_modules\firebase-admin\lib\utils\error.js:124:28)
    at C:\Users\Marian\Desktop\test\tp\node_modules\firebase-admin\lib\firebase-app.js:124:23
    at process._tickCallback (internal/process/next_tick.js:68:7)

Steps to reproduce:

1. Run the firebase emulators (especially the auth emulator)
2. Set the FIREBASE_AUTH_EMULATOR_HOST env var as described in the docs
3. Create a simple npm project that uses the firebase-admin
4. Write a simple script (see detailed code below) that makes any call on the auth using the firebase-admin

Relevant Code:

I’m running a dev environment using the VSCode .devcontainer feature using the following files:

main.Dockerfile

ARG VARIANT="14-buster"
FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
    && apt-get -y install --no-install-recommends openjdk-11-jre-headless
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg  add - && apt-get update -y && apt-get install google-cloud-sdk -y
RUN sudo -u node npm install -g @nestjs/cli@7.4.0 firebase-tools@v8.14.0 nx@10.3.0

firebase_emulator.Dockerfile

ARG VARIANT="14-buster"
FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}

RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
    && apt-get -y install --no-install-recommends openjdk-11-jre-headless

RUN sudo -u node npm install -g firebase-tools@v8.14.0

COPY ./firebase.json .
COPY ./.firebaserc .

RUN firebase setup:emulators:database
RUN firebase setup:emulators:firestore

ENTRYPOINT [ "firebase",  "emulators:start"]

docker-compose.yml

version: '3'
services:
  main:
    build: 
      context: .
      dockerfile: main.Dockerfile
      args:
        VARIANT: 10
    volumes:
      - ..:/workspace
    command: sleep infinity
    environment:
      FIRESTORE_EMULATOR_HOST: "firebase_emulator:8080"
      FIREBASE_DATABASE_EMULATOR_HOST: "firebase_emulator:9000"
      FIREBASE_AUTH_EMULATOR_HOST: "firebase_emulator:9099"
      GCLOUD_PROJECT: "local"
    links:
      - firebase_emulator
  firebase_emulator:
    build: 
      context: .
      dockerfile: firebase_emulator.Dockerfile
      args:
        VARIANT: 10
    ports:
      - "4000:4000"
      - "5001:5001"
      - "8080:8080"
      - "9000:9000"
      - "8085:8085"
      - "4500:4500"
      - "4400:4400"
      - "9005:9005"
      - "9099:9099"

devcontainer.json

{
	"name": "Node.js & TypeScript & GCP & Firebase & Nest",
	"dockerComposeFile":"docker-compose.yml",
	"service": "main",
	"workspaceFolder": "/workspace",
	"settings": { 
		"terminal.integrated.shell.linux": "/bin/zsh",
		"files.autoSave": "afterDelay",
		"git.autofetch": true,
		"workbench.iconTheme": "material-icon-theme"
	},
	"extensions": [
		"dbaeumer.vscode-eslint",
		"ms-vscode.vscode-typescript-tslint-plugin",
		"eg2.vscode-npm-script",
		"redhat.vscode-yaml",
		"abhijoybasak.nestjs-files",
		"nrwl.angular-console",
		"esbenp.prettier-vscode",
		"firsttris.vscode-jest-runner",
		"github.vscode-pull-request-github",
		"pkief.material-icon-theme",
		"humao.rest-client"
	],
	"remoteEnv": {
		"GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}",
		"FIREBASE_TOKEN": "${localEnv:FIREBASE_TOKEN}"
	},
	"postCreateCommand": "npm install && npm install --only=dev",
	"remoteUser": "node"
}

firebase.json

{
    "emulators": {
      "firestore": {
        "port": 8080,
        "host": "0.0.0.0"
      },
      "database": {
        "port": 9000,
        "host": "0.0.0.0"
      },
      "auth": {
        "port": 9099,
        "host": "0.0.0.0"
      },
      "ui": {
        "enabled": true,
        "port": 4000,
        "host": "0.0.0.0"
      }
    }
 }

.firebaserc

{
  "projects": {
    "default": "local"
  }
}

The minimal code required is to call some auth function using the firebase-admin package. For example:

// The test script make sure the FIREBASE_AUTH_EMULATOR_HOST environment var is set
const process=require("process")
process.env.FIREBASE_AUTH_EMULATOR_HOST = "localhost:9099";

var admin = require('firebase-admin');

admin.initializeApp({
    projectId: 'local'
})

admin.auth().createUser({});

[samtstern]

@dbanisimov @nVitius thanks for your feedback! According to @yuchenshi we may be able to fix this by lazily requiring credentials in firebase-admin-node when using Auth with the emulator.

[akauppi]

@IsaiahByDayah On your side comment on rules testing and initializeAdminApp: I think it’s a completely different abstraction from the admin client, only meant for bypassing rules restrictions. Anyways, out of scope of this issue.