TransportError when running within App Engine

[REQUIRED] Step 2: Describe your environment

• Operating System version: MacOS Sierra (10.12.4)
• Firebase SDK version: 2.1.0
• Library version: N/A
• Firebase Product: Firebase Admin Python

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

1. Set up a Google App Engine environment (Python 2.7). Add SSL as a library in app.yaml
2. Write code for a trivial DB transaction
3. Run this code in the development app engine environment (eg dev_appserver.py app.yaml)

Running a trivial DB write results in this error message:

Traceback (most recent call last):
  File "/Users/rajvir/Dev/SR-backend/scraper.py", line 289, in firebase_test
    'test': 'value'
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/db.py", line 152, in set
    self._client.request_oneway('put', self._add_suffix(), json=value, params='print=silent')
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/db.py", line 603, in request_oneway
    self._do_request(method, urlpath, **kwargs)
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/db.py", line 631, in _do_request
    resp = self._session.request(method, self._url + urlpath, auth=self._auth, **kwargs)
  File "/Users/rajvir/Dev/SR-backend/lib/requests/sessions.py", line 488, in request
    prep = self.prepare_request(req)
  File "/Users/rajvir/Dev/SR-backend/lib/requests/sessions.py", line 431, in prepare_request
    hooks=merge_hooks(request.hooks, self.hooks),
  File "/Users/rajvir/Dev/SR-backend/lib/requests/models.py", line 309, in prepare
    self.prepare_auth(auth, url)
  File "/Users/rajvir/Dev/SR-backend/lib/requests/models.py", line 540, in prepare_auth
    r = auth(self)
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/db.py", line 674, in __call__
    req.headers['Authorization'] = 'Bearer {0}'.format(self._app._get_token())
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/__init__.py", line 211, in _get_token
    self._token = self._credential.get_access_token()
  File "/Users/rajvir/Dev/SR-backend/lib/firebase_admin/credentials.py", line 97, in get_access_token
    self._g_credential.refresh(_request)
  File "/Users/rajvir/Dev/SR-backend/env/lib/python2.7/site-packages/google/oauth2/service_account.py", line 310, in refresh
    request, self._token_uri, assertion)
  File "/Users/rajvir/Dev/SR-backend/env/lib/python2.7/site-packages/google/oauth2/_client.py", line 143, in jwt_grant
    response_data = _token_endpoint_request(request, token_uri, body)
  File "/Users/rajvir/Dev/SR-backend/env/lib/python2.7/site-packages/google/oauth2/_client.py", line 104, in _token_endpoint_request
    method='POST', url=token_uri, headers=headers, body=body)
  File "/Users/rajvir/Dev/SR-backend/env/lib/python2.7/site-packages/google/auth/transport/requests.py", line 115, in __call__
    raise exceptions.TransportError(exc)
TransportError: ('Connection aborted.', error(13, 'Permission denied'))

Running this same code outside of the App Engine environment works normally as expected.

Relevant Code:

cred = credentials.Certificate('service_account_file.json')
firebase_admin.initialize_app(cred, {
    'databaseURL': 'https://APP_ID.firebaseio.com'
})
ref = db.reference()

def firebase_test():
    try:
        ref.set({
            'test': 'value'
        })
    except:
        traceback.print_exc()

[hiranya911]

I will close this issue, since there’s not much we can do from our end to resolve the issues discussed here. We can continue to follow up with the Google cloud and google-auth team to get these issues addressed in the long run.

[hiranya911]

I’ve created an issue for the google-auth library documenting some of the pain points related to App Engine support. Hopefully we can get some useful feedback from them.

As for the poor support from the dev appserver, this is a long running issue and many other projects are experiencing the same problem. However, there are several workarounds. For me adding the following bit of code into the appengine_config.pysolved the issue:

import os
import google
import imp
import inspect
from google.appengine.ext import vendor

from google.appengine.tools.devappserver2.python import sandbox
sandbox._WHITE_LIST_C_MODULES += ['_ssl', '_socket']

runtime_path = os.path.realpath(inspect.getsourcefile(inspect))
runtime_dir = os.path.dirname(runtime_path)

# Patch and reload the socket module implementation.
system_socket = os.path.join(runtime_dir, 'socket.py')
imp.load_source('socket', system_socket)

# Patch and reload the ssl module implementation.
system_ssl = os.path.join(runtime_dir, 'ssl.py')
imp.load_source('ssl', system_ssl)

This basically whitelists the socket and ssl libraries for the dev app server, and uses the system-level socket library instead of the one packaged with the App Engine SDK. Your mileage may vary.