FirestoreOptions not loading projectid from credentials correctly

I recently migrated from an older version (0.45) where I configured firestore using the FirebaseOptions, e.g.

GoogleCredentials credentials = GoogleCredentials.fromStream(new FileInputStream(_firebaseCredentialsPath));
FirebaseOptions options = new FirebaseOptions.Builder()
            .setCredentials(credentials)
            .build();
 FirebaseApp.initializeApp(options);
 _database = FirestoreClient.getFirestore();

This works. I migrated to the new way of doing things with FirestoreOptions (0.56.0). I got warnings to change the configuration. So the resulting code is now:

GoogleCredentials credentials = GoogleCredentials.fromStream(new FileInputStream(_firebaseCredentialsPath));
FirestoreOptions fireStoreOptions =
            FirestoreOptions.newBuilder().setTimestampsInSnapshotsEnabled(true)
                    .setCredentials(credentials)
                    .build();
_database = fireStoreOptions.getService();

However, this code fails. It requires that the projectId field be set using .setProjectId(“…”). In my case it defaulted to another project in cloud that did not have firestore enabled. Perhaps the default project in cloud? It’s unclear. This seems like a bug. The project id is not available from the credentials API, even though it is there. Why is the projectid being ignored / not set from credentials correctly?

[marshallpierce]

I can confirm this, and that https://github.com/GoogleCloudPlatform/google-cloud-java/issues/3458 still is a problem. I’m using 0.56.0-beta.

For context: val credentials = ServiceAccountCredentials.fromStream(stream) loads credentials from a service account json file that is an owner in a project set aside for running tests.

• setCredentialsProvider(FixedCredentialsProvider.create(credentials)), no setProjectId:

com.google.api.gax.rpc.FailedPreconditionException: io.grpc.StatusRuntimeException: FAILED_PRECONDITION: The Cloud Firestore API is not enabled for the project <the default project for my local gcloud config, which is not the project id in the credentials>

In other words, it’s looking in the wrong place.

• setCredentialsProvider with a FixedCredentialsProvider.create(credentials), with setProjectId: everything works.

• setCredentials(credentials), no setProjectId:

com.google.api.gax.rpc.FailedPreconditionException: io.grpc.StatusRuntimeException: FAILED_PRECONDITION: The Cloud Firestore API is not enabled for the project <the default project for my local gcloud config, which is not the project id in the credentials>

• setCredentials(credentials), with setProjectId:

com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Missing or insufficient permissions.

Which, I’m guessing, is it trying to use the default credentials on the test project’s Firestore, which of course won’t work. In other words, https://github.com/GoogleCloudPlatform/google-cloud-java/issues/3458. (Have I mentioned how much I dislike the concept of silent default credentials?)

For comparison, with 0.51.0-beta, setCredentials(credentials), with setProjectId works fine.

[sduskis]

If I read this issue correctly, this seems like “working as intended”. The user / service account used by the application needs to have access to the project resources being accessed. In this case, it sounds like the permissions of the user being used didn’t align properly with the code.

There is an effort to move away from the implicit permissions, but that’s going to take some time. I don’t see anything actionable on this issue, at this point, so I’m closing it. Please feel free to open a different issue to address documentation related issues around credentials.