search

caidooss / grafana-auth-proxy

Performant reverse authentication proxy for Grafana
MIT License
9 stars 3 forks source link

Google Firebase example? #8

Open IntegersOfK opened 4 years ago

IntegersOfK commented 4 years ago

Hi, I'm trying to use this for my Grafana instance running on Google Compute Engine. Until now, I've been using the JavaScript SDK for my Google Firebase user tokens, but that means the URLs and headers are all abstracted away from me.

Does anyone have any tips on how I can configure this to authenticate with my Firebase users?

I am looking at the table here to see if I can connect the options to what's needed for the auth proxy: https://firebase.google.com/docs/auth/admin/create-custom-tokens#create_custom_tokens_using_a_third-party_jwt_library

Or maybe this is of more use: https://cloud.google.com/iap/docs/signed-headers-howto

I'm just struggling to figure out how to get my users created and then authenticated so if you have any tips or would like to work with me on this, please post your findings thank you!

Sytten commented 3 years ago

Sorry I never saw that message, for reference you most likely need another server to setup a cookie for you with whatever JWT token using RSA (since the frontend can't set cookies). You can most likely use the token provided by google since it has the necessary claims:

{
  "name": "Emile Fugulin",
  "picture": "...",
  "iss": "https://securetoken.google.com/myproject",
  "aud": "myproject",
  "auth_time": 1613673609,
  "user_id": "some_id",
  "sub": "some_sub",
  "iat": 1614984560,
  "exp": 1614988160,
  "email": "emile@toto.com",
  "email_verified": true,
    "sign_in_provider": "google.com"
  }
}

You just need to setup the claims for it to work properly and figure out the .well_known to get the public keys necessary to verify the token.