When trying to migrate users across tenants in a test app I noticed that the PasswordHash of users I moved to the new tenant was being changed to the previous tenant's PasswordHash base64 encoded again. This means when a user tries to sign in with this newly imported user the correct password will be invalid
Additionally, when exporting users I noticed that some of the users' PasswordHash had - and _ characters in it, so the previous function for decoding (base64.StdEncoding.DecodeString()) would throw an error when it encountered the byte containing that character. Instead we need to use base64 URL encoding to decode, so we need a function that does just that (base64.URLEncoding.DecodeString(s)).
The hash key on the other hand can have a / character in it so it still requires Standard base64 encoding
In short: the user's PasswordHash uses a different flavor of base 64 encoding then the signer key provided in the Firebase/Cloud Console and needs to be decoded properly before uploading a user.
Describe the problem
When trying to migrate users across tenants in a test app I noticed that the
PasswordHash
of users I moved to the new tenant was being changed to the previous tenant'sPasswordHash
base64 encoded again. This means when a user tries to sign in with this newly imported user the correct password will be invalidAdditionally, when exporting users I noticed that some of the users'
PasswordHash
had-
and_
characters in it, so the previous function for decoding (base64.StdEncoding.DecodeString()
) would throw an error when it encountered the byte containing that character. Instead we need to use base64 URL encoding to decode, so we need a function that does just that (base64.URLEncoding.DecodeString(s)
).The hash key on the other hand can have a
/
character in it so it still requires Standard base64 encodingIn short: the user's
PasswordHash
uses a different flavor of base 64 encoding then the signer key provided in the Firebase/Cloud Console and needs to be decoded properly before uploading a user.