Signing users with email link, not working with GCIP

MrVentzi commented 3 years ago

[REQUIRED] Describe your environment

Operating System version: Windows 10
Browser version: Version 91.0.4472.124
Firebase UI version: _____
Firebase SDK version: _____ "firebase": "^8.6.8", "firebaseui": "^4.8.0", "gcip-iap": "^0.1.4",

[REQUIRED] Describe the problem

Steps to reproduce:

Everything else works (e.g. SAML, Google, Microsoft, Email/Password) but the passwordless login doesn't. Just says invalid mode and that's it.

Relevant Code:

Below is the code I have, although doesn't seem like the firebase sandbox can run it. It runs on a nodejs server on my local currently (behind a dns ventsi.xxxxx.com).

import { firebase } from '@firebase/app';
import "firebase/auth";
import * as firebaseui from 'firebaseui'
import * as ciap from 'gcip-iap';

const configs = {
    "API_KEY": {
        authDomain: 'myproject.firebaseapp.com',
        displayMode: 'identifierFirst', //  identifierFirst / optionFirst
        callbacks: {
            selectTenantUiShown: () => {
            },
            selectTenantUiHidden: () => {
            },
            signInUiShown: (tenantId) => {
            },
            beforeSignInSuccess: (user) => {
                return Promise.resolve(user);
            }
        },
        tenants: {
            "xxxxxx-bey29": {
                displayName: 'TEST',
                signInOptions: [
                    {
                        provider: firebase.auth.EmailAuthProvider.PROVIDER_ID,
                        signInMethod: firebase.auth.EmailAuthProvider.EMAIL_LINK_SIGN_IN_METHOD,
                        hd: 'xxxxx.com',
                        forceSameDevice: false,

                        emailLinkSignIn: function() {
                            return {
                                url: window.location.href,
                                handleCodeInApp: true,
                                canHandleCodeInApp: false,
                            };
                        }
                    },
                ],
                signInFlow: 'redirect'
                // immediateFederatedRedirect: true,
            },
        },
    },
};

const handler = new firebaseui.auth.FirebaseUiHandler(
    '#firebaseui-auth-container', configs);
const ciapInstance = new ciap.Authentication(handler);
ciapInstance.start();

sam-gc commented 3 years ago

Hi @MrVentzi, thanks for the detailed info. Would you mind sharing what kinds of errors are returned over the network (i.e. from the network tab in your debugger)? That might help us pinpoint the issue more precisely.

MrVentzi commented 3 years ago

Hi @sam-gc

ventsi.mydomain.com.har.zip Above is a har export with redacted strings. invalid_mode

From what i can tell, there is no errors across the network requests/responses. It seems to happen on the app side.

Let me know if you need me to provide anything else.

Keen to get this working as it is an MVP requirement for our new auth app.

sam-gc commented 3 years ago

I believe getting to the root of this issue is going to require more details about your app/setup. Would you mind following up with Cloud Support? They're better equipped to handle issues like this. https://console.cloud.google.com/support

bojeil-google commented 3 years ago

Hey @MrVentzi something is wrong with your continue URL. I am unable to decodeURIComponent() on it. Can you provide more details on how you are configuring this in FirebaseUI?

Separately, I also noticed you are using IAP with GCIP. If so, you need to ensure the flow ends on the same browser.

bojeil-google commented 3 years ago

Actually, I just realized, email link sign in won't work with IAP even in the same browser. The mode field is also used by IAP. FirebaseUI can't handle IAP modes and IAP sign in page handler can't handle these out of band modes.

We should probably document that email link sign in is not supported by IAP.

The error you are seeing is from the IAP library and not FirebaseUI.

MrVentzi commented 3 years ago

Thanks for the info @bojeil-google. It does however sound like a bug rather than intended incompatibility.

Considering the email provider works just fine when using passwords, it feels like it should work with email link as well.

How do we go about getting this to work?

mfriedy commented 1 year ago

Hi, is there any update / suggested workaround for this? Using email links to sign into IAP is exactly the solution I'm looking for

firebase / firebaseui-web