无法分配 iam.serviceAccounts.signBlob 权限

Question

TLDR; I'm having trouble assigning an IAM permission to a service account.

I'm building a test that involves minting custom tokens with firebase Auth. When I hit:

  const token = await admin.auth().createCustomToken('test', {
    isAdmin: true,
  })

the following error is thrown

Permission iam.serviceAccounts.signBlob is required to perform
this operation on service account 
projects/-/serviceAccounts/dashboard@appspot.gserviceaccount.com.;
Please refer to 
https://firebase.google.com/docs/auth/admin/create-custom-tokens
for more details on how to use and troubleshoot this feature

In the referenced documentation it says to add the Service Account Token Creator role to the service account. I have added that role (as well as tried Service Account Admin to no avail.

I can verify that my permissions seem to be correctly set, when I run gcloud projects get-iam-policy project I can see my service account attached to the desired role

- members:
  - serviceAccount:dashboard@appspot.gserviceaccount.com
  role: roles/iam.serviceAccountTokenCreator

However if I look at that specific service account, it seems to show up empty which would fall in line with my error:

gcloud iam service-accounts get-iam-policy dashboard@appspot.gserviceaccount.com
etag: ACAB

• Why would those two commands & cloud console show differing information?

I assume that whatever is causing my service account permissions to show up blank is the culprit, but I'm not sure where to debug further. It seems to me the only difference is one command is called with a project in it, but I initialize my firebase app with the project id, and have verified it with (firebase-admin).apps[0].options so it seems like a dead end.

Answer 1

Firebase mentions about this error on its docs:

https://firebase.google.com/docs/auth/admin/create-custom-tokens#failed_to_determine_service_account

You must initialize your app correctly through a JSON config file.

A simple fix would be:

1. Go to https://console.cloud.google.com/iam-admin/iam?project=PROJECT_NAME
2. Edit your default service account.
3. Add the role Service Account Token Creator

In a few minutes your project will be able to create signed tokens.

Answer 2

The sign feature of a service account requires the iam.serviceAccounts.signBlob permission. This permission is included in the Service Account Token role roles/iam.serviceAccountTokenCreator

You can assign this role at the "project" level or at the "service account" level. This is why you see different results. Assigning roles at the project level affects permissions for all service accounts. Assigning roles at the service account only affects that service account.

The key to your problem is that the caller does not have this role on service account dashboard@appspot.gserviceaccount.com . You have given the service account permission and NOT the caller. Look into your code for the service account that you used to setup the Firebase SDK.