如何使用JWT for Google firebase生成身份验证令牌？

Question

所以我正在尝试验证Firebase REST API。 我正在使用Vapor框架服务器端swift，我安装了JWT软件包 。

我正在尝试使用serviceAccountKey.json文件和JWT中的数据来生成身份验证令牌。

这是我尝试过的代码：

let payload = try JSON(node: [
        "iat": Date().timeIntervalSince1970,
        "exp": Date().timeIntervalSince1970 + 3600,
        "iss": "client_email from serviceAccountKey.json",
        "aud": "https://accounts.google.com/o/oauth2/token",
        "scope": [
            "https://www.googleapis.com/auth/firebase.database",
            "https://www.googleapis.com/auth/userinfo.email"
        ]
    ])
    let privateKey = "copied from serviceAccountKey.json"

    let signer = try HS256(bytes: privateKey.bytes)

    let jwt = try JWT(payload: payload, signer: signer)
    let token = try jwt.createToken()
    print(token)

serviceAccountKey.json

{
  "type": "service_account",
  "project_id": "",
  "private_key_id": "",
  "private_key": "",
  "client_email": "",
  "client_id": "",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": ""
}

Answer 1

这时我正在使用Xcode 8.3.3。 Package.swift包含：

let package = Package(
name: "StripePayment",
dependencies: [
    .Package(url: "https://github.com/vapor/vapor.git", majorVersion: 1, minor: 5),
    .Package(url:"https://github.com/vapor/jwt.git", majorVersion: 0,minor: 8),
     .Package(url: "https://github.com/SwiftyJSON/SwiftyJSON.git", versions: Version(1, 0, 0)..<Version(3, .max, .max))

],
exclude: [
    "Config",
    "Database",
    "Localization",
    "Public",
    "Resources",
    "Tests",
]
)

如果您生成服务帐户凭据，则需要记住以下内容，来自https://cloud.google.com/storage/docs/authentication ：您可以通过创建OAuth客户端在Cloud Platform控制台中创建私钥服务帐户的ID。 您可以获得JSON和PKCS12格式的私钥：

如果您在Google Cloud Platform之外的生产环境中使用Application Default Credentials ，则需要JSON密钥。 JSON密钥无法转换为其他格式 。 许多不同的编程语言和库都支持PKCS12（.p12）。 如果需要，您可以使用OpenSSL将密钥转换为其他格式（ 请参阅将私钥转换为其他格式 ）。 但是，PKCS12密钥无法转换为JSON格式。

注意 ：您不需要以产生console.cloud.google.com服务帐户。 请按照下面列出的步骤1 ... 6进行操作。

1. 转到https://console.firebase.google.com ，单击您的项目，在“概述”旁边单击“轮子设置”，单击“服务帐户”，滚动到页面底部，然后单击“生成新私钥”。

2. 使用OpenSSL将p.12（aka pkcs12）文件转换为.pem（aka pkcs1）

   cat /path/to/xxxx-privatekey.p12 | openssl pkcs12 -nodes -nocerts -passin pass:notasecret | openssl rsa > /path/to/secret.pem

3. 转到github并搜索VaporJWT并将其导入Xcode。 它将帮助您创建签名的JSON Web令牌。

4. 在这个github页面上，您将学习如何提取私钥以供RSA使用。

5. 将.pem转换为der
   openssl rsa -in /path/to/secret.pem -outform der -out /path/to/private.der

6. 将.der转换为.base64
   openssl base64 -in /path/to/private.der -out /path/to/Desktop/private.txt
   在private.txt中，您拥有在base64中编码的私钥，您最终可以使用它来签署您的JWT。 然后，您可以使用已签名的JWT拨打Google API。

``

 import Vapor
 import VaporJWT

 let drop = Droplet()
 var tokenID:String!

 //set current date
 let dateNow = Date()

 // assign to expDate the validity period of the token returned by OAuth server (3600 seconds)
 var expDate = String(Int(dateNow.timeIntervalSince1970 + (60 * 60)))

// assign to iatDate the time when the call was made to request an access token
 var iatDate = String(Int(dateNow.timeIntervalSince1970))

// the header of the JSON Web Token (first part of the JWT)
 let headerJWT = ["alg":"RS256","typ":"JWT"]

 // the claim set of the JSON Web Token
 let jwtClaimSet =
   ["iss":"firebase-adminsdk-c7i38@fir-30c9e.iam.gserviceaccount.com",
     "scope":"https://www.googleapis.com/auth/firebase.database",
     "aud":"https://www.googleapis.com/oauth2/v4/token",
     "exp": expDate,
     "iat": iatDate]


 //Using VaporJWT construct a JSON Web Token and sign it with RS256 algorithm
 //The only signing algorithm supported by the Google OAuth 2.0 Authorization     
 //Server is RSA using SHA-256 hashing algorithm.

  let jwt = try JWT(headers: Node(node: headerJWT), payload: Node(node:jwtClaimSet), encoding: Base64URLEncoding(), signer: RS256(encodedKey: "copy paste here what you have in private.txt as explained at point 7 above "))

 // create the JSON Web Token
  let JWTtoken = try jwt.createToken()
 let grant_type = "urn:ietf:params:oauth:grant-type:jwt-bearer" // this value must not be changed
   let unreserved = "*-._"
   let allowed = NSMutableCharacterSet.alphanumeric()
    allowed.addCharacters(in: unreserved)

// percent or URL encode grant_type
 let grant_URLEncoded = grant_type.addingPercentEncoding(withAllowedCharacters: allowed as CharacterSet)

 // create a string made of grant_type and assertion. NOTE!!! only grant_type's value is URL encoded.
 //JSON Web Token value does not need to be URL encoded
   var fullString = "grant_type=\(grant_URLEncoded!)&assertion=\(JWTtoken)"


  //pass fullString in the body parameter
   drop.get("call") { request in


    let response =  try drop.client.post("https://www.googleapis.com/oauth2/v4/token", headers: ["Content-Type": "application/x-www-form-urlencoded"], query: [:],body: fullString)

   let serverResp = response.headers
   let serverBody = response.body.bytes
      let serverJson = try JSON(bytes: serverBody!)
        print(serverJson)

     return "Success"

Answer 2

如果你只想让事情有效，最好使用1.5.0版

.Package(url: "https://github.com/gtchance/FirebaseSwift.git", Version(1,5,0)),

并使用传统的秘密。 项目设置>服务帐户>数据库秘密