Service Account credentials file not readable or invalid about firebase-bundle HOT 23 CLOSED

In the meantime, if possible, please set the environment variable FIREBASE_CREDENTIALS to the path of the credentials file in your project, then the autodiscovery of the Firebase SDK should pick it up.

I'll rewrite the bundle from scratch for Symfony ^3.4 and ^4.2 (those two are officially supported) and create a new major release once it's ready (and a PR so that you can test it beforehand)

from firebase-bundle.

@kylenoland @JordanProtin Could you please update to release 1.3 of the bundle and see if and how the behaviour changes? The new release includes changes in the SDK and in the configuration handling:

• The handling of environment variables has been improved when using autodiscovery (this seems to be an issue especially on Windows machines (thanks again @Shifu33 for your help in the kreait Discord)
• Credential autodiscovery is now disabled when the credentials configuration option has been set. This prevents triggering it when there is a problem with the configured credentials.

This should help at least narrowing down the issue a little, if it doesn't fix it 🤞- please let me know what you find out!

from firebase-bundle.

Thank you for your quickly answer !

Yes, using different service accounts could have been the reason, but I don't think..
Indeed, as I have said, I've tried to use cURL requests in order to make sure that this error comes from your bundle or not. Using this (bad) solution, it's not necessary to put a service_account.json file (cURL request requires only the FCM server key).

Indeed, maybe there is a delay before Google accepts Apple APN auth key, I don't know..
For sure, using APN auth key is supposed to ease all that configuration. You have to just to create a key from your apple account developer and download it. Then, you have to import this key into your firebase cloud messaging part and fill in some fields (team id, bundle id, etc.), just it.

I have to work about this issue tomorrow, I keep you informed !
Thank you for your support @jeromegamez 😁

from firebase-bundle.

I will have a look at this shortly - in the meantime, could you please check out https://github.com/jeromegamez/firebase-php-examples and compare your project setup with the setup in the repo? I worked with it just yesterday and it worked (for me™)

from firebase-bundle.

For sure, thank you for your quickly answer.
For information, I've used FIREBASE_CREDENTIALS env variable and it's works !
But this doesn't work from .yaml config file.
I'll check out your project meantime.

Thk's

from firebase-bundle.

I just noticed that you've put the configuration in %kernel.project_dir%/config/firebase/firebase.yaml, but the correct location is %kernel.project_dir%/config/packages/firebase.yaml - otherwise the configuration will not be processed (see Container configuration in the default app kernel in 4.x).

That should be the reason why using the environment variable works, but the config doesn't.

from firebase-bundle.

Indeed, but I get same result with the correct location using the config...
Probably this is cache error or maybe I've to rebuild my symfony project.
I continue to investigate about it...
Thank you for your help

from firebase-bundle.

I have the same error on Symfony 3.4.

In config.yml:

kreait_firebase:
    projects:
        myproject:
            public: true
            default: true
            credentials: '%kernel.project_dir%/config/firebase_credentials.json'
            database_uri: 'redacted'
            alias: 'firebase'

It appears that in CredentialsLoader::fromWellKnownFile() it is looking for the json file at /root/.config/gcloud/application_default_credentials.json

from firebase-bundle.

This should only be one of the fallback discovery strategies when the configured path doesn‘t work - but this obviously doesn‘t... work 🙄

I‘ll test this today or tomorrow and will have a fix soon!

from firebase-bundle.

@jeromegamez I don't see anywhere in the Factory class where you have access to the kreait_firebase key from the config.yml file to read the service account json file location. Everything in this class and all the various Discovery classes rely on hard coded URLs or the server env.

from firebase-bundle.

Uuh, you're right, what an oversight 🤦‍♂, in my manual tests I always used the default environment variables 🤦‍♂.

I'm working on a fix, but it will probably take a while, as I have to rewrite the tests as well - they obviously don't cut it, and .my Symfony Bundle Skills are rusty, very rusty ^^

from firebase-bundle.

I just tried to troubleshoot the issue, but unfortunately wasn't able to reproduce it.

In the issue description, the screenshot indicates that the configured path to the credentials JSON file is not taken into account, otherwise the auto-discovery strategies (using e.g. the FIREBASE_CREDENTIALS or GOOGLE_APPLICATION_CREDENTIALS environment variables wouldn't have been triggered).

I used https://github.com/jeromegamez/firebase-php-examples as the project for my tests and changed the settings from using the .env file to hardcoded paths to my credentials file, and everything still worked.

I don't see anywhere in the Factory class where you have access to the kreait_firebase key from the config.yml file to read the service account json file location. Everything in this class and all the various Discovery classes rely on hard coded URLs or the server env.

The key is defined in

The configuration is processed in https://github.com/kreait/firebase-bundle/blob/master/DependencyInjection/FirebaseExtension.php#L75-L77 and passed to the Factory, where the credentials configuration is read to determine the path to the credentials file.

To reiterate: in Symfony 4, the configuration for the Firebase PHP SDK should be in one of those locations:

• config/*.yaml
• config/packages/*.yaml
• config/packages/dev/*.yaml
• config/packages/prod/*.yaml

I also set up a Symfony 3.4 project to check if the locations differ, but they seem to be the same.

I'd like to invite you to the kreait Discord, where we could perhaps troubleshoot this more easily (perhaps with a screen sharing session or something). You can the link to it in the README file.

from firebase-bundle.

Hello, I have the same issue but it's appear randomly ... When I call a route who using your firebase package sometimes I have this issue :

Kreait\Firebase\ServiceAccount\Discovery\FromEnvironmentVariable: The environment variable "FIREBASE_CREDENTIALS" is not set.
Kreait\Firebase\ServiceAccount\Discovery\FromEnvironmentVariable: The environment variable "GOOGLE_APPLICATION_CREDENTIALS" is not set.
Kreait\Firebase\ServiceAccount\Discovery\FromGoogleWellKnownFile: The well known file is not readable or invalid
cURL error 6: Could not resolve host: metadata.google.internal (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)

and sometimes it's work great.

I also put :

FIREBASE_CREDENTIALS=path_to_my_credentials.json

in my .env.local

I don't understand why sometimes it's okay and sometimes it's not okay ... but I hope this will be fix soon !

Great work by the way

EDIT : I'm using Symfony 4.2.5

EDIT 2 : Maybe it's linked to this : symfony/recipes#532 ?

from firebase-bundle.

Work like a charm for me, thanks to you for the release !

from firebase-bundle.

Hi @jeromegamez !

Thank you for your help.

I have just test your last update using the release 1.3 but I get the same issue..

Conclusion : credentials configuration option in firebase.yaml config file doesn't work, but this works using the .env variable FIREBASE_CREDENTIALS from my .env file in Symfony !

from firebase-bundle.

Hi @jeromegamez !

It's always me ! Thank you for your work !
Your bundle works fine in dev mode, but when I put my symfony app on a production server, I get an error :

Client error: `POST https://fcm.googleapis.com/v1/projects/{project_number}/messages:send` resulted in a `401 Unauthorized` response:\n
    {\n
      "error": {\n
        "code": 401,\n
        "message": "Auth error from APNS or Web Push Service",\n
        "status": "UNAUTHENTICATE (truncated...)\n
    """

Do you have an idea about this ?
I try to solve this since 1 day ago, without good results...

from firebase-bundle.

Is {project_number} in the output of the error, or did you change it after copy pasting it?

Do you use the same service account on dev and on prod? If you do, could you try using a different one for prod? If you don't, does the one on prod have the same permissions as the one on dev?

Also, all Errors should have been wrapped in a Kreait\Firebase\Exception\MessagingException, so I don't know where your error is coming from. If you had a messaging exception, you could to

try {
    // Whatever you're doing
} catch (\Kreait\Firebase\Exception\MessagingException $e) {
    print_r($e->errors());
    exit;
}

In general: if you provide me only with an error message, there's not much I can help with except by asking questions and giving suggestions on how to find out more. I could help much better if you provided me with something that I can reproduce, otherwise I can't do much else then guess what's going on on a system that I've never seen 😅

from firebase-bundle.

For sure, I'v changed it by my firebase project number when I call this API (it was for the example).

Indeed, this error comes from Kreait\Firebase\Exception\MessagingException.

However, since my last posted message, I tried to use cURL requests in order to make sure that this error comes from your bundle or not. And I think it's because of my firebase and apple account developer configuration and not by your bundle (great work in passing).
All works fine on Android, but not on iOS. I use APN Auth Key using iOS and I think something is broken with this, but I don't know exactly... Do you think it's about the service account permissions ?

You're right ! But I followed your documentation to build a FCM sending and it works great in dev mode. So it's unnecessary to put my code according to me..
To be honest, I was hoping that you already met this error ..

Thank you for you help ! :)

from firebase-bundle.

Unfortunately I haven‘t seen this error yet :/. I was asking if you were using different service accounts, because I don‘t know if there is some kind of „protection“ on Google‘s or Apple‘s ends like „Wait a minute: this service account was used from this IP address (dev) two minutes ago, and now it‘s being used from a completely different IP address (prod), there‘s something fishy“ or something like this... testing with different service accounts or with the same (depending on the opposite of what what you currently have) would at least help answer the question if this could be the reason...

It also could be that this is a (hopefully) temporary hiccup on Google‘s side when transferring the APN payload to Apple - I haven’t used Apple push notifications yet, but do you have to register a new authentication key and put it somewhere in the Firebase Console? In this case I could imagine that Apple says: you can‘t use the same key for client-sent Notifications (from an iOS device) and Server-Sent Notifications (with an Admin SDK)

Please let me know if you find a solution to this or found out something more - it‘s an interesting problem, and if solved, I could add it to the troubleshooting section in the docs! 🤞

Edit: Doesn‘t seem to be a hiccup :/ https://status.firebase.google.com/

from firebase-bundle.

For sure, I'v changed it by my firebase project number when I call this API (it was for the example).

Indeed, this error comes from Kreait\Firebase\Exception\MessagingException.

However, since my last posted message, I tried to use cURL requests in order to make sure that this error comes from your bundle or not. And I think it's because of my firebase and apple account developer configuration and not by your bundle (great work in passing).
All works fine on Android, but not on iOS. I use APN Auth Key using iOS and I think something is broken with this, but I don't know exactly... Do you think it's about the service account permissions ?

You're right ! But I followed your documentation to build a FCM sending and it works great in dev mode. So it's unnecessary to put my code according to me..
To be honest, I was hoping that you already met this error ..

Thank you for you help ! :)

hello @JordanProtin can u share the apis i can use to manually call firebase

from firebase-bundle.

For sure, I'v changed it by my firebase project number when I call this API (it was for the example).
Indeed, this error comes from Kreait\Firebase\Exception\MessagingException.
However, since my last posted message, I tried to use cURL requests in order to make sure that this error comes from your bundle or not. And I think it's because of my firebase and apple account developer configuration and not by your bundle (great work in passing).
All works fine on Android, but not on iOS. I use APN Auth Key using iOS and I think something is broken with this, but I don't know exactly... Do you think it's about the service account permissions ?
You're right ! But I followed your documentation to build a FCM sending and it works great in dev mode. So it's unnecessary to put my code according to me..
To be honest, I was hoping that you already met this error ..
Thank you for you help ! :)

hello @JordanProtin can u share the apis i can use to manually call firebase

Hello @sara-maarouf, what do you mean ? I've used this firebase bundle to call Firebase API

from firebase-bundle.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

from firebase-bundle.

Remember: on linux place firebase config files etc in a folder that user 'apache' can read! So, for example, do not place such files in /home/myname/firebase.json. Even if you go chmod 777 firebase.json, this file may not be accessible by user 'apache', hence the 404....

Then you do not need to use env variables. $factory = (new Factory())->withServiceAccount(DIR.'/vendor/firebase-adminsdk.json');

from firebase-bundle.