SigningError with Firebase getSignedUrl()
I'm trying to use file.getSignedUrl() to get the download URL from Firebase Storage via Google Cloud Functions (Nodejs). I'm getting this error in the Cloud Functions console:
{ SigningError: A Forbidden error was returned while attempting to retrieve an access token for the Compute Engine built-in service account. This may be because the Compute Engine instance does not have the correct permission scopes specified. Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/myapp-cd94d/serviceAccounts/myapp-cd94d@appspot.gserviceaccount.com.
at SigningError (/user_code/node_modules/@google-cloud/storage/build/src/file.js:58:9)
at authClient.sign.then.catch.err (/user_code/node_modules/@google-cloud/storage/build/src/file.js:1019:22)
at process._tickDomainCallback (internal/process/next_tick.js:135:7) name: 'SigningError' }
I copied the code from the Add the Firebase Admin SDK to Your Server documentation. I have my serviceAccountKey.json
in my functions
folder. firebase deploy
isn't given me the error
Error parsing triggers: Cannot find module 'serviceAccountKey.json'
so I must have the right path to my serviceAccountKey.json
. I even generated a new private key, that didn't fix the problem. I have firebase-admin 6.1.0
and firebase-tools 6.1.0
. Here's the relevant parts of my code:
const admin = require('firebase-admin');
var serviceAccount = require("./myapp-cd94d-firebase-adminsdk-1234x-sEcReT.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://myapp-cd94d.firebaseio.com"
});
...
const config = {
action: 'read',
expires: '03-17-2025'
};
file.getSignedUrl(config).then(function(data) {
const url = data[0];
console.log(url);
})
.catch(function(error) {
console.error(error);
})
I saw that Doug Stevenson's answer has different code but it appears to be equivalent to the code in the documentation.
firebase google-cloud-functions firebase-storage
add a comment |
I'm trying to use file.getSignedUrl() to get the download URL from Firebase Storage via Google Cloud Functions (Nodejs). I'm getting this error in the Cloud Functions console:
{ SigningError: A Forbidden error was returned while attempting to retrieve an access token for the Compute Engine built-in service account. This may be because the Compute Engine instance does not have the correct permission scopes specified. Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/myapp-cd94d/serviceAccounts/myapp-cd94d@appspot.gserviceaccount.com.
at SigningError (/user_code/node_modules/@google-cloud/storage/build/src/file.js:58:9)
at authClient.sign.then.catch.err (/user_code/node_modules/@google-cloud/storage/build/src/file.js:1019:22)
at process._tickDomainCallback (internal/process/next_tick.js:135:7) name: 'SigningError' }
I copied the code from the Add the Firebase Admin SDK to Your Server documentation. I have my serviceAccountKey.json
in my functions
folder. firebase deploy
isn't given me the error
Error parsing triggers: Cannot find module 'serviceAccountKey.json'
so I must have the right path to my serviceAccountKey.json
. I even generated a new private key, that didn't fix the problem. I have firebase-admin 6.1.0
and firebase-tools 6.1.0
. Here's the relevant parts of my code:
const admin = require('firebase-admin');
var serviceAccount = require("./myapp-cd94d-firebase-adminsdk-1234x-sEcReT.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://myapp-cd94d.firebaseio.com"
});
...
const config = {
action: 'read',
expires: '03-17-2025'
};
file.getSignedUrl(config).then(function(data) {
const url = data[0];
console.log(url);
})
.catch(function(error) {
console.error(error);
})
I saw that Doug Stevenson's answer has different code but it appears to be equivalent to the code in the documentation.
firebase google-cloud-functions firebase-storage
add a comment |
I'm trying to use file.getSignedUrl() to get the download URL from Firebase Storage via Google Cloud Functions (Nodejs). I'm getting this error in the Cloud Functions console:
{ SigningError: A Forbidden error was returned while attempting to retrieve an access token for the Compute Engine built-in service account. This may be because the Compute Engine instance does not have the correct permission scopes specified. Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/myapp-cd94d/serviceAccounts/myapp-cd94d@appspot.gserviceaccount.com.
at SigningError (/user_code/node_modules/@google-cloud/storage/build/src/file.js:58:9)
at authClient.sign.then.catch.err (/user_code/node_modules/@google-cloud/storage/build/src/file.js:1019:22)
at process._tickDomainCallback (internal/process/next_tick.js:135:7) name: 'SigningError' }
I copied the code from the Add the Firebase Admin SDK to Your Server documentation. I have my serviceAccountKey.json
in my functions
folder. firebase deploy
isn't given me the error
Error parsing triggers: Cannot find module 'serviceAccountKey.json'
so I must have the right path to my serviceAccountKey.json
. I even generated a new private key, that didn't fix the problem. I have firebase-admin 6.1.0
and firebase-tools 6.1.0
. Here's the relevant parts of my code:
const admin = require('firebase-admin');
var serviceAccount = require("./myapp-cd94d-firebase-adminsdk-1234x-sEcReT.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://myapp-cd94d.firebaseio.com"
});
...
const config = {
action: 'read',
expires: '03-17-2025'
};
file.getSignedUrl(config).then(function(data) {
const url = data[0];
console.log(url);
})
.catch(function(error) {
console.error(error);
})
I saw that Doug Stevenson's answer has different code but it appears to be equivalent to the code in the documentation.
firebase google-cloud-functions firebase-storage
I'm trying to use file.getSignedUrl() to get the download URL from Firebase Storage via Google Cloud Functions (Nodejs). I'm getting this error in the Cloud Functions console:
{ SigningError: A Forbidden error was returned while attempting to retrieve an access token for the Compute Engine built-in service account. This may be because the Compute Engine instance does not have the correct permission scopes specified. Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/myapp-cd94d/serviceAccounts/myapp-cd94d@appspot.gserviceaccount.com.
at SigningError (/user_code/node_modules/@google-cloud/storage/build/src/file.js:58:9)
at authClient.sign.then.catch.err (/user_code/node_modules/@google-cloud/storage/build/src/file.js:1019:22)
at process._tickDomainCallback (internal/process/next_tick.js:135:7) name: 'SigningError' }
I copied the code from the Add the Firebase Admin SDK to Your Server documentation. I have my serviceAccountKey.json
in my functions
folder. firebase deploy
isn't given me the error
Error parsing triggers: Cannot find module 'serviceAccountKey.json'
so I must have the right path to my serviceAccountKey.json
. I even generated a new private key, that didn't fix the problem. I have firebase-admin 6.1.0
and firebase-tools 6.1.0
. Here's the relevant parts of my code:
const admin = require('firebase-admin');
var serviceAccount = require("./myapp-cd94d-firebase-adminsdk-1234x-sEcReT.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://myapp-cd94d.firebaseio.com"
});
...
const config = {
action: 'read',
expires: '03-17-2025'
};
file.getSignedUrl(config).then(function(data) {
const url = data[0];
console.log(url);
})
.catch(function(error) {
console.error(error);
})
I saw that Doug Stevenson's answer has different code but it appears to be equivalent to the code in the documentation.
firebase google-cloud-functions firebase-storage
firebase google-cloud-functions firebase-storage
edited Nov 17 '18 at 17:38
Thomas David Kehoe
asked Nov 14 '18 at 17:30
Thomas David KehoeThomas David Kehoe
2,12711435
2,12711435
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The answer has to do with Cloud Identity and Access Management. First, go to your Google Cloud Platform IAM & admin page. You'll see various service accounts. Look for the service account that looks like myapp-cd99d@appspot.gserviceaccount.com
. It should say App Engine default service account
in the Name
column. (If an error message referenced a different service account, find that service account.)
In the Role
column, you may or not see some roles. If you're getting a SigningError
message, the Role
column is missing the role Service Account Token Creator. Check the checkbox to the left of myapp-cd99d@appspot.gserviceaccount.com
to select the service account, and then click the pencil to the right to edit it. In the next screen, click +ADD ANOTHER ROLE
. Scroll down to Service Accounts
, select Service Account Token Creator
, and save. Now you should see Service Account Token Creator
in the Roles
column for App Engine default service account
. Now you have permission to create signed tokens.
Next, repeat these steps and add a role for Storage Object Creator
. This will allow you to run getSignedURL()
.
You could save alternatively assign Service Account Admin and Storage Admin, which include the Service Account Token Creator
and Storage Object Creator
roles respectively, plus other roles.
Now, if you instead got a SingingError
message, it might be because you're warbling Bruce Springsteen's "Glory Days" out of tune. :-)
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53305784%2fsigningerror-with-firebase-getsignedurl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The answer has to do with Cloud Identity and Access Management. First, go to your Google Cloud Platform IAM & admin page. You'll see various service accounts. Look for the service account that looks like myapp-cd99d@appspot.gserviceaccount.com
. It should say App Engine default service account
in the Name
column. (If an error message referenced a different service account, find that service account.)
In the Role
column, you may or not see some roles. If you're getting a SigningError
message, the Role
column is missing the role Service Account Token Creator. Check the checkbox to the left of myapp-cd99d@appspot.gserviceaccount.com
to select the service account, and then click the pencil to the right to edit it. In the next screen, click +ADD ANOTHER ROLE
. Scroll down to Service Accounts
, select Service Account Token Creator
, and save. Now you should see Service Account Token Creator
in the Roles
column for App Engine default service account
. Now you have permission to create signed tokens.
Next, repeat these steps and add a role for Storage Object Creator
. This will allow you to run getSignedURL()
.
You could save alternatively assign Service Account Admin and Storage Admin, which include the Service Account Token Creator
and Storage Object Creator
roles respectively, plus other roles.
Now, if you instead got a SingingError
message, it might be because you're warbling Bruce Springsteen's "Glory Days" out of tune. :-)
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
add a comment |
The answer has to do with Cloud Identity and Access Management. First, go to your Google Cloud Platform IAM & admin page. You'll see various service accounts. Look for the service account that looks like myapp-cd99d@appspot.gserviceaccount.com
. It should say App Engine default service account
in the Name
column. (If an error message referenced a different service account, find that service account.)
In the Role
column, you may or not see some roles. If you're getting a SigningError
message, the Role
column is missing the role Service Account Token Creator. Check the checkbox to the left of myapp-cd99d@appspot.gserviceaccount.com
to select the service account, and then click the pencil to the right to edit it. In the next screen, click +ADD ANOTHER ROLE
. Scroll down to Service Accounts
, select Service Account Token Creator
, and save. Now you should see Service Account Token Creator
in the Roles
column for App Engine default service account
. Now you have permission to create signed tokens.
Next, repeat these steps and add a role for Storage Object Creator
. This will allow you to run getSignedURL()
.
You could save alternatively assign Service Account Admin and Storage Admin, which include the Service Account Token Creator
and Storage Object Creator
roles respectively, plus other roles.
Now, if you instead got a SingingError
message, it might be because you're warbling Bruce Springsteen's "Glory Days" out of tune. :-)
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
add a comment |
The answer has to do with Cloud Identity and Access Management. First, go to your Google Cloud Platform IAM & admin page. You'll see various service accounts. Look for the service account that looks like myapp-cd99d@appspot.gserviceaccount.com
. It should say App Engine default service account
in the Name
column. (If an error message referenced a different service account, find that service account.)
In the Role
column, you may or not see some roles. If you're getting a SigningError
message, the Role
column is missing the role Service Account Token Creator. Check the checkbox to the left of myapp-cd99d@appspot.gserviceaccount.com
to select the service account, and then click the pencil to the right to edit it. In the next screen, click +ADD ANOTHER ROLE
. Scroll down to Service Accounts
, select Service Account Token Creator
, and save. Now you should see Service Account Token Creator
in the Roles
column for App Engine default service account
. Now you have permission to create signed tokens.
Next, repeat these steps and add a role for Storage Object Creator
. This will allow you to run getSignedURL()
.
You could save alternatively assign Service Account Admin and Storage Admin, which include the Service Account Token Creator
and Storage Object Creator
roles respectively, plus other roles.
Now, if you instead got a SingingError
message, it might be because you're warbling Bruce Springsteen's "Glory Days" out of tune. :-)
The answer has to do with Cloud Identity and Access Management. First, go to your Google Cloud Platform IAM & admin page. You'll see various service accounts. Look for the service account that looks like myapp-cd99d@appspot.gserviceaccount.com
. It should say App Engine default service account
in the Name
column. (If an error message referenced a different service account, find that service account.)
In the Role
column, you may or not see some roles. If you're getting a SigningError
message, the Role
column is missing the role Service Account Token Creator. Check the checkbox to the left of myapp-cd99d@appspot.gserviceaccount.com
to select the service account, and then click the pencil to the right to edit it. In the next screen, click +ADD ANOTHER ROLE
. Scroll down to Service Accounts
, select Service Account Token Creator
, and save. Now you should see Service Account Token Creator
in the Roles
column for App Engine default service account
. Now you have permission to create signed tokens.
Next, repeat these steps and add a role for Storage Object Creator
. This will allow you to run getSignedURL()
.
You could save alternatively assign Service Account Admin and Storage Admin, which include the Service Account Token Creator
and Storage Object Creator
roles respectively, plus other roles.
Now, if you instead got a SingingError
message, it might be because you're warbling Bruce Springsteen's "Glory Days" out of tune. :-)
answered Nov 17 '18 at 18:14
Thomas David KehoeThomas David Kehoe
2,12711435
2,12711435
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
add a comment |
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
2
2
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
what i wanna know is why this isnt taken care of / documented
– galki
Dec 4 '18 at 22:50
1
1
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
"By default the service account ID you get from the Firebase console, and the ones auto-discovered via Cloud Functions do not have these permissions" from a medium article
– galki
Dec 5 '18 at 13:04
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53305784%2fsigningerror-with-firebase-getsignedurl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown