如何使用JWT为Google Firebase生成身份验证令牌？

Question

所以我试图验证Firebase REST API。我使用服务器端swift的Vapor框架，并安装了JWT包。

我正在尝试使用serviceAccountKey.json文件和JWT中的数据来生成身份验证令牌。

以下是我尝试过的代码：

let payload = try JSON(node: [
        "iat": Date().timeIntervalSince1970,
        "exp": Date().timeIntervalSince1970 + 3600,
        "iss": "client_email from serviceAccountKey.json",
        "aud": "https://accounts.google.com/o/oauth2/token",
        "scope": [
            "https://www.googleapis.com/auth/firebase.database",
            "https://www.googleapis.com/auth/userinfo.email"
        ]
    ])
    let privateKey = "copied from serviceAccountKey.json"

    let signer = try HS256(bytes: privateKey.bytes)

    let jwt = try JWT(payload: payload, signer: signer)
    let token = try jwt.createToken()
    print(token)

serviceAccountKey.json

{
  "type": "service_account",
  "project_id": "",
  "private_key_id": "",
  "private_key": "",
  "client_email": "",
  "client_id": "",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": ""
}

Answer 1

如果您只想让事情顺利进行，最好使用1.5.0版本

.Package(url: "https://github.com/gtchance/FirebaseSwift.git", Version(1,5,0)),

并使用遗留秘密。项目设置

Answer 2

目前，我正在使用Xcode 8.3.3。包装.swift包含：

let package = Package(
name: "StripePayment",
dependencies: [
    .Package(url: "https://github.com/vapor/vapor.git", majorVersion: 1, minor: 5),
    .Package(url:"https://github.com/vapor/jwt.git", majorVersion: 0,minor: 8),
     .Package(url: "https://github.com/SwiftyJSON/SwiftyJSON.git", versions: Version(1, 0, 0)..<Version(3, .max, .max))

],
exclude: [
    "Config",
    "Database",
    "Localization",
    "Public",
    "Resources",
    "Tests",
]
)

如果您生成服务帐户凭据，则需要牢记以下几点，该凭据取自 https://cloud.google.com/storage/docs/authentication：您可以通过为服务帐户创建 OAuth 客户端 ID，在云平台控制台中创建私钥。您可以获取 JSON 和 PKCS12 格式的私钥：

如果您在Google Cloud Platform以外的正式生产环境中使用应用程序默认凭据，则需要JSON密钥。JSON密钥无法转换为其他格式。许多不同的编程语言和库都支持PKCS12（. p12）。如果需要，您可以使用OpenSSL将密钥转换为其他格式（请参阅将私钥转换为其他格式）。但是，PKCS12密钥无法转换为JSON格式。

注意：您不需要在console.cloud.google生成服务帐户。只需按照下面列出的步骤1…6。

>

转到 https://console.firebase.google.com，单击您的项目，在“概述”旁边单击轮式设置，单击“服务帐户”，滚动到页面底部，然后单击“生成新的私钥”。

使用OpenSSL将p.12（也称为pkcs12）文件转换为.pem（也称为pkcs1）

cat/path/to/xxxx私钥。p12 |openssl pkcs12-节点-nocerts-passin pass:notasecret| openssl rsa

去github搜索VaporJWT，导入Xcode。它将帮助您创建一个签名的JSON Web令牌。

在此 github 页面上，您将学习如何提取私钥以供 RSA 使用。

在/path/to/secret中将.pem转换为der
openssl rsa。pem-输出der-输出/path/to/private.der

``

 import Vapor
 import VaporJWT

 let drop = Droplet()
 var tokenID:String!

 //set current date
 let dateNow = Date()

 // assign to expDate the validity period of the token returned by OAuth server (3600 seconds)
 var expDate = String(Int(dateNow.timeIntervalSince1970 + (60 * 60)))

// assign to iatDate the time when the call was made to request an access token
 var iatDate = String(Int(dateNow.timeIntervalSince1970))

// the header of the JSON Web Token (first part of the JWT)
 let headerJWT = ["alg":"RS256","typ":"JWT"]

 // the claim set of the JSON Web Token
 let jwtClaimSet =
   ["iss":"[e-mail]",
     "scope":"https://www.googleapis.com/auth/firebase.database",
     "aud":"https://www.googleapis.com/oauth2/v4/token",
     "exp": expDate,
     "iat": iatDate]


 //Using VaporJWT construct a JSON Web Token and sign it with RS256 algorithm
 //The only signing algorithm supported by the Google OAuth 2.0 Authorization     
 //Server is RSA using SHA-256 hashing algorithm.

  let jwt = try JWT(headers: Node(node: headerJWT), payload: Node(node:jwtClaimSet), encoding: Base64URLEncoding(), signer: RS256(encodedKey: "copy paste here what you have in private.txt as explained at point 7 above "))

 // create the JSON Web Token
  let JWTtoken = try jwt.createToken()
 let grant_type = "urn:ietf:params:oauth:grant-type:jwt-bearer" // this value must not be changed
   let unreserved = "*-._"
   let allowed = NSMutableCharacterSet.alphanumeric()
    allowed.addCharacters(in: unreserved)

// percent or URL encode grant_type
 let grant_URLEncoded = grant_type.addingPercentEncoding(withAllowedCharacters: allowed as CharacterSet)

 // create a string made of grant_type and assertion. NOTE!!! only grant_type's value is URL encoded.
 //JSON Web Token value does not need to be URL encoded
   var fullString = "grant_type=\(grant_URLEncoded!)&assertion=\(JWTtoken)"


  //pass fullString in the body parameter
   drop.get("call") { request in


    let response =  try drop.client.post("https://www.googleapis.com/oauth2/v4/token", headers: ["Content-Type": "application/x-www-form-urlencoded"], query: [:],body: fullString)

   let serverResp = response.headers
   let serverBody = response.body.bytes
      let serverJson = try JSON(bytes: serverBody!)
        print(serverJson)

     return "Success"