OpenID Connect Firebase Authentication error

Unity Services
, ,
1

Hello! I am a reasonably new developer attempting to sign into Unity Authentication with OpenID Connect in order to use other UGS like Cloud Save and Economy. After a bit of research, I managed to cobble together a flow that works something like this:

  1. Create a Firebase project, link it with Unity, and register Firebase as an OIDC provider in my Unity project. (WORKING, however, unsure if I have registered Firebase as an OIDC provider properly!)
  2. Use Firebase API to register and login users using email/password (WORKING)
  3. Use the TokenAsync() method on the resultant FirebaseUser object in order to get what I believe to be the id token of the user (WORKING)
  4. Use that token along with the oidc ID provider that I have registered Firebase with Unity as in order to successfully SignInWithOpenIdConnectAsync() (NOT WORKING).

Essentially, when I try to sign in using the token that I am getting from the FirebaseUser using the TokenAsync method, I get the following error:

[Authentication]: Request completed with error: {“title”:“PERMISSION_DENIED”,“detail”:“invalid audience”,“details”:[ ],“status”:401}

Here is a screenshot of the ID provider I have registered with Unity in my project (I have ommitted some of the ID for privacy. I think this might be where the error is coming from?):

8749791--1185393--upload_2023-1-23_1-52-40.png
8749791--1185393--upload_2023-1-23_1-52-40.png874Ă—377 16.7 KB

Any insight into the OpenID Connect process and its integration with UGS would be extremely valuable since the documentation and forum posts out there are few and far between.

Thank you!

8749791--1185384--upload_2023-1-23_1-44-56.png

2

Nailed it myself. For those interested:

The issue was with the ID provider registration in Unity (project settings or dashboard). I had to find the correct client ID and issuer URL in order to get past this error.

For those wondering how to do this for Firebase (or perhaps for other OIDC providers as well) this is what I did.

For Firebase:

client ID = project ID. Should probably look like “name-123456”.

issuer url: https://securetoken.google.com/projectId

More general approach:

Try to get an ID token from your OIDC provider (for Firebase, call TokenAsync() on a FirebaseUser object). Then, decode the token (I used jwt.io) and try to find the client id and issuer url in the token’s payload. For me, the client ID was in the “aud” field and the issuer URL was in the “iss” field.

Good luck.

4 Likes
3

I would pay you money to see how you did this from step 1. Ridiculously hard to find documentation/support on how to basically: authenticate user with email and pw and make it work with UGS.

1 Like
4

Yes, tutorial for Step 0 please! @Seforius