Firebase Auth with SAP CAP

[sakshamjain]

What is Authentication & Authorisation

Authentication and authorization are two fundamental concepts in the field of information security and access control. They are closely related but distinct processes that work together to ensure security and proper access to resources within a system or application. Authentication is the process of verifying the identity of a user or entity attempting to access a system or resource.

Authorization, also known as access control, is the process of granting or denying access rights and permissions to authenticated users or entities based on their roles, privileges, and permissions.

The SAP Authorization and Trust Management service lets you manage user authorizations and trust identity providers. Identity providers are the user base for applications. User authorizations are managed using technical roles at the application level, which can be aggregated into business-level role collections for large-scale cloud scenarios.

Why Firebase

You may wonder why to use Firebase Authentication when SAP Authorization and Trust Management service is more suited for enterprise-level applications for user authentication.

If a customer is currently using Firebase as their authentication service but still wants to leverage SAP CAP Framework, there is a way to achieve this.

The basic idea is that the Firebase SDK can be used to authenticate users with Firebase, and then a CAP service implementation to validate the authentication.

Getting Started

Firebase Auth Service and SAP CAP Service are two powerful technologies that can work together to create secure and scalable applications. Firebase Auth Service is a backend service that provides user authentication and authorization, while SAP CAP Service is a framework for building enterprise-grade applications. In this blog, we will explore how to use Firebase Auth Service with SAP CAP Service.

Before we begin, it is important to note that SAP CAP Service is built on top of Node.js, which means that we can use Node.js packages in our CAP Service application. One such package is firebase-admin, which allows us to use Firebase Auth Service in our Node.js application.

Step 1: Set up Firebase Auth Service

To use Firebase Auth Service with SAP CAP Service, we need to first set up a Firebase project and enable the Auth Service. Follow these steps to set up Firebase Auth Service:

1. Go to the Firebase Console and create a new project.


2. Once the project is created, click on the "Authentication" tab and enable the Auth Service.


3. Choose the authentication methods you want to use, such as email and password, Google, or Facebook.


4. Once the Auth Service is enabled, Firebase will generate a configuration object that contains the necessary credentials for accessing the Auth Service.

Step 2: Install the firebase-admin package

To use Firebase Auth Service in our SAP CAP Service application, we need to install the firebase-admin package. To install the package, run the following command in the terminal:

npm install firebase-admin --save

Step 3: Configure Firebase Admin SDK

Now that we have installed the firebase-admin package, we need to configure it with the credentials generated by Firebase. To do this, we need to create a service account in Firebase and download the credentials file. Follow these steps to download the credentials file:

1. Go to the Firebase Console and click on the "Settings" icon.


2. Click on the "Service Accounts" tab and then click on the "Generate New Private Key" button.


3. Save the credentials file to your local machine.

Now that we have the credentials file, we can configure the Firebase Admin SDK by adding the following code to our SAP CAP Service application by navigating to srv folder and defining a service implementation.

The easiest way to add service implementations is to simply place equally named .js  files next to the .cds  files containing the respective service definitions.

// Example

srv/

  schema.cds

  schema.js

Here is an example of how service implementation will look like.

// Firebase-Admin Configuration

const firebaseAdmin = require('firebase-admin');

const credentials = require('../credentials.json');



firebaseAdmin.initializeApp({

    credential: firebaseAdmin.credential.cert(credentials)

});

Make sure to replace "../credentials.json" with the path to your credentials file.

Step 4: Authenticate users with Firebase Auth Service

Now that we have set up Firebase Auth Service and configured the Firebase Admin SDK, we can use Firebase Auth Service to authenticate users in our SAP CAP Service application.

Register event handlers with service definition to perform a auth check before any API calls.

// Firebase-Admin Configuration

const firebaseAdmin = require('firebase-admin');

const credentials = require('../credentials.json');



firebaseAdmin.initializeApp({

    credential: firebaseAdmin.credential.cert(credentials)

});



// Event Handler

const cds = require('@sap/cds')

module.exports = function () {

    this.before(['*'], `User`, async (req) => {

        let authToken = req.headers.authorization;

        if (authToken == undefined || authToken == null) {

            req.error(400, 'Bad Request');

        } else {

            authToken = authToken.replace('Bearer ', '');

            try {

                await firebaseAdmin.auth().verifyIdToken(authToken);

            } catch (error) {

                return req.error(401, 'Unauthorised');

            }

        }

    });

}

In this example, I am using the "verifyIdToken" method of the Firebase Auth Service to verify the user's ID token. If the ID token is valid, the method returns a decoded token object that contains the user info.

Architecture

Conclusion

To sum up, using Firebase Auth Service with SAP CAP Service can enhance the security and scalability of your application. Firebase Auth Service provides a reliable and easy-to-use backend for user authentication and authorization, while SAP CAP Service offers a robust framework for building enterprise-grade applications. By combining these technologies, you can create a seamless user authentication and authorization experience while ensuring that your application meets the highest security standards.