Firebase Cloud messaging - permissions error for cloud build deployed app

Question

I have a java spring boot backend app, that I am trying to hook up to Firebase Cloud Messages. I have an android app that uses firebase and I am trying to use this backend to push notifications.

I've generated a private key from firebase console project settings, placed the json file - and the following worked LOCALLY perfectly:

try {
  FirebaseOptions options = new FirebaseOptions.Builder()
    .setCredentials(GoogleCredentials.fromStream(new ClassPathResource("PATH_TO_GENERATED_JSON").
  getInputStream())).build();
  if (FirebaseApp.getApps().isEmpty()) {
    FirebaseApp.initializeApp(options);
    logger.info("Firebase application has been initialized");
  }
} catch (IOException e) {
  logger.error(e.getMessage());
}
...
response = FirebaseMessaging.getInstance().send(message);

I have set up google cloud build to automatically trigger and build from github. But I cannot commit the json credentials file (right?), so for cloud deployment I have changed the initialization part to:

if (FirebaseApp.getApps().isEmpty()) {
  FirebaseApp.initializeApp();
  logger.info("Firebase application has been initialized");
}

But I have received errors information about project id not set, so I have also edited the cloud build trigger inline YAML with:

--update-env-vars=GOOGLE_CLOUD_PROJECT=XXXXXXXXXXX

But now I am getting the following error when trying to send the message:

com.google.firebase.messaging.FirebaseMessagingException: Permission 'cloudmessaging.messages.create' denied on resource '//cloudresourcemanager.googleapis.com/projects/XXXXXXXXXXX' (or it may not exist). (XXXXXXXXXXX being my project id)

I've started giving "Firebase Cloud Messaging Admin" role left and right on https://console.cloud.google.com/iam-admin/iam?project= but that didn't help :(

Can anyone help?

Adding stack trace:

com.google.firebase.messaging.FirebaseMessagingException: Permission 'cloudmessaging.messages.create' denied on resource '//cloudresourcemanager.googleapis.com/projects/our-shield-329019' (or it may not exist).
    at com.google.firebase.messaging.FirebaseMessagingException.withMessagingErrorCode(FirebaseMessagingException.java:51)
    at com.google.firebase.messaging.FirebaseMessagingClientImpl$MessagingErrorHandler.createException(FirebaseMessagingClientImpl.java:293)
    at com.google.firebase.messaging.FirebaseMessagingClientImpl$MessagingErrorHandler.createException(FirebaseMessagingClientImpl.java:282)
    at com.google.firebase.internal.AbstractHttpErrorHandler.handleHttpResponseException(AbstractHttpErrorHandler.java:57)
    at com.google.firebase.internal.ErrorHandlingHttpClient.send(ErrorHandlingHttpClient.java:108)
    at com.google.firebase.internal.ErrorHandlingHttpClient.sendAndParse(ErrorHandlingHttpClient.java:72)
    at com.google.firebase.messaging.FirebaseMessagingClientImpl.sendSingleRequest(FirebaseMessagingClientImpl.java:127)
    at com.google.firebase.messaging.FirebaseMessagingClientImpl.send(FirebaseMessagingClientImpl.java:113)
    at com.google.firebase.messaging.FirebaseMessaging$1.execute(FirebaseMessaging.java:137)
    at com.google.firebase.messaging.FirebaseMessaging$1.execute(FirebaseMessaging.java:134)
    at com.google.firebase.internal.CallableOperation.call(CallableOperation.java:36)
    at com.google.firebase.messaging.FirebaseMessaging.send(FirebaseMessaging.java:104)
    at com.google.firebase.messaging.FirebaseMessaging.send(FirebaseMessaging.java:86)
    at com.miloszdobrowolski.investobotbackend.InvestobotAPIs.testNotification(InvestobotAPIs.java:120)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:568)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:655)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1726)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: com.google.api.client.http.HttpResponseException: 403 Forbidden

Acetylide

Answer 1

As listed in the Understanding Roles documentation, Firebase Cloud Messaging Admin does not have a cloudmessaging.messages.create permission. In order to add this permission, use one of the following roles:

1. Firebase Admin (roles/firebase.admin)
2. Firebase Grow Admin (roles/firebase.growthAdmin)
3. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
4. Firebase SDK Provisioning Service Agent (roles/firebase.sdkProvisioningServiceAgent)

Arbuthnot

I could swear I've seen somewhere i documentation that that role is in Admin :/ Well, this of course have solved my problem, thank You! – Backdrop

Thanks. It's infuriating that you can't seem to search roles by permission, at least not in the place that you apply them. – Liselisetta

Just spent a day with this issue. Thank you! – Rabon

I tried adding each of those 4 roles and in each case when I clicked View Permission Diff it did not show cloudmessaging.messages.create in the list. Should I ignore that and try them anyway? – Derekderelict

Answer 2

you need to assign some Firebase role to the Gmail account you are using to send the Push notifs

Muslin

After adding roles, how can I make use of it? I have generated a new private key in service accounts section of Project Settings but still I'm getting the same error if I use the newly created json – Yvor