使用服务帐户凭据模式的 Firebase 分发 android 应用程序的权限被拒绝

Question

我正在尝试从 Fabric 迁移到 Firebase，因为 Fabric 将在 2020 年 3 月 31 日之后不可用。

我已经完成了第一步：向 gradle 添加插件和依赖项，添加分析 json 文件，甚至崩溃报告，一切似乎都是正确的，因为我可以在 Firebase 控制台中看到数据（分析和崩溃）。

但我没那么幸运将应用程序分发系统从 Beta+Fastlane 迁移到 Firebase。我正在尝试选项“使用 Gradle 向测试人员分发 Android 应用程序”。我已经添加了插件和依赖项，添加得很好，因为我可以运行 gradle 任务 ./gradlew appDistributionUploadMyVariant。

我从 Google Cloud Platform 控制台为名为 firebase-adminsdk 的用户（我认为这个名称是由 Firebase 系统给出的）正确项目获取 serviceCredentialsFile .用户的电子邮件是这样的 firebase-adminsdk-xxx@my_project.iam.gserviceaccount.com，它与我在 Firebase 控制台 -> 设置 -> 服务帐户 -> Firebase Admin SDK 中看到的相同。

我已经下载了带有凭据的 json 文件并且 gradle 可以找到它，因为如果输入错误的路径 - url 故意为该文件记录一个 Service credentials file does not exist。根据我上面提到的一些行，此文件的内容具有 client_email 和 project_id 的正确值。

但是我遇到了 403 错误。我粘贴一些执行任务时获得的信息./gradlew appDistributionUploadMyVariant --info（我隐藏了一些私人信息）：

Task ':app:appDistributionUploadMyVariant' is not up-to-date because:
  Task has not declared any outputs despite executing actions.
Found APK at /MyFolder/app/build/outputs/apk/qa/qaType/app-qa-qaType.apk.
Uploading APK to Firebase App Distribution...
Getting appId from output of google services plugin
-------------- REQUEST  --------------
POST https://oauth2.googleapis.com/token
Accept-Encoding: gzip
User-Agent: Google-HTTP-Java-Client/1.28.0 (gzip)
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 808

curl -v --compressed -X POST -H 'Accept-Encoding: gzip' -H 'User-Agent: Google-HTTP-Java-Client/1.28.0 (gzip)' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -d '@-' -- 'https://oauth2.googleapis.com/token' << $$$
Total: 808 bytes
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJSUzI1N(...)
-------------- RESPONSE --------------
HTTP/1.1 200 OK
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Alt-Svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
Cache-Control: private
Server: scaffolding on HTTPServer2
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Vary: Referer
Vary: X-Origin
Vary: Origin
X-XSS-Protection: 0
Date: Fri, 22 Nov 2019 14:47:29 GMT
Content-Type: application/json; charset=utf-8

Total: 207 bytes
{
  "access_token": "access_token_value",
  "expires_in": 3600,
  "token_type": "Bearer"
}
-------------- REQUEST  --------------
GET https://firebaseappdistribution.googleapis.com/v1alpha/apps/appId
Accept-Encoding: gzip
Authorization: <Not Logged>
User-Agent: Firebase App Distro Client/1.2.0
x-app-distro-api-client-id: com.google.firebase
x-app-distro-api-client-type: gradle
x-app-distro-api-client-version: 1.2.0

curl -v --compressed -H 'Accept-Encoding: gzip' -H 'Authorization: <Not Logged>' -H 'User-Agent: Firebase App Distro Client/1.2.0' -H 'x-app-distro-api-client-id: com.google.firebase' -H 'x-app-distro-api-client-type: gradle' -H 'x-app-distro-api-client-version: 1.2.0' -- 'https://firebaseappdistribution.googleapis.com/v1alpha/apps/appId'
-------------- RESPONSE --------------
HTTP/1.1 403 Forbidden
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Alt-Svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
Cache-Control: private
Server: ESF
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Vary: Referer
Vary: X-Origin
Vary: Origin
X-XSS-Protection: 0
Date: Fri, 22 Nov 2019 14:47:30 GMT
Content-Type: application/json; charset=UTF-8

Total: 126 bytes
{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

:app:appDistributionUploadMyVariant (Thread[Daemon worker Thread 8,5,main]) completed. Took 1.552 secs.
AAPT2 aapt2-3.4.1-5326820-osx Daemon #0: shutdown

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:appDistributionUploadMyVariant'.
> App Distribution failed to fetch app information: [403] The caller does not have permission

我也尝试过从 gradle 文件传递 appId 值，结果相同。

有什么想法吗？

Answer 1

错误“[403] 调用者没有权限。”是由权限问题引起的。

您能否尝试按照 this 如何创建服务帐户以及在哪里下载 json，看看它是否有效？

也欢迎您联系 firebase support 了解更多信息。 :)

Answer 2

请尝试运行

firebase logout

然后重新登录（或使用令牌）。

我遇到了同样的问题，并按照上述所有其他步骤进行操作，但均未成功。但是，当我运行带有调试标志的 firebase appdistribution:distribute --debug foo 时，我注意到我仍然登录到另一个 firebase 实例，这似乎导致了问题。

Answer 3

服务帐户的角色是：“Firebase App Distribution Admin SDK Service Agent”：

Read and write access to Firebase App Distribution with the Admin SDK

或个人 permissions.

使用服务帐户凭据模式的 Firebase 分发 android 应用程序的权限被拒绝

Permission denied with Firebase distribution android app using service account credentials mode

android

gradle

firebase

google-fabric

firebase-app-distribution