1

I have an iOS app that I'd like to restrict access to, making it only available to users from a specific email domain. The app requires the users to log in using their Google Account. I've found various answers online that suggested adding 

".read": "auth.token.email.endsWith('gmail.com')"

But that doesn't seem to return an error in the sign in page, but only when the user in question tries to access the database. Any suggestions?

cyril
  • 3,020
  • 6
  • 36
  • 61

3 Answers3

1

You will have to enforce that. You have multiple tools to do so:

  1. After signInWithCredential resolves, you can check the domain and that it is a google.com provider. If you are allowing email/password users, you need to verify those too. If the user doesn't meet your criteria, use the delete API on the user and issue an error to the user that they need to sign in with a certain account.

  2. Enforce the check in your rules, as you can't always trust the client. Ensure that if a user signs up, and isn't deleted, he/she can't access the data.

  3. Use Firebase functions which has a trigger for user creation. On user creation, check your criteria is met, if not, use the firebase-admin module to delete that user.

  4. If you are using the Google sign-in library for iOS to get the Google credential, you can check the Google user email and Google ID token before you signInWithCredential in Firebase and block the sign in attempt.

  5. Write your own clean up script: If you are hosting your own server and do not want to use Firebase Functions, you can run a daily script that downloads all your users using the Firebase CLI SDK and then deletes all users using firebase-admin SDK that do no match your criteria.

bojeil
  • 29,642
  • 4
  • 69
  • 76
0

Since the required email domain is @gmail.com, you could just disable the email and password and enable the Google sign in method in your Firebase console. So, the only way a user can sign in on your app is with a Google account.

https://firebase.google.com/docs/auth/ios/google-signin

guichristovao
  • 450
  • 4
  • 6
0

Include the email and password sign up option and just check for domains within your app. This will be a simple string comparison test on the email address.

Or just spin up a server to which you'll be sending the emails to for verification. This way you wouldn't have to push out new updates every time you add an extra domain. You can try and see if cloud functions would be helpful instead of spinning up a new server.

eshirima
  • 3,837
  • 5
  • 37
  • 61