Unable to login to CLI after getting The caller does not have permission

Google Cloud Serverless Applications
1

I logged out after getting the error: The caller does not have permission from the command: firebase deploy. Tried to log back in and now getting the error: Error: Failed to authenticate, have you run firebase login?

When I run this command: firebase login --debug

I get the following:

[2023-11-17T03:25:04.577Z] > command requires scopes: [“email”,“openid”,“https://www.googleapis.com/auth/cloudplatformprojects.readonly”,“https://www.googleapis.com/auth/firebase”,“https://www.googleapis.com/auth/cloud-platform”]

[2023-11-17T03:25:07.590Z] Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.

at GoogleAuth.getApplicationDefaultAsync (/opt/homebrew/lib/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:183:19)

at processTicksAndRejections (node:internal/process/task_queues:95:5)

at runNextTicks (node:internal/process/task_queues:64:3)

at listOnTimeout (node:internal/timers:537:9)

at process.processTimers (node:internal/timers:511:7)

at async GoogleAuth.getClient (/opt/homebrew/lib/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:565:17)

at async GoogleAuth.getAccessToken (/opt/homebrew/lib/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:587:24)

at async autoAuth (/opt/homebrew/lib/node_modules/firebase-tools/lib/requireAuth.js:25:19)

at async requireAuth (/opt/homebrew/lib/node_modules/firebase-tools/lib/requireAuth.js:65:20)

at async Command.resolveProjectIdentifiers (/opt/homebrew/lib/node_modules/firebase-tools/lib/command.js:206:13)

Error: Failed to authenticate, have you run firebase login?

Any ideas?

2

Hi @ltshannon ,

Can you try? firebase login --no-localhost

Kind Regards,

SanketK

3

This what I get:

MacBook-Air-2:functions larry$ firebase login --no-localhost

Error: Failed to authenticate, have you run firebase login?

(node:67196) MetadataLookupWarning: received unexpected error = Invalid response from metadata service: incorrect Metadata-Flavor header. code = UNKNOWN

(Use node --trace-warnings ... to show where the warning was created)

Having trouble? Try firebase [command] --help

If I run: node --trace-warnings …

I get:

node:internal/modules/cjs/loader:1093

throw err;

^

Error: Cannot find module ‘/Users/larry/Desktop/PHaR/PetHelpAndRescue-function/functions/…’

at Module._resolveFilename (node:internal/modules/cjs/loader:1090:15)

at Module._load (node:internal/modules/cjs/loader:934:27)

at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:83:12)

at node:internal/main/run_main_module:23:47 {

code: ‘MODULE_NOT_FOUND’,

requireStack:

}

Node.js v19.7.0

4

Hi @ltshannon ,

Can you try the following?

  1. Create a json key file via the Google Cloud Console by following the steps here:

https://developers.google.com/workspace/guides/create-credentials#create_credentials_for_a_service_account

  1. Once you create it, it will be downloaded to your MacBook.

  2. Execute the export command:

export GOOGLE_APPLICATION_CREDENTIALS="/YourNewKey.json"

  1. Then try the login again:

firebase login

Kind Regards,

SanketK

5

Thanks, that got me logged in and now I’m getting this on firebase deploy:

=== Deploying to ‘ahnow-pet-safety-rescue-test’…

i deploying firestore, functions

i firestore: reading indexes from firestore.indexes.json…

i cloud.firestore: checking firestore.rules for compilation errors…

Error: HTTP Error: 403, The caller does not have permission

1 Like
6

Hi @ltshannon ,

Great, we are half way there!

This now boils down to IAM permissions. Can you review this documentation and make sure the required IAM permissions are assigned to your Service Account?

https://firebase.google.com/docs/projects/iam/permissions#functions

Kind Regards,

SanketK

7

Still getting error:

Error: HTTP Error: 403, The caller does not have permission

on command : firebase deploy

I have set the IAM permissions on my email

Screenshot 2023-11-18 at 7.01.57 AM.png
Screenshot 2023-11-18 at 7.01.57 AM.png1958×216 16.7 KB

8

Thanks , this working for me too

9

more info from firebase deploy --debug:

[2023-11-18T21:33:09.948Z] <<< [apiv2][body] POST https://iam.googleapis.com/v1/projects/227941583523/serviceAccounts/227941583523@appspot.gserviceaccount.com:testIamPermissions {“error”:{“code”:404,“message”:“Unknown service account”,“status”:“NOT_FOUND”}}

[2023-11-18T21:33:09.949Z] [functions] service account IAM check errored, deploy may fail: HTTP Error: 404, Unknown service account {“name”:“FirebaseError”,“children”:,“context”:{“body”:{“error”:{“code”:404,“message”:“Unknown service account”,“status”:“NOT_FOUND”}},“response”:{“statusCode”:404}},“exit”:1,“message”:“HTTP Error: 404, Unknown service account”,“status”:404}

10

Hi @ltshannon ,

Thank you for sharing the logs.

  1. Can you confirm if this service account is present in the project? 227941583523@appspot.gserviceaccount.com

Refer: https://cloud.google.com/appengine/docs/legacy/standard/python/service-account#:~:text=The%20App%20Engine%20default%20service%20account%20is%20associated%20with%20your,Editor%20role%20in%20the%20project.
AND
https://cloud.google.com/functions/docs/securing/function-identity#default ← Modifying permissions on default service account.

  1. If not already enabled, can you try to manually enable app engine within this project. This should trigger a default app engine service account creation.

The idea is to have a default app engine service account in place with the right permissions to successfully execute this command. This service account is being used for certain tasks within this deploy function and since it is non existent/deleted, the tasks are failing.

Kind Regards,
SanketK

11

@ltshannon ,

Additionally, please ensure the latest firebase tools are installed:

npm install -g firebase-tools@latest

Kind Regards,

SanketK

12

Hi SanketK,

Yes I have a service account present but it is not named: 227941583523@appspot.gserviceaccount.com

it is named: ahnow-pet-safety-rescue-test@appspot.gserviceaccount.com

Another question, how do I do this:

“manually enable app engine within this project”

I’ve installed gcloud and when I run this command:

gcloud app deploy

I get the following error:

ERROR: An app.yaml (or appengine-web.xml) file is required to deploy this directory as an App Engine application. Create an app.yaml file using the directions at https://cloud.google.com/appengine/docs/flexible/reference/app-yaml (App Engine flexible environment) or https://cloud.google.com/appengine/docs/standard/reference/app-yaml (App Engine standard environment) under the tab for your language.

I don’t understand where I need to put the app-yaml file:

runtime: python312

instance_class: F2

env_variables:
  BUCKET_NAME: "example-gcs-bucket"

handlers:
# Matches requests to /images/... to files in static/images/...
- url: /images
  static_dir: static/images

- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto
13

ok, I hav e done this.