Firebase Auth saving users without identifier with OIDC

Question

I am currently able to register new users with Firebase Auth and an OIDC provider (OP from now on). That means the user sees the pop-up for login and, after successful login, a new user appears in Firebase Authentication.

However, the new users are missing the identifier (which I would expect to be the email address):

When using the email scope, the OP is providing the email and email_verified claims as part of the userinfo response, but I'm guessing Firebase is trying to read the email address in a different way.

Is there a way to know which field(s)/scopes is Firebase using/expecting to read in order to set the email as the new user's identifier with OIDC? So that:

• I can ask the OP to update their configuration/response accordingly and allow Firebase to store the email address as identifier.
• Or update some configuration client-side to tell Firebase to use the available claims using the userinfo endpoint.

Answer 1

I contacted Firebase support and they clarified that Firebase needs those claims both:

• In the userinfo endpoint.
• In the ID token.

So basically, it is not enough to have them included in the userinfo response. OP needs to add the claims in the ID token for Firebase to use the email address as the identifier in the Authentication users list.

Example of an ID token that would work properly with Firebase:

{
  iss: 'https://www.provider.com',
  aud: 'audience',
  iat: 12345,
  exp: 123456,
  sub: 'UserID0001',
  name: 'Jane Doe',
  given_name: 'Jane',
  family_name: 'Doe',
  preferred_username: 'j.doe',
  picture: 'http://example.com/janedoe/me.jpg'
  email: '[email protected]',  // This claim is expected
  email_verified: 'true'  // This claim is expected
}

The userinfo endpoint is also required to return the same claims (and according to Firebase support they need to match with the ID token):

{
  name: 'Jane Doe',
  given_name: 'Jane',
  family_name: 'Doe',
  preferred_username: 'j.doe',
  picture: 'http://example.com/janedoe/me.jpg'
  email: '[email protected]',  // This claim is expected
  email_verified: 'true'  // This claim is expected
}