Firebase Authentication provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app. It supports authentication using passwords, phone numbers, popular federated identity providers like Google, Facebook and Twitter, and more. Some key aspects of how Firebase Authentication works:
Users can sign up/register for your app by providing an email and password using the Firebase auth APIs/UI. Their email and hashed password will be securely stored in Firebase.
Users can also sign in using federated identity providers like Google/Facebook to avoid creating separate app credentials. Firebase handles federation behind the scenes.
Once signed in, Firebase generates a unique FirebaseAuth user ID for each user which you would use to identify them in your app’s database.
Additional user profile data like name, profile picture etc. can also be fetched/stored by linking the user records with their Google/Facebook profiles.
Firebase also supports authentication using phone numbers for apps that require phone-based authentication flows like OTP.
The auth state and user records are stored securely in Firebase Auth on the backend and can be accessed through the Firebase Auth APIs/SDKs.
To manage user data and application permissions at the database level, Firebase Realtime Database can be used in conjunction with Firebase Auth. Some key aspects of how this would work:
The Firebase database would be secured using Server-Side Security Rules which are enforced when data is written or read from the database.
The security rules can check for the auth uid of the client accessing the data and allow/deny access as per the permissions defined in rules.
For example, rules can be written to only allow a user to write/delete data under their own uid node in the database and not of other users.
Rules can also be used to define which authenticated users have access to which nodes. For example, only “admins” able to access admin related data sections.
Additional granular permissions beyond authentication could also be implemented by having custom claim fields linked to user records.
The read/write permissions would be tested by the client SDK against these security rules during data operations on the frontend.
This provides a rules-based permissions system integrated with the auth state management by Firebase Authentication.
To connect the auth system with realtime database protection:
On sign up/login using Firebase Auth APIs, the auth uid generated by Firebase would be available to the client.
This uid could then be used as the unique identifier to manage that user’s data node under their uid in the RTDB.
For example, the JSON tree could have /users/${uid} as the base node for every authenticated user’s individual profile and data.
The security rules for the RTDB would be configured to allow write access only if the auth uid matches the uid in the node path (request.auth.uid == request.path.match(‘/users/’)[0])
Read access may be restricted to only allow reading specific fields instead of entire user objects depending on the use case.
Additional custom claims in the user objects returned by Firebase Auth after sign in can be used to implement more granular permissions.
Admin users would have privileged access defined through custom claims checks in security rules rather than relying only on auth uid matching.
On sign out, the client access to data would be revoked automatically due to the auth state change and security rules no longer allowing access.
This provides a robust and scalable solution to manage user authentication and granular realtime database permissions in mobile apps using Firebase Auth and RTDB. Some key advantages are integrated JWT auth handling, synchronized auth state on clients, and secure rules-enforced database access control.
Andrew Stroud