Emulator with Anonymous Credentials is No Longer Possible

[alphapseudo]

Previously on version 1.9.0, setting the environment variable FIRESTORE_EMULATOR_HOST and providing AnonymousCredentials allowed the transport to be established successfully.

After upgrading to 2.0.0, we are receiving a DefaultCredentialsError instead. When FIRESTORE_EMULATOR_HOST is set, the credentials provided to the client are no longer respected.

Environment details

Running an instance of the Firestore emulator inside of a Docker container

• OS type and version: CentOS 7.5
• Python version: 3.8
• pip version: 20.2
• google-cloud-firestore version: 2.0.0
• google-auth version: 1.23.0

Steps to reproduce

1. Set FIRESTORE_EMULATOR_HOST environment variable e.g. FIRESTORE_EMULATOR_HOST=emulator_host:8200
2. Instantiate a new Firestore client by providing AnonymousCredentials
3. Execute an example query/request using this client

Code example

# e.g. export FIRESTORE_EMULATOR_HOST=emulator_host:8200

from google.auth.credentials import AnonymousCredentials
from google.cloud.firestore import Client

credentials = AnonymousCredentials()
client = Client(project="my-project", credentials=credentials)

product = db.collection("products").document("product_abcd").get()

print(product)

Stack trace

File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/cloud/firestore_v1/document.py", line 359, in get
  firestore_api = self._client._firestore_api
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/cloud/firestore_v1/client.py", line 104, in _firestore_api
  return self._firestore_api_helper(
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/cloud/firestore_v1/base_client.py", line 152, in _firestore_api_helper
  channel = transport.create_channel(host=self._emulator_host)
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/cloud/firestore_v1/services/firestore/transports/grpc.py", line 223, in create_channel
  return grpc_helpers.create_channel(
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/api_core/grpc_helpers.py", line 275, in create_channel
  composite_credentials = _create_composite_credentials(
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/api_core/grpc_helpers.py", line 217, in _create_composite_credentials
  credentials, _ = google.auth.default(scopes=scopes)
File "/pyenv/versions/test-app/lib/python3.8/site-packages/google/auth/_default.py", line 356, in default
  raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)

google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see https://cloud.google.com/docs/authentication/getting-started

[HemangChothani]

@alphapseudo Thanks for opening the issue, I am able to reproduce it.

@tseaver @crwilcox I found something in TODO mentioned in the code, is there anything related to auto-gen code:

python-firestore/google/cloud/firestore_v1/base_client.py

Lines 149 to 151 in 75d0a48

	if self._emulator_host is not None:
	# TODO(microgen): this likely needs to be adapted to use insecure_channel
	# on new generated surface.

[crwilcox]

@alphapseudo thanks for the bug report. I should have a patch out for this later today.

[crwilcox]

will be released under v2.0.1