以编程方式管理用户

本文档介绍如何使用 Identity Platform Admin SDK 以编程方式管理用户。通过 Admin SDK，您可以执行各种常见管理任务，例如创建、查找和修改用户。

准备工作

安装 Admin SDK。

获取用户

根据 ID 获取用户

标识用户的主要方式是通过其 uid：

Node.js

getAuth()
  .getUser(uid)
  .then((userRecord) => {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log(`Successfully fetched user data: ${userRecord.toJSON()}`);
  })
  .catch((error) => {
    console.log('Error fetching user data:', error);
  });
manage_users.js

Java

UserRecord userRecord = FirebaseAuth.getInstance().getUser(uid);
// See the UserRecord reference doc for the contents of userRecord.
System.out.println("Successfully fetched user data: " + userRecord.getUid());
FirebaseAuthSnippets.java

Python

from firebase_admin import auth

user = auth.get_user(uid)
print('Successfully fetched user data: {0}'.format(user.uid))
index.py

Go

// Get an auth client from the firebase.App
client, err := app.Auth(ctx)
if err != nil {
	log.Fatalf("error getting Auth client: %v\n", err)
}

u, err := client.GetUser(ctx, uid)
if err != nil {
	log.Fatalf("error getting user %s: %v\n", uid, err)
}
log.Printf("Successfully fetched user data: %v\n", u)
auth.go

C#

UserRecord userRecord = await FirebaseAuth.DefaultInstance.GetUserAsync(uid);
// See the UserRecord reference doc for the contents of userRecord.
Console.WriteLine($"Successfully fetched user data: {userRecord.Uid}");
FirebaseAuthSnippets.cs

根据电子邮件获取用户

您还可以使用用户的电子邮件地址来获取用户：

Node.js

getAuth()
  .getUserByEmail(email)
  .then((userRecord) => {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log(`Successfully fetched user data: ${userRecord.toJSON()}`);
  })
  .catch((error) => {
    console.log('Error fetching user data:', error);
  });
manage_users.js

Java

UserRecord userRecord = FirebaseAuth.getInstance().getUserByEmail(email);
// See the UserRecord reference doc for the contents of userRecord.
System.out.println("Successfully fetched user data: " + userRecord.getEmail());
FirebaseAuthSnippets.java

Python

from firebase_admin import auth

user = auth.get_user_by_email(email)
print('Successfully fetched user data: {0}'.format(user.uid))
index.py

Go

u, err := client.GetUserByEmail(ctx, email)
if err != nil {
	log.Fatalf("error getting user by email %s: %v\n", email, err)
}
log.Printf("Successfully fetched user data: %v\n", u)
auth.go

C#

UserRecord userRecord = await FirebaseAuth.DefaultInstance.GetUserByEmailAsync(email);
// See the UserRecord reference doc for the contents of userRecord.
Console.WriteLine($"Successfully fetched user data: {userRecord.Uid}");
FirebaseAuthSnippets.cs

请注意，您只能使用主电子邮件，而不能使用提供商专有的电子邮件进行搜索。例如，如果电子邮件为 [e-mail] 的 Facebook 账号与电子邮件为 [e-mail] 的现有用户相关联，则调用 getUserByEmail("[e-mail]") 不会返回任何结果。而调用 getUserByEmail("[e-mail]") 会返回预期的用户。

主电子邮件地址取决于账号关联设置：

• 关联使用相同电子邮件的账号：除非手动更新，否则主电子邮件是用于登录的首个电子邮件。
• ：除非手动更新，否则仅在创建密码用户时设置主电子邮件。

根据电话号码获取用户

如果用户有电话号码，则可以使用电话号码查找用户：

Node.js

getAuth()
  .getUserByPhoneNumber(phoneNumber)
  .then((userRecord) => {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log(`Successfully fetched user data:  ${userRecord.toJSON()}`);
  })
  .catch((error) => {
    console.log('Error fetching user data:', error);
  });
manage_users.js

Java

UserRecord userRecord = FirebaseAuth.getInstance().getUserByPhoneNumber(phoneNumber);
// See the UserRecord reference doc for the contents of userRecord.
System.out.println("Successfully fetched user data: " + userRecord.getPhoneNumber());
FirebaseAuthSnippets.java

Python

from firebase_admin import auth

user = auth.get_user_by_phone_number(phone)
print('Successfully fetched user data: {0}'.format(user.uid))
index.py

Go

u, err := client.GetUserByPhoneNumber(ctx, phone)
if err != nil {
	log.Fatalf("error getting user by phone %s: %v\n", phone, err)
}
log.Printf("Successfully fetched user data: %v\n", u)
auth.go

C#

UserRecord userRecord = await FirebaseAuth.DefaultInstance.GetUserByPhoneNumberAsync(phoneNumber);
// See the UserRecord reference doc for the contents of userRecord.
Console.WriteLine($"Successfully fetched user data: {userRecord.Uid}");
FirebaseAuthSnippets.cs

批量检索用户数据

您还可以根据您提供的标识符检索用户列表。您可以按用户 uid、电子邮件或电话号码来识别用户。一次调用最多可提供 100 个标识符。可同时包含以下各种类型的标识符：

Node.js

getAuth()
  .getUsers([
    { uid: 'uid1' },
    { email: '[e-mail]' },
    { phoneNumber: '[phone]' },
    { providerId: 'google.com', providerUid: 'google_uid4' },
  ])
  .then((getUsersResult) => {
    console.log('Successfully fetched user data:');
    getUsersResult.users.forEach((userRecord) => {
      console.log(userRecord);
    });

    console.log('Unable to find users corresponding to these identifiers:');
    getUsersResult.notFound.forEach((userIdentifier) => {
      console.log(userIdentifier);
    });
  })
  .catch((error) => {
    console.log('Error fetching user data:', error);
  });
manage_users.js

Java

GetUsersResult result = FirebaseAuth.getInstance().getUsersAsync(Arrays.asList(
    new UidIdentifier("uid1"),
    new EmailIdentifier("[e-mail]"),
    new PhoneIdentifier("[phone]"),
    new ProviderIdentifier("google.com", "google_uid4"))).get();

System.out.println("Successfully fetched user data:");
for (UserRecord user : result.getUsers()) {
  System.out.println(user.getUid());
}

System.out.println("Unable to find users corresponding to these identifiers:");
for (UserIdentifier uid : result.getNotFound()) {
  System.out.println(uid);
}
FirebaseAuthSnippets.java

Python

from firebase_admin import auth

result = auth.get_users([
    auth.UidIdentifier('uid1'),
    auth.EmailIdentifier('[e-mail]'),
    auth.PhoneIdentifier([phone]),
    auth.ProviderIdentifier('google.com', 'google_uid4')
])

print('Successfully fetched user data:')
for user in result.users:
    print(user.uid)

print('Unable to find users corresponding to these identifiers:')
for uid in result.not_found:
    print(uid)
index.py

Go

getUsersResult, err := client.GetUsers(ctx, []auth.UserIdentifier{
	auth.UIDIdentifier{UID: "uid1"},
	auth.EmailIdentifier{Email: "[e-mail]"},
	auth.PhoneIdentifier{PhoneNumber: "[phone]"},
	auth.ProviderIdentifier{ProviderID: "google.com", ProviderUID: "google_uid1"},
})
if err != nil {
	log.Fatalf("error retriving multiple users: %v\n", err)
}

log.Printf("Successfully fetched user data:")
for _, u := range getUsersResult.Users {
	log.Printf("%v", u)
}

log.Printf("Unable to find users corresponding to these identifiers:")
for _, id := range getUsersResult.NotFound {
	log.Printf("%v", id)
}
auth.go

C#

GetUsersResult result = await FirebaseAuth.DefaultInstance.GetUsersAsync(
    new List<UserIdentifier>
    {
        new UidIdentifier("uid1"),
        new EmailIdentifier("[e-mail]"),
        new PhoneIdentifier("[phone]"),
        new ProviderIdentifier("google.com", "google_uid4"),
    });

Console.WriteLine("Successfully fetched user data:");
foreach (UserRecord user in result.Users)
{
    Console.WriteLine($"User: {user.Uid}");
}

Console.WriteLine("Unable to find users corresponding to these identifiers:");
foreach (UserIdentifier uid in result.NotFound)
{
    Console.WriteLine($"{uid}");
}
FirebaseAuthSnippets.cs

此方法会返回一个与输入列表大小相同的列表，其中每个条目都包含相应的 UserRecord 或错误消息，错误消息会说明无法查找相关标识符的原因。

列出用户

以下代码展示了如何列出所有用户：

Node.js

const listAllUsers = (nextPageToken) => {
  // List batch of users, 1000 at a time.
  getAuth()
    .listUsers(1000, nextPageToken)
    .then((listUsersResult) => {
      listUsersResult.users.forEach((userRecord) => {
        console.log('user', userRecord.toJSON());
      });
      if (listUsersResult.pageToken) {
        // List next batch of users.
        listAllUsers(listUsersResult.pageToken);
      }
    })
    .catch((error) => {
      console.log('Error listing users:', error);
    });
};
// Start listing users from the beginning, 1000 at a time.
listAllUsers();
manage_users.js

Java

// Start listing users from the beginning, 1000 at a time.
ListUsersPage page = FirebaseAuth.getInstance().listUsers(null);
while (page != null) {
  for (ExportedUserRecord user : page.getValues()) {
    System.out.println("User: " + user.getUid());
  }
  page = page.getNextPage();
}

// Iterate through all users. This will still retrieve users in batches,
// buffering no more than 1000 users in memory at a time.
page = FirebaseAuth.getInstance().listUsers(null);
for (ExportedUserRecord user : page.iterateAll()) {
  System.out.println("User: " + user.getUid());
}
FirebaseAuthSnippets.java

Python

# Start listing users from the beginning, 1000 at a time.
page = auth.list_users()
while page:
    for user in page.users:
        print('User: ' + user.uid)
    # Get next batch of users.
    page = page.get_next_page()

# Iterate through all users. This will still retrieve users in batches,
# buffering no more than 1000 users in memory at a time.
for user in auth.list_users().iterate_all():
    print('User: ' + user.uid)
index.py

Go

// Note, behind the scenes, the Users() iterator will retrive 1000 Users at a time through the API
iter := client.Users(ctx, "")
for {
	user, err := iter.Next()
	if err == iterator.Done {
		break
	}
	if err != nil {
		log.Fatalf("error listing users: %s\n", err)
	}
	log.Printf("read user user: %v\n", user)
}

// Iterating by pages 100 users at a time.
// Note that using both the Next() function on an iterator and the NextPage()
// on a Pager wrapping that same iterator will result in an error.
pager := iterator.NewPager(client.Users(ctx, ""), 100, "")
for {
	var users []*auth.ExportedUserRecord
	nextPageToken, err := pager.NextPage(&users)
	if err != nil {
		log.Fatalf("paging error %v\n", err)
	}
	for _, u := range users {
		log.Printf("read user user: %v\n", u)
	}
	if nextPageToken == "" {
		break
	}
}
auth.go

C#

// Start listing users from the beginning, 1000 at a time.
var pagedEnumerable = FirebaseAuth.DefaultInstance.ListUsersAsync(null);
var responses = pagedEnumerable.AsRawResponses().GetAsyncEnumerator();
while (await responses.MoveNextAsync())
{
    ExportedUserRecords response = responses.Current;
    foreach (ExportedUserRecord user in response.Users)
    {
        Console.WriteLine($"User: {user.Uid}");
    }
}

// Iterate through all users. This will still retrieve users in batches,
// buffering no more than 1000 users in memory at a time.
var enumerator = FirebaseAuth.DefaultInstance.ListUsersAsync(null).GetAsyncEnumerator();
while (await enumerator.MoveNextAsync())
{
    ExportedUserRecord user = enumerator.Current;
    Console.WriteLine($"User: {user.Uid}");
}
FirebaseAuthSnippets.cs

用户会被会批量返回，并按 uid 排序。每批结果都包含用户列表和用于获取下一批用户的下一页令牌。列出所有用户后，不会返回 pageToken。

maxResult 字段指定最大批次大小。默认值以及最大值为 1000。

列出用户密码哈希

由于密码哈希是敏感数据，因此除非用户拥有 firebaseauth.configs.getHashConfig 权限，否则 Admin SDK 不会返回密码哈希。任何预定义角色都不具备此权限。要授予该权限，请执行以下操作：

1. 创建一个自定义角色，该自定义角色可授予 firebaseauth.configs.getHashConfig 权限。

2. 向用户或服务账号授予自定义角色。

具有此自定义角色的用户对 listUsers() 的后续调用将包括 passwordHash 和 passwordSalt 字段。

警告：请勿使用 Editor 角色 (roles/editor) 授予 firebaseauth.configs.getHashConfig 权限。此角色包括许多其他非必需的权限。

创建用户

以编程方式创建新用户可避免对最终用户施加某些限制。您不受节流或速率限制的约束，并且可以绕过电子邮件和电话号码的正常验证过程。

创建新用户：

Node.js

getAuth()
  .createUser({
    email: '[e-mail]',
    emailVerified: false,
    phoneNumber: '[phone]',
    password: 'secretPassword',
    displayName: 'John Doe',
    photoURL: 'http://www.example.com/12345678/photo.png',
    disabled: false,
  })
  .then((userRecord) => {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log('Successfully created new user:', userRecord.uid);
  })
  .catch((error) => {
    console.log('Error creating new user:', error);
  });
manage_users.js

Java

CreateRequest request = new CreateRequest()
    .setEmail("[e-mail]")
    .setEmailVerified(false)
    .setPassword("secretPassword")
    .setPhoneNumber("[phone]")
    .setDisplayName("John Doe")
    .setPhotoUrl("http://www.example.com/12345678/photo.png")
    .setDisabled(false);

UserRecord userRecord = FirebaseAuth.getInstance().createUser(request);
System.out.println("Successfully created new user: " + userRecord.getUid());
FirebaseAuthSnippets.java

Python

user = auth.create_user(
    email='[e-mail]',
    email_verified=False,
    phone_number='[phone]',
    password='secretPassword',
    display_name='John Doe',
    photo_url='http://www.example.com/12345678/photo.png',
    disabled=False)
print('Sucessfully created new user: {0}'.format(user.uid))
index.py

Go

params := (&auth.UserToCreate{}).
	Email("[e-mail]").
	EmailVerified(false).
	PhoneNumber("[phone]").
	Password("secretPassword").
	DisplayName("John Doe").
	PhotoURL("http://www.example.com/12345678/photo.png").
	Disabled(false)
u, err := client.CreateUser(ctx, params)
if err != nil {
	log.Fatalf("error creating user: %v\n", err)
}
log.Printf("Successfully created user: %v\n", u)
auth.go

C#

UserRecordArgs args = new UserRecordArgs()
{
    Email = "[e-mail]",
    EmailVerified = false,
    PhoneNumber = "[phone]",
    Password = "secretPassword",
    DisplayName = "John Doe",
    PhotoUrl = "http://www.example.com/12345678/photo.png",
    Disabled = false,
};
UserRecord userRecord = await FirebaseAuth.DefaultInstance.CreateUserAsync(args);
// See the UserRecord reference doc for the contents of userRecord.
Console.WriteLine($"Successfully created new user: {userRecord.Uid}");
FirebaseAuthSnippets.cs

您可以为新用户设置以下任意属性。所有属性均为可选属性。

属性	类型	说明
uid	字符串	要分配给新创建的用户的 uid。必须是包含 1 到 128 个字符的字符串（含 1 和 128）。如果未提供，系统会自动生成随机 uid。
email	字符串	用户的主电子邮件。必须是有效的电子邮件地址。
emailVerified	布尔值	用户的主电子邮件是否通过验证。如果未提供，则默认值为 false。
phoneNumber	字符串	用户的主电话号码。必须是符合 E.164 规范的有效的电话号码。
password	字符串	用户未经哈希处理的原始密码。必须至少包含六个字符。
displayName	字符串	用户的显示名。
photoURL	字符串	用户照片的网址。
disabled	布尔值	用户是否已被停用。true 表示已停用；false 表示已启用。如果未提供，则默认值为 false。

更新用户

Node.js

getAuth()
  .updateUser(uid, {
    email: '[e-mail]',
    phoneNumber: '[phone]',
    emailVerified: true,
    password: 'newPassword',
    displayName: 'Jane Doe',
    photoURL: 'http://www.example.com/12345678/photo.png',
    disabled: true,
  })
  .then((userRecord) => {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log('Successfully updated user', userRecord.toJSON());
  })
  .catch((error) => {
    console.log('Error updating user:', error);
  });
manage_users.js

Java

UpdateRequest request = new UpdateRequest(uid)
    .setEmail("[e-mail]")
    .setPhoneNumber("[phone]")
    .setEmailVerified(true)
    .setPassword("newPassword")
    .setDisplayName("Jane Doe")
    .setPhotoUrl("http://www.example.com/12345678/photo.png")
    .setDisabled(true);

UserRecord userRecord = FirebaseAuth.getInstance().updateUser(request);
System.out.println("Successfully updated user: " + userRecord.getUid());
FirebaseAuthSnippets.java

Python

user = auth.update_user(
    uid,
    email='[e-mail]',
    phone_number='[phone]',
    email_verified=True,
    password='newPassword',
    display_name='John Doe',
    photo_url='http://www.example.com/12345678/photo.png',
    disabled=True)
print('Sucessfully updated user: {0}'.format(user.uid))
index.py

Go

params := (&auth.UserToUpdate{}).
	Email("[e-mail]").
	EmailVerified(true).
	PhoneNumber("[phone]").
	Password("newPassword").
	DisplayName("John Doe").
	PhotoURL("http://www.example.com/12345678/photo.png").
	Disabled(true)
u, err := client.UpdateUser(ctx, uid, params)
if err != nil {
	log.Fatalf("error updating user: %v\n", err)
}
log.Printf("Successfully updated user: %v\n", u)
auth.go

C#

UserRecordArgs args = new UserRecordArgs()
{
    Uid = uid,
    Email = "[e-mail]",
    PhoneNumber = "[phone]",
    EmailVerified = true,
    Password = "newPassword",
    DisplayName = "Jane Doe",
    PhotoUrl = "http://www.example.com/12345678/photo.png",
    Disabled = true,
};
UserRecord userRecord = await FirebaseAuth.DefaultInstance.UpdateUserAsync(args);
// See the UserRecord reference doc for the contents of userRecord.
Console.WriteLine($"Successfully updated user: {userRecord.Uid}");
FirebaseAuthSnippets.cs

您可以更新以下任何用户属性。所有属性均为可选属性。如果没有为属性指定值，则其值将保持不变。

属性	类型	说明
email	字符串	用户新的主电子邮件。必须是有效的电子邮件地址。
emailVerified	布尔值	用户的主电子邮件是否通过验证。如果未提供，则默认值为 false。
phoneNumber	字符串	用户新的主电话号码。必须是符合 E.164 规范的有效的电话号码。设置为 null 可清除用户现有的电话号码。
password	字符串	用户的新密码（原始且未经哈希处理）。必须至少包含六个字符。
displayName	字符串 | null	用户的新显示名。设置为 null 可清除用户现有的显示名。
photoURL	字符串 | null	用户的新照片网址。设置为 null 可清除用户的现有照片网址。如果设置为 non-null，则必须提供一个有效的网址。
disabled	布尔值	用户是否已被停用。true 表示已停用；false 表示已启用。

删除用户

您可以使用用户的 uid 删除用户：

Node.js

getAuth()
  .deleteUser(uid)
  .then(() => {
    console.log('Successfully deleted user');
  })
  .catch((error) => {
    console.log('Error deleting user:', error);
  });
manage_users.js

Java

FirebaseAuth.getInstance().deleteUser(uid);
System.out.println("Successfully deleted user.");
FirebaseAuthSnippets.java

Python

auth.delete_user(uid)
print('Successfully deleted user')
index.py

Go

err := client.DeleteUser(ctx, uid)
if err != nil {
	log.Fatalf("error deleting user: %v\n", err)
}
log.Printf("Successfully deleted user: %s\n", uid)
auth.go

C#

await FirebaseAuth.DefaultInstance.DeleteUserAsync(uid);
Console.WriteLine("Successfully deleted user.");
FirebaseAuthSnippets.cs

删除多个用户

您还可以一次删除多个用户：

Node.js

getAuth()
  .deleteUsers([uid1, uid2, uid3])
  .then((deleteUsersResult) => {
    console.log(`Successfully deleted ${deleteUsersResult.successCount} users`);
    console.log(`Failed to delete ${deleteUsersResult.failureCount} users`);
    deleteUsersResult.errors.forEach((err) => {
      console.log(err.error.toJSON());
    });
  })
  .catch((error) => {
    console.log('Error deleting users:', error);
  });
manage_users.js

Java

DeleteUsersResult result = FirebaseAuth.getInstance().deleteUsersAsync(
    Arrays.asList("uid1", "uid2", "uid3")).get();

System.out.println("Successfully deleted " + result.getSuccessCount() + " users");
System.out.println("Failed to delete " + result.getFailureCount() + " users");
for (ErrorInfo error : result.getErrors()) {
  System.out.println("error #" + error.getIndex() + ", reason: " + error.getReason());
}
FirebaseAuthSnippets.java

Python

from firebase_admin import auth

result = auth.delete_users(["uid1", "uid2", "uid3"])

print('Successfully deleted {0} users'.format(result.success_count))
print('Failed to delete {0} users'.format(result.failure_count))
for err in result.errors:
    print('error #{0}, reason: {1}'.format(result.index, result.reason))
index.py

Go

deleteUsersResult, err := client.DeleteUsers(ctx, []string{"uid1", "uid2", "uid3"})
if err != nil {
	log.Fatalf("error deleting users: %v\n", err)
}

log.Printf("Successfully deleted %d users", deleteUsersResult.SuccessCount)
log.Printf("Failed to delete %d users", deleteUsersResult.FailureCount)
for _, err := range deleteUsersResult.Errors {
	log.Printf("%v", err)
}
auth.go

C#

DeleteUsersResult result = await FirebaseAuth.DefaultInstance.DeleteUsersAsync(new List<string>
    {
        "uid1",
        "uid2",
        "uid3",
    });

Console.WriteLine($"Successfully deleted {result.SuccessCount} users.");
Console.WriteLine($"Failed to delete {result.FailureCount} users.");

foreach (ErrorInfo err in result.Errors)
{
    Console.WriteLine($"Error #{err.Index}, reason: {err.Reason}");
}
FirebaseAuthSnippets.cs

对于无法删除的用户，“删除用户”方法会返回失败列表。

后续步骤

• 将用户从现有应用迁移到 Identity Platform
• 以编程方式管理 SAML 和 OIDC 提供商。