Skip to main content

Initial setup for Firestore Writer

Initial setup ensures Striim can connect and write to your Firestore database with appropriately scoped credentials. In Google Cloud, you provision a Firestore Enterprise edition database with MongoDB compatibility and set up one of the three supported authentication mechanisms. In Striim, you then save the connection and authentication details as a reusable connection profile.

Google Cloud requirements

Provisioning the Firestore database

Firestore Writer requires a Firestore Enterprise edition database with MongoDB compatibility (see Firestore with MongoDB compatibility overview in Google's documentation). The Standard edition is not supported.

Note the database's MongoDB-format connection URL (for example, mongodb://<database>.<region>.firestore.goog:443); you will need it when configuring the Striim connection profile.

Setting up authentication

Set up one of the following authentication mechanisms. In each case, the account must have write access to the database: for SCRAM, the Firestore database User role or higher; for the service account mechanisms, the roles/datastore.user role (Cloud Datastore User) or higher.

SCRAM

SCRAM authenticates a Firestore database user with a username and password.

  1. In the Google Cloud console, navigate to the Security tab of the Firestore database.

  2. Click Add user and select a role with User (Read/write access) or higher privileges.

  3. Copy the generated password. You will enter the username and password in the Striim connection profile.

Service account key

This mechanism authenticates a Google Cloud service account using a JSON key file.

  1. Create a service account (see Create service accounts in Google's IAM documentation).

  2. During creation, grant the service account the Cloud Datastore User role (roles/datastore.user) or higher privileges.

  3. Generate a service account key in JSON format and download it. You will specify the key file's path in the Striim connection profile.

Application default credentials on a Google Compute Engine VM

This mechanism authenticates using the application default credentials of a service account attached to the Google Compute Engine VM on which Striim runs. Use it only when Striim is deployed on a Compute Engine VM.

  1. Create a service account with the Cloud Datastore User role or higher, as described above.

  2. When creating the VM (or by editing a stopped VM), under the Security settings, attach the service account to the VM and enable the Cloud Platform access scope (see Service accounts in Google's Compute Engine documentation).

Firestore Writer running on that VM can then authenticate using the application default credentials, with no key file or password stored in Striim.

Striim requirements

Configuring Striim to work with Firestore Writer

Firestore Writer connects using the MongoDB Java Sync driver, which is bundled with Striim. The adapter connects with the client parameters loadBalanced=true, tls=true, and retryWrites=false; you do not need to include these in the connection URL. No additional driver setup is required.

Configuring a Striim connection profile

Firestore Writer connects using a Firestore connection profile, which holds the connection and authentication properties. Create the profile once, then select it when you add a Firestore Writer target in Flow Designer or TQL.

  1. In the Striim UI, open Connection Profiles and click Create Profile.

  2. Enter a Name and (optional) Description. For Type, select Firestore.

  3. Provide the connection properties: the Connection URL, the Authentication Type, and the credentials that authentication type requires (see Programmer's reference for Firestore Writer).

  4. Click Test Connection. Resolve any validation errors, then click Save.