title: How to authenticate an user in firebase-admin in nodejs?
body: <p>At the moment I am creating a Firebase API on nodejs. I would like to handle all Firebase stuff (like authentication) with firebase-admin on nodejs. But what is the correct way to authenticate a user over nodejs in firebase-admin <strong>without</strong> the Javascript Firebase SDK on the client side? On the official <a href="https://firebase.google.com/docs/auth/admin/manage-users" rel="noreferrer">documentation for admin</a> I didn't find a function called <strong>signInWithEmailAndPassword</strong> (like as on the client side SDK) for nodejs. There is only a function called: "<strong>getUserByEmail</strong>", but this function doesn't check if the user has entered the correct password.</p>
  
  <p>This is my form:</p>
  
  <pre><code>&lt;form class="sign-box" action="/login" method="post"&gt;
  
        &lt;div class="form-group"&gt;
            &lt;input id="username" name="username" type="text" class="form-control" placeholder="E-Mail"/&gt;
        &lt;/div&gt;
        &lt;div class="form-group"&gt;
            &lt;input id="password" name="password" type="password" class="form-control" placeholder="Password"/&gt;
        &lt;/div&gt;
        &lt;button type="submit" class="btn btn-rounded"&gt;Sign in&lt;/button&gt;
  
  &lt;/form&gt;
  </code></pre>
  
  <p>Once the form is submitted I pass the values to my API in nodejs:</p>
  
  <pre><code>app.post('/login', urlencodedParser, function (req, res) {
  
      // getting the values
  
      response = {
          username: req.body.username,
          password: req.body.password
  
      };    
  
      // authenticate the user here, but how ?
  
  });
  </code></pre>
  
  <p>My first idea was to use the Firebase SDK on the client side to sign in with <strong>signInWithEmailAndPassword</strong> and to get the uid. Once I had the UID I wanted to sent the UID to nodejs and call the function createCustomToken and to return the generated token (with some additional claims) back to the client. Once I get the token back I would use the function <strong>signWithCustomToken</strong> (on the client side) to authenticate the user. Is this way correct or is there a better way ? </p>