title: Firebase Storage Rules with Custom Claims
body: <p>I am unable to get Firebase Storage work with custom rules and using custom claims.</p>
  
  <p>In my Python Admin panel, I do the following to create the user and assign a claim client_id:</p>
  
  <pre><code># Standard Auth
  import firebase_admin
  from firebase_admin import db, storage, auth
  cred   = firebase_admin.credentials.Certificate('path_to_cert_json')
  app    = firebase_admin.initialize_app(cred, 'config')
  bucket = storage.bucket(app=app)
  
  # Create User
  auth.create_user(email=email) 
  
  # Create custom claims
  auth.set_custom_user_claims(uid, {'client_id': client_id})
  </code></pre>
  
  <p>Then for Firebase rules, I try to allow the user to only read (or download) files when the file is in a subfolder with the client_id:</p>
  
  <p><em>File structure on storage:</em></p>
  
  <pre><code>/{environment}/{client_id}/other_folders_and_files
  </code></pre>
  
  <p>I set the following storage rules:</p>
  
  <pre><code>service firebase.storage {
    match /b/{bucket}/o {
      match /{environment}/{client_id}/{allPaths=**} {
        allow read: if request.auth.token.client_id == client_id
      }
    }
  }
  </code></pre>
  
  <p>But that gives me an error that Permission is denied. </p>
  
  <p>What am I doing wrong?</p>
  
  <p>Note:</p>
  
  <ul>
  <li>client_id is correct and the folder structure is correct, have checked this a million times.</li>
  </ul>