encounter/adk-python
0
0
Fork 0
mirror of https://github.com/encounter/adk-python.git synced 2026-07-09 18:19:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): Add native support for id_token in OAuth2 credentials

Browse Source 
## Problem
When performing authentication flows via `OAUTH2` or `OPEN_ID_CONNECT`, the native `OAuth2Token` response from identity providers, like Google OAuth, often includes an `id_token` alongside the `access_token` and `refresh_token`. [MCP Toolbox](https://googleapis.github.io/genai-toolbox/resources/authservices/google/) implements authentication through ID Tokens and [integrates with ADK](https://google.github.io/adk-docs/integrations/mcp-toolbox-for-databases/) to provide easy tools management for the end-users.

However, the ADK's `update_credential_with_tokens` utility explicitly drops the `id_token`, preventing agents and tools from verifying user identity or extracting OIDC claims securely. Furthermore, the `OAuth2Auth` model does not have a designated field for `id_token`.

## Solution
1. Added an `id_token: Optional[str] = None` field to the `OAuth2Auth` pydantic model in `auth_credential.py`.
2. Updated `update_credential_with_tokens` in `oauth2_credential_util.py` to correctly extract and map `tokens.get("id_token")` into the `OAuth2Auth` credential object.
3. Updated the relevant unit tests to ensure `id_token` is asserted and preserved during credential updates.

### Testing Plan

- I have added or updated unit tests for my change.
- All unit tests pass locally.

PiperOrigin-RevId: 871801313
This commit is contained in:
Google Team Member
2026-02-18 04:34:39 -08:00
committed by Copybara-Service
parent 6a53f414d3
commit 33f7d118b3
3 changed files with 25 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unittests/auth/test_oauth2_credential_util.py
+14
View File
@@ -222,13 +222,27 @@ class TestOAuth2CredentialUtil:
tokens = OAuth2Token({
"access_token": "new_access_token",
"refresh_token": "new_refresh_token",
"id_token": "new_id_token",
"expires_at": expected_expires_at,
"expires_in": 3600,
})
assert credential.oauth2 is not None
update_credential_with_tokens(credential, tokens)
assert credential.oauth2.access_token == "new_access_token"
assert credential.oauth2.refresh_token == "new_refresh_token"
assert credential.oauth2.id_token == "new_id_token"
assert credential.oauth2.expires_at == expected_expires_at
assert credential.oauth2.expires_in == 3600
def test_update_credential_with_tokens_none(self) -> None:
credential = AuthCredential(
auth_type=AuthCredentialTypes.API_KEY,
)
tokens = OAuth2Token({"access_token": "new_access_token"})
# Should not raise any exceptions when oauth2 is None
update_credential_with_tokens(credential, tokens)
assert credential.oauth2 is None