fix: issue 3785. id_token missing #3786

guillaumeblaquiere · 2025-12-02T13:20:25Z

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

Closes: id_token missing in OIDC credential #3785

Problem:
id_token value is not gathered and made available in the OIDC flow

Solution:

Add the id_token field in the oauth2auth class
Add the id_token field population when available in the oauth credential util

Manual End-to-End (E2E) Tests:

Tested with OIDC and OAuth flow, works well

… token exchange.

gemini-code-assist · 2025-12-02T13:20:40Z

Summary of Changes

Hello @guillaumeblaquiere, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical omission in the OpenID Connect (OIDC) authentication flow by ensuring that the id_token is properly captured and stored. It introduces a dedicated field within the authentication credential model and updates the token utility to populate this field, thereby making the id_token accessible for OIDC-based authentications. This change enhances the system's compliance with OIDC specifications and provides necessary user identity information.

Highlights

Bug Fix: Resolves issue id_token missing in OIDC credential #3785 where the id_token was not being captured during the OIDC authentication flow.
Model Update: Added an id_token field to the OAuth2Auth class in auth_credential.py to store the OpenID Connect ID token.
Token Population: Modified the update_credential_with_tokens utility function in oauth2_credential_util.py to correctly populate the new id_token field when it is available in the token response.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request correctly adds support for id_token in the OIDC flow by updating the OAuth2Auth model and the update_credential_with_tokens utility function. The implementation is straightforward and correct. My only suggestion is to update the existing unit tests to cover this new functionality, ensuring the change is robust and preventing future regressions. I've added a specific comment with a suggestion on how to update the tests.

src/google/adk/auth/oauth2_credential_util.py

ryanaiagent · 2025-12-04T21:39:08Z

Hi @guillaumeblaquiere , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Can you fix the lint error. You can use autoformat.sh.
Let us know once you have done that.

guillaumeblaquiere · 2025-12-05T08:41:58Z

@ryanaiagent I ran the autoformat but I didn't understand why it was related to the previous error.
Let me know if you need more actions from me;

guillaumeblaquiere · 2025-12-10T21:38:53Z

@ryanaiagent I didn't understand the error I got during the previous run. I'm happy to work on it, but I need more explanation!
https://github.com/google/adk-python/actions/runs/20023850733/job/57489823701

ryanaiagent · 2026-01-20T04:59:24Z

Hi @guillaumeblaquiere , we appreciate your patience and support. Can you please fix the failing unit tests before we can proceed with the review.

guillaumeblaquiere · 2026-01-21T14:49:37Z

@ryanaiagent I checked out the main branch, and I found the same unit test errors. I can fix the test from other developments (to make the test OK), but I'm not sure that will REALLY test the expected features behavior.

Let me know what you expect from me at this stage.

ryanaiagent · 2026-01-23T02:20:39Z

Hi @wukath , can you please review this.

wukath · 2026-01-24T00:19:06Z

thanks for contributing! what is the id_token used for? I see that we've added it to auth credential, just wondering if the user personally will be accessing it or if we need to make other changes in the adk codebase

guillaumeblaquiere · 2026-01-24T15:18:28Z

Yes, today I would like to use user credential to let ADK agent act as the user.
OAuth token is correctly managed, but the identity token is not handle by the code today.

I image cases where the users must use their own credential when their accessing Cloud Run for instance.

guillaumeblaquiere · 2026-01-24T22:02:18Z

@ryanaiagent unit test fixed, and my local env also (updated project.toml file for this)

ryanaiagent · 2026-01-26T19:25:39Z

/gemini review

gemini-code-assist

Code Review

This pull request effectively addresses issue #3785 by integrating id_token into the OAuth2 authentication flow. The changes include updating the OAuth2Auth data model, populating the id_token in the oauth2_credential_util, and adding corresponding unit tests to ensure correctness. Additionally, there are minor import cleanups and adjustments to mocking strategies in the test_remote_a2a_agent.py file, which improve the test suite's robustness. The changes are well-contained and directly address the stated problem.

gemini-code-assist · 2026-01-26T19:27:11Z

tests/unittests/auth/test_oauth2_credential_util.py


    assert credential.oauth2.access_token == "new_access_token"
    assert credential.oauth2.refresh_token == "new_refresh_token"
+    assert credential.oauth2.id_token == "some_id_token"


This assertion verifies that the id_token is correctly set on the OAuth2Auth object after update_credential_with_tokens is called. This is a critical test to ensure the new functionality works as expected.

gemini-code-assist · 2026-01-26T19:27:12Z

pyproject.toml


 [tool.pytest.ini_options]
 testpaths = ["tests"]
+pythonpath = "src"


Adding pythonpath = "src" to the [tool.pytest.ini_options] section is a good practice. It ensures that pytest can correctly resolve imports from the src directory, which can prevent import errors during test execution, especially in larger projects with a specific directory structure.

gemini-code-assist · 2026-01-26T19:27:12Z

src/google/adk/auth/auth_credential.py

  auth_response_uri: Optional[str] = None
  auth_code: Optional[str] = None
  access_token: Optional[str] = None
+  id_token: Optional[str] = None


Adding id_token: Optional[str] = None to the OAuth2Auth class is a direct and necessary change to support the id_token in the OIDC flow, as described in the PR. This correctly extends the data model to accommodate the new token type.

gemini-code-assist · 2026-01-26T19:27:12Z

src/google/adk/auth/oauth2_credential_util.py

  """
  auth_credential.oauth2.access_token = tokens.get("access_token")
  auth_credential.oauth2.refresh_token = tokens.get("refresh_token")
+  auth_credential.oauth2.id_token = tokens.get("id_token", None)


Populating the id_token field from the tokens dictionary is crucial for making the id_token available after an OAuth2/OIDC exchange. This change directly implements the solution for issue #3785.

gemini-code-assist · 2026-01-26T19:27:12Z

tests/unittests/agents/test_remote_a2a_agent.py

          self.agent.name,
          self.mock_context,
-          self.mock_a2a_part_converter,
+          self.agent._a2a_part_converter,


Changing self.mock_a2a_part_converter to self.agent._a2a_part_converter ensures that the test uses the actual converter instance associated with the agent object, rather than a separate mock. This improves the accuracy of the test by reflecting how the agent would behave in a real scenario.

gemini-code-assist · 2026-01-26T19:27:12Z

tests/unittests/agents/test_remote_a2a_agent.py


          # Mock A2A client
-          mock_a2a_client = create_autospec(spec=A2AClient, instance=True)
+          mock_a2a_client = MagicMock(spec=A2AClient)


Replacing create_autospec(spec=A2AClient, instance=True) with MagicMock(spec=A2AClient) can simplify mocking in some cases. MagicMock is generally more flexible and less strict about argument matching than create_autospec(..., instance=True), which can be beneficial for tests that don't require strict adherence to the spec's signature for all calls. If create_autospec was causing issues due to strictness, MagicMock is a reasonable alternative.

Test failed if I use create_autospec

gemini-code-assist · 2026-01-26T19:27:12Z

tests/unittests/agents/test_remote_a2a_agent.py


          # Mock A2A client
-          mock_a2a_client = create_autospec(spec=A2AClient, instance=True)
+          mock_a2a_client = MagicMock(spec=A2AClient)


This change from create_autospec to MagicMock is consistent with the previous change and likely addresses similar issues related to mocking flexibility.

Test failed if I use create_autospec

gemini-code-assist · 2026-01-26T19:27:12Z

tests/unittests/agents/test_remote_a2a_agent.py


          # Mock A2A client
-          mock_a2a_client = create_autospec(spec=A2AClient, instance=True)
+          mock_a2a_client = MagicMock(spec=A2AClient)


This change from create_autospec to MagicMock is consistent with the previous changes and likely addresses similar issues related to mocking flexibility.

Test failed if I use create_autospec

gemini-code-assist · 2026-01-26T19:27:12Z

tests/unittests/auth/test_oauth2_credential_util.py

    tokens = OAuth2Token({
        "access_token": "new_access_token",
        "refresh_token": "new_refresh_token",
+        "id_token": "some_id_token",


ryanaiagent · 2026-01-26T23:50:50Z

Hi @guillaumeblaquiere , Your PR has been received by the team and is currently under review. We will provide feedback as soon as we have an update to share.

fix: issue 3785. Add id_token field and fill it when available in the…

c9eb67e

… token exchange.

adk-bot added the core [Component] This issue is related to the core interface and implementation label Dec 2, 2025

gemini-code-assist bot reviewed Dec 2, 2025

View reviewed changes

src/google/adk/auth/oauth2_credential_util.py Show resolved Hide resolved

test: add id_token in test

f1c74e7

ankursharmas requested a review from seanzhou1023 December 3, 2025 03:11

guillaumeblaquiere added 2 commits December 3, 2025 15:36

Merge branch 'main' into fix-3785

3744fb0

Merge branch 'main' into fix-3785

f153943

ryanaiagent self-assigned this Dec 4, 2025

ryanaiagent added the request clarification [Status] The maintainer need clarification or more information from the author label Dec 4, 2025

guillaumeblaquiere added 2 commits December 5, 2025 09:40

chore: autoformat.sh

c208c77

Merge branch 'main' into fix-3785

d5c5319

guillaumeblaquiere added 2 commits December 8, 2025 10:52

Merge branch 'main' into fix-3785

aa430c7

Merge branch 'main' into fix-3785

54d4d00

guillaumeblaquiere added 5 commits December 12, 2025 13:08

Merge branch 'main' into fix-3785

feaf945

Merge branch 'main' into fix-3785

abc3e08

Merge branch 'main' into fix-3785

fc8d1b3

Merge branch 'main' into fix-3785

2381c91

Merge branch 'main' into fix-3785

60ee6b3

surajksharma07 mentioned this pull request Jan 14, 2026

id_token missing in OIDC credential #3785

Open

Merge branch 'main' into fix-3785

2ef4782

Merge branch 'main' into fix-3785

a223d26

guillaumeblaquiere added 2 commits January 21, 2026 20:45

Merge branch 'main' into fix-3785

d5f6142

Merge branch 'main' into fix-3785

77eaa98

ryanaiagent added needs review [Status] The PR/issue is awaiting review from the maintainer and removed request clarification [Status] The maintainer need clarification or more information from the author labels Jan 23, 2026

chore: fix unit test

2973e2c

gemini-code-assist bot reviewed Jan 26, 2026

View reviewed changes

fix: issue 3785. id_token missing #3786

Are you sure you want to change the base?

fix: issue 3785. id_token missing #3786

Uh oh!

Conversation

guillaumeblaquiere commented Dec 2, 2025

Link to Issue or Description of Change

Uh oh!

gemini-code-assist bot commented Dec 2, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

ryanaiagent commented Dec 4, 2025

Uh oh!

guillaumeblaquiere commented Dec 5, 2025

Uh oh!

guillaumeblaquiere commented Dec 10, 2025

Uh oh!

ryanaiagent commented Jan 20, 2026

Uh oh!

guillaumeblaquiere commented Jan 21, 2026

Uh oh!

ryanaiagent commented Jan 23, 2026

Uh oh!

wukath commented Jan 24, 2026

Uh oh!

guillaumeblaquiere commented Jan 24, 2026

Uh oh!

guillaumeblaquiere commented Jan 24, 2026

Uh oh!

ryanaiagent commented Jan 26, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

guillaumeblaquiere Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

guillaumeblaquiere Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

guillaumeblaquiere Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

ryanaiagent commented Jan 26, 2026

Uh oh!