Agent Registry & Auth Manager

[HonzaKopecky]

Hey there! Is the support for 3-legged OAuth with Auth Manager and automatic binding via Agent Registry still limited by the fact that adk web doesn't support the OAuth flow triggered by the Agent Registry? Are there any plans to support this?

Any information about the situation in Gemini Enterprise App? The flow wouldn't get triggered there either which draws the Auth manager fairly useless for agents living in the Gemini Enterprise Agent Platform environment.

[adk-bot]

Response from ADK Answering Agent (experimental, answer may be inaccurate)

TLDR: ADK's adk web client initiates 3-legged OAuth flows by handling popups and redirects, with ongoing development to enhance this support. Gemini Enterprise Agent Platform is designed to manage OAuth 2.0 flows and provide agents with necessary access tokens.

---

Here's an overview of 3-legged OAuth support within ADK, Agent Registry, adk web, and Gemini Enterprise App:

adk web and 3-legged OAuth Flow

The adk web client can interact with 3-legged OAuth (3LO) flows by opening the consent popup and handling the redirect from the OAuth provider. While adk web facilitates this interaction and relays the validation state to finalize the credentials, the full OAuth consent process involves user interaction with an external OAuth provider [1, 2, 3]. ADK triggers a specific interactive process with your Agent Client application for flows requiring user consent [4].

Plans for Enhanced Support

There is ongoing development to enhance 3-legged OAuth support. The Agent Identity Auth Manager, which provides a streamlined solution for managing auth credentials, is currently in Preview release [5]. Recent updates include the addition of a finalize endpoint for 3-legged OAuth flows with the Auth Manager [6]. Support for OAuth PKCE in McpToolset has also been added [7].

Gemini Enterprise App Environment

The Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) is designed to manage OAuth 2.0 flows for agents. When an agent is deployed to Gemini Enterprise and configured to use OAuth 2.0, users interacting with the agent will go through an OAuth consent flow. The Agent Engine then provides the agent with the necessary access tokens to call APIs on the user's behalf [8]. For integrations with external authentication providers like Gemini Enterprise, where tokens are managed by the platform, you can use external_access_token_key [9, 10]. To use Gemini Enterprise, environment variables like GOOGLE_GENAI_USE_ENTERPRISE=True need to be set [11, 12].

In summary, while adk web plays a role in initiating 3LO, the Agent Identity Auth Manager is under active development to improve this experience. For agents within the Gemini Enterprise Agent Platform, the platform itself manages the OAuth 2.0 consent flow and provides tokens to the agent.

References:

[1] https://google.github.io/adk-docs/integrations/agent-identity/
[2] https://github.com/google/adk-python/blob/main/contributing/samples/integrations/gcp_auth/README.md
[3] https://github.com/google/adk-python/blob/main/src/google/adk/cli/api_server.py
[4] https://google.github.io/adk-docs/tools-custom/authentication/
[5] https://google.github.io/adk-docs/integrations/agent-identity/
[6] https://github.com/google/adk-python/blob/main/CHANGELOG.md
[7] https://github.com/google/adk-python/blob/main/CHANGELOG.md
[8] https://github.com/google/adk-python/blob/main/contributing/samples/integrations/bigquery/README.md
[9] https://google.github.io/adk-docs/integrations/data-agent/
[10] https://google.github.io/adk-docs/get-started/google-cloud/
[11] https://google.github.io/adk-docs/tutorials/multi-tool-agent/
[12] https://google.github.io/adk-docs/agents/models/google-gemini/