feat(auth/gcp): add GCP credential provider#1173
Draft
wolo-lab wants to merge 2 commits into
Draft
Conversation
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 20:44
a46455a to
421a856
Compare
Add gcp.NewProvider, an auth.CredentialProvider that resolves per-user credentials from the Agent Identity / IAM Connector services (via the REST client) and maps them to an auth.Credential. It takes the acting user from the ADK context at resolve time, so it runs inside an agent invocation and needs no per-user configuration. To recover the user from an http.RoundTripper that only sees a context.Context (deep beneath a tool call, past jsonrpc2/net/http wrapping), this also adds agent.FromContext(ctx) (ReadonlyContext, bool): ADK contexts register a read-only view of themselves under a private key, and FromContext returns it. Identity still lives on the typed context via Session(); nothing is stored under a key. Additive and non-breaking: the only new public API in agent is FromContext; the Value overrides are on unexported/internal context types and change behavior only for the new private key. No new module dependencies (the GCP client is hand-rolled over net/http + ADC).
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 23:33
421a856 to
eadd5a6
Compare
…ontext
FromContext/RequireContext returned a full agent.ReadonlyContext just so the
GCP credential provider could read UserID. That forced a readonlyView
laundering type (13 method forwarders) plus anti-widening + reflection tests,
all existing only to stop the recovered context from being widened back to a
mutable Context/InvocationContext.
Return a small immutable agent.Identity{UserID,AppName,SessionID} via
IdentityFromContext/RequireIdentity instead. Returning a value erases the
widening concern entirely: readonlyView and the widening tests are gone.
Rename the context key SelfKey -> IdentityKey to match what it now carries.
All of this API is new in this PR (absent from main), so nothing released
changes; ReadonlyContext/Context/InvocationContext are untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
`auth/gcp` has the credentials-service REST client (#1149) but no
`auth.CredentialProvider` that resolves the acting user's credential from the
invocation context. Without it there is no way to wire per-user GCP credentials
(Agent Identity / IAM Connector) into a tool call — adk-python has this via its
GCP auth provider.
Summary
`auth.CredentialProvider` that resolves a per-user credential via the REST
client and maps it to an `auth.Credential`. The acting user is taken from the
ADK context at resolve time, so it runs inside an agent invocation.
`context.Context` (e.g. an `http.RoundTripper` deep beneath a tool call, past
jsonrpc2/net/http wrapping) can recover the invocation identity. Identity still
lives on the typed context via `Session()`.