feat(auth/gcp): add GCP credential provider#1173
Open
wolo-lab wants to merge 2 commits into
Open
Conversation
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
4 times, most recently
from
July 20, 2026 11:29
5a28496 to
234d752
Compare
wolo-lab
marked this pull request as ready for review
July 20, 2026 11:32
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 20, 2026 11:40
234d752 to
c65d414
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 20, 2026 11:49
c65d414 to
9186dc4
Compare
This was referenced Jul 22, 2026
wolo-lab
force-pushed
the
wolo/auth-gcp-client
branch
2 times, most recently
from
July 22, 2026 20:25
642c715 to
73b5382
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 22, 2026 21:21
9186dc4 to
edeb3da
Compare
Add gcp.NewProvider, an auth.CredentialProvider that resolves per-user credentials from the Agent Identity / IAM Connector services (via the REST client) and maps them to an auth.Credential. It takes the acting user from the ADK context at resolve time, so it runs inside an agent invocation and needs no per-user configuration. To recover the user from an http.RoundTripper that only sees a context.Context (deep beneath a tool call, past jsonrpc2/net/http wrapping), this also adds agent.FromContext(ctx) (ReadonlyContext, bool): ADK contexts register a read-only view of themselves under a private key, and FromContext returns it. Identity still lives on the typed context via Session(); nothing is stored under a key. Additive and non-breaking: the only new public API in agent is FromContext; the Value overrides are on unexported/internal context types and change behavior only for the new private key. No new module dependencies (the GCP client is hand-rolled over net/http + ADC).
…ontext
FromContext/RequireContext returned a full agent.ReadonlyContext just so the
GCP credential provider could read UserID. That forced a readonlyView
laundering type (13 method forwarders) plus anti-widening + reflection tests,
all existing only to stop the recovered context from being widened back to a
mutable Context/InvocationContext.
Return a small immutable agent.Identity{UserID,AppName,SessionID} via
IdentityFromContext/RequireIdentity instead. Returning a value erases the
widening concern entirely: readonlyView and the widening tests are gone.
Rename the context key SelfKey -> IdentityKey to match what it now carries.
All of this API is new in this PR (absent from main), so nothing released
changes; ReadonlyContext/Context/InvocationContext are untouched.
wolo-lab
force-pushed
the
wolo/auth-gcp-client
branch
from
July 22, 2026 22:26
73b5382 to
c2c93fc
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 22, 2026 22:27
edeb3da to
a4d444d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
auth/gcphas the credentials-service REST client (#1149) but noauth.CredentialProviderthat resolves the acting user's credential from theinvocation context. Without it there is no way to wire per-user GCP credentials
(Agent Identity / IAM Connector) into a tool call — adk-python has this via its
GCP auth provider.
Summary
gcp.NewProvider(scheme, *gcp.ProviderConfig)returning anauth.CredentialProviderthat resolves a per-user credential via the RESTclient and maps it to an
auth.Credential. The acting user is taken from theADK context at resolve time, so it runs inside an agent invocation.
agent.Identityandagent.IdentityFromContext(ctx) (Identity, bool)socode holding only a
context.Context(e.g. anhttp.RoundTripperdeep beneatha tool call, past jsonrpc2/net/http wrapping) can recover the invocation
identity. Identity is synthesized on demand from
Session()on the typedcontext and registered under a private key in
internal/adkcontext— amodule-internal leaf package (shared by
agentandinternal/contextto avoidan import cycle), so code outside the module can neither name nor forge it.
Valueon both context types delegates every non-identity key, and any contextwithout a session, to the embedded context — so it never panics and a wrapped
ADK context can still supply the identity.
ProviderConfig, nil = defaults), consistent withgcp.NewClient.