Skip to content

feat(core): implement OpenID Connect (OIDC) auth provider for remote agents#26559

Closed
alexandrevarga wants to merge 5 commits into
google-gemini:mainfrom
alexandrevarga:feat/oidc-auth-provider
Closed

feat(core): implement OpenID Connect (OIDC) auth provider for remote agents#26559
alexandrevarga wants to merge 5 commits into
google-gemini:mainfrom
alexandrevarga:feat/oidc-auth-provider

Conversation

@alexandrevarga

@alexandrevarga alexandrevarga commented May 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Fixes #26562

Description
This PR implements the missing openIdConnect authentication provider for Agent-to-Agent (A2A) communication,
resolving a pending TODO in the auth factory.

By enabling OIDC, Gemini CLI can now securely connect to enterprise-grade remote agents (e.g., corporate Jira,
Slack, or internal tool agents) that require modern identity-based authentication instead of simple API keys.

Key Changes

  • Dynamic Discovery: Implemented OIDC Discovery logic to automatically fetch endpoints from
    /.well-known/openid-configuration.
  • Type Safety: Used Zod to validate discovery documents, ensuring robust handling of external JSON responses.
  • Architectural Resilience: Implemented lazy loading for MCPOAuthTokenStorage to prevent circular dependency
    issues during startup.
  • Interactive Flow: Integrated with the existing PKCE and callback server utilities to provide a seamless
    browser-based login experience.

Testing

  • Unit Tests: Created openIdConnect-provider.test.ts with 100% pass rate, covering discovery and error handling.
  • Regression: Verified that existing OAuth2 and API Key providers remain unaffected (passed 117 tests in
    auth-provider directory).
  • Manual Verification: Successfully performed a real-world "smoke test" using Google's OIDC issuer, verifying the
    discovery phase and browser interaction.

Impact
This change is a prerequisite for Gemini CLI's adoption in enterprise environments, allowing it to act as a secure
client for remote agent ecosystems.

@alexandrevarga alexandrevarga requested review from a team as code owners May 6, 2026 01:53
@gemini-code-assist

gemini-code-assist Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces an OpenID Connect (OIDC) authentication provider to the core agent infrastructure, allowing Gemini CLI to authenticate with enterprise-grade remote agents. The implementation includes robust discovery mechanisms, type-safe configuration validation, and an interactive browser-based login flow. Additionally, the PR improves the reliability of the RipGrep tool by adding a system-level binary fallback, ensuring better compatibility across different environments.

Highlights

  • OIDC Authentication Provider: Implemented a new OpenID Connect (OIDC) authentication provider for Agent-to-Agent communication, enabling secure identity-based authentication for enterprise environments.
  • Dynamic Discovery: Added automatic OIDC discovery logic to fetch endpoints from /.well-known/openid-configuration, validated with Zod for type safety.
  • Interactive Login Flow: Integrated PKCE and callback server utilities to support a seamless browser-based authentication experience.
  • RipGrep Fallback: Updated the RipGrep tool to support system-level 'rg' binaries as a fallback when bundled binaries are unavailable.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

🛑 Action Required: Evaluation Approval

Steering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged.

Maintainers:

  1. Go to the Workflow Run Summary.
  2. Click the yellow 'Review deployments' button.
  3. Select the 'eval-gate' environment and click 'Approve'.

Once approved, the evaluation results will be posted here automatically.

@gemini-cli gemini-cli Bot added the status/need-issue Pull requests that need to have an associated issue. label May 6, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 6, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request implements the OpenID Connect (OIDC) authentication provider, including dynamic discovery and interactive PKCE-based authentication. It also adds a fallback mechanism for the ripGrep tool to search for the rg binary in the system PATH if the bundled version is missing. Feedback focuses on improving type safety by replacing any with specific imports, removing redundant validation logic, and addressing security vulnerabilities related to SSRF and MITM by enforcing HTTPS and validating discovery URLs.

Comment thread packages/core/src/agents/auth-provider/openIdConnect-provider.ts Outdated
Comment thread packages/core/src/agents/auth-provider/openIdConnect-provider.ts Outdated
Comment thread packages/core/src/agents/auth-provider/openIdConnect-provider.ts Outdated
Comment thread packages/core/src/agents/auth-provider/openIdConnect-provider.ts Outdated
@alexandrevarga alexandrevarga force-pushed the feat/oidc-auth-provider branch from f60a36a to 61629a3 Compare May 6, 2026 02:05
@gemini-cli gemini-cli Bot removed the status/need-issue Pull requests that need to have an associated issue. label May 6, 2026
Bojun-Vvibe added a commit to Bojun-Vvibe/oss-contributions that referenced this pull request May 6, 2026
@Bojun-Vvibe
review: drip-385 litellm + gemini-cli + qwen-code (4 PRs)
5b5079d 
- BerriAI/litellm#27266 handle response.incomplete in Responses->Chat transform [merge-after-nits]
- BerriAI/litellm#27259 add module docstring + regression test for render smoke [merge-as-is]
- google-gemini/gemini-cli#26559 implement OIDC auth provider for A2A remote agents [merge-after-nits]
- QwenLM/qwen-code#3861 preserve comments via comment-json on settings migration [merge-after-nits]
@alexandrevarga

alexandrevarga commented May 6, 2026

Copy link
Copy Markdown
Author

Implemented refresh token logic, added UUID fallback for anonymous agents to prevent collisions, hoisted duplicated awaits, and added a positive cache hit test case.

@github-actions github-actions Bot mentioned this pull request May 6, 2026
Open
@gemini-cli gemini-cli Bot added priority/p2 Important but can be addressed in a future release. area/security Issues related to security labels May 7, 2026
@gemini-cli

gemini-cli Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Hi there! Thank you for your interest in contributing to Gemini CLI.

To ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.

This PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

@github-actions github-actions Bot mentioned this pull request May 13, 2026
Open
@gemini-cli

gemini-cli Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

@gemini-cli gemini-cli Bot closed this May 20, 2026
This was referenced May 20, 2026
Open
Open
@alexandrevarga alexandrevarga deleted the feat/oidc-auth-provider branch May 28, 2026 22:34
@github-actions github-actions Bot mentioned this pull request May 29, 2026
Open
@sripasg sripasg added the size/l A large sized PR label Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/security Issues related to security priority/p2 Important but can be addressed in a future release. size/l A large sized PR status/pr-nudge-sent

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature] Implement OpenID Connect (OIDC) authentication provider for remote agents

2 participants

@alexandrevarga @sripasg