mirror of
https://github.com/google/adk-docs.git
synced 2026-09-14 16:16:59 +08:00
Ali Adnan
882165a8b2
* Update conditional-routing.py * Update tools_and_agent.py * Update tools_and_agent.py * Update tools_and_agent.py --------- Co-authored-by: Joe Fernandez <931947+joefernandez@users.noreply.github.com>
89 lines
4.1 KiB
Python
89 lines
4.1 KiB
Python
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import os
|
|
|
|
from google.adk.auth.auth_schemes import OpenIdConnectWithConfig
|
|
from google.adk.auth.auth_credential import AuthCredential, AuthCredentialTypes, OAuth2Auth
|
|
from google.adk.tools.openapi_tool.openapi_spec_parser.openapi_toolset import OpenAPIToolset
|
|
from google.adk.agents.llm_agent import LlmAgent
|
|
|
|
# --- Authentication Configuration ---
|
|
# This section configures how the agent will handle authentication using OpenID Connect (OIDC),
|
|
# often layered on top of OAuth 2.0.
|
|
|
|
# Define the Authentication Scheme using OpenID Connect.
|
|
# This object tells the ADK *how* to perform the OIDC/OAuth2 flow.
|
|
# It requires details specific to your Identity Provider (IDP), like Google OAuth, Okta, Auth0, etc.
|
|
# Note: Replace the example Okta URLs and credentials with your actual IDP details.
|
|
# All following fields are required, and available from your IDP.
|
|
auth_scheme = OpenIdConnectWithConfig(
|
|
# The URL of the IDP's authorization endpoint where the user is redirected to log in.
|
|
authorization_endpoint="https://your-endpoint.okta.com/oauth2/v1/authorize",
|
|
# The URL of the IDP's token endpoint where the authorization code is exchanged for tokens.
|
|
token_endpoint="https://your-token-endpoint.okta.com/oauth2/v1/token",
|
|
# The scopes (permissions) your application requests from the IDP.
|
|
# 'openid' is standard for OIDC. 'profile' and 'email' request user profile info.
|
|
scopes=['openid', 'profile', "email"]
|
|
)
|
|
|
|
# Define the Authentication Credentials for your specific application.
|
|
# This object holds the client identifier and secret that your application uses
|
|
# to identify itself to the IDP during the OAuth2 flow.
|
|
# !! SECURITY WARNING: Avoid hardcoding secrets in production code. !!
|
|
# !! Use environment variables or a secret management system instead. !!
|
|
auth_credential = AuthCredential(
|
|
auth_type=AuthCredentialTypes.OPEN_ID_CONNECT,
|
|
oauth2=OAuth2Auth(
|
|
client_id="CLIENT_ID",
|
|
client_secret="CLIENT_SECRET",
|
|
)
|
|
)
|
|
|
|
|
|
# --- Toolset Configuration from OpenAPI Specification ---
|
|
# This section defines a sample set of tools the agent can use, configured with Authentication
|
|
# from steps above.
|
|
# This sample set of tools use endpoints protected by Okta and requires an OpenID Connect flow
|
|
# to acquire end user credentials.
|
|
with open(os.path.join(os.path.dirname(__file__), 'spec.yaml'), 'r') as f:
|
|
spec_content = f.read()
|
|
|
|
userinfo_toolset = OpenAPIToolset(
|
|
spec_str=spec_content,
|
|
spec_str_type='yaml',
|
|
# ** Crucially, associate the authentication scheme and credentials with these tools. **
|
|
# This tells the ADK that the tools require the defined OIDC/OAuth2 flow.
|
|
auth_scheme=auth_scheme,
|
|
auth_credential=auth_credential,
|
|
)
|
|
|
|
# --- Agent Configuration ---
|
|
# Configure and create the main LLM Agent.
|
|
root_agent = LlmAgent(
|
|
model='gemini-2.0-flash',
|
|
name='enterprise_assistant',
|
|
instruction='Help user integrate with multiple enterprise systems, including retrieving user information which may require authentication.',
|
|
tools=[userinfo_toolset],
|
|
)
|
|
|
|
# --- Ready for Use ---
|
|
# The `root_agent` is now configured with tools protected by OIDC/OAuth2 authentication.
|
|
# When the agent attempts to use one of these tools, the ADK framework will automatically
|
|
# trigger the authentication flow defined by `auth_scheme` and `auth_credential`
|
|
# if valid credentials are not already available in the session.
|
|
# The subsequent interaction flow would guide the user through the login process and handle
|
|
# token exchanging, and automatically attach the exchanged token to the endpoint defined in
|
|
# the tool.
|