mirror of
https://github.com/google/adk-docs.git
synced 2026-09-14 16:16:59 +08:00
Kristopher Overholt
74 lines
3.5 KiB
Python
74 lines
3.5 KiB
Python
import os
|
|
|
|
from google.adk.auth.auth_schemes import OpenIdConnectWithConfig
|
|
from google.adk.auth.auth_credential import AuthCredential, AuthCredentialTypes, OAuth2Auth
|
|
from google.adk.tools.openapi_tool.openapi_spec_parser.openapi_toolset import OpenAPIToolset
|
|
from google.adk.agents.llm_agent import LlmAgent
|
|
|
|
# --- Authentication Configuration ---
|
|
# This section configures how the agent will handle authentication using OpenID Connect (OIDC),
|
|
# often layered on top of OAuth 2.0.
|
|
|
|
# Define the Authentication Scheme using OpenID Connect.
|
|
# This object tells the ADK *how* to perform the OIDC/OAuth2 flow.
|
|
# It requires details specific to your Identity Provider (IDP), like Google OAuth, Okta, Auth0, etc.
|
|
# Note: Replace the example Okta URLs and credentials with your actual IDP details.
|
|
# All following fields are required, and available from your IDP.
|
|
auth_scheme = OpenIdConnectWithConfig(
|
|
# The URL of the IDP's authorization endpoint where the user is redirected to log in.
|
|
authorization_endpoint="https://your-endpoint.okta.com/oauth2/v1/authorize",
|
|
# The URL of the IDP's token endpoint where the authorization code is exchanged for tokens.
|
|
token_endpoint="https://your-token-endpoint.okta.com/oauth2/v1/token",
|
|
# The scopes (permissions) your application requests from the IDP.
|
|
# 'openid' is standard for OIDC. 'profile' and 'email' request user profile info.
|
|
scopes=['openid', 'profile', "email"]
|
|
)
|
|
|
|
# Define the Authentication Credentials for your specific application.
|
|
# This object holds the client identifier and secret that your application uses
|
|
# to identify itself to the IDP during the OAuth2 flow.
|
|
# !! SECURITY WARNING: Avoid hardcoding secrets in production code. !!
|
|
# !! Use environment variables or a secret management system instead. !!
|
|
auth_credential = AuthCredential(
|
|
auth_type=AuthCredentialTypes.OPEN_ID_CONNECT,
|
|
oauth2=OAuth2Auth(
|
|
client_id="CLIENT_ID",
|
|
client_secret="CIENT_SECRET",
|
|
)
|
|
)
|
|
|
|
|
|
# --- Toolset Configuration from OpenAPI Specification ---
|
|
# This section defines a sample set of tools the agent can use, configured with Authentication
|
|
# from steps above.
|
|
# This sample set of tools use endpoints protected by Okta and requires an OpenID Connect flow
|
|
# to acquire end user credentials.
|
|
with open(os.path.join(os.path.dirname(__file__), 'spec.yaml'), 'r') as f:
|
|
spec_content = f.read()
|
|
|
|
userinfo_toolset = OpenAPIToolset(
|
|
spec_str=spec_content,
|
|
spec_str_type='yaml',
|
|
# ** Crucially, associate the authentication scheme and credentials with these tools. **
|
|
# This tells the ADK that the tools require the defined OIDC/OAuth2 flow.
|
|
auth_scheme=auth_scheme,
|
|
auth_credential=auth_credential,
|
|
)
|
|
|
|
# --- Agent Configuration ---
|
|
# Configure and create the main LLM Agent.
|
|
root_agent = LlmAgent(
|
|
model='gemini-2.0-flash',
|
|
name='enterprise_assistant',
|
|
instruction='Help user integrate with multiple enterprise systems, including retrieving user information which may require authentication.',
|
|
tools=userinfo_toolset.get_tools(),
|
|
)
|
|
|
|
# --- Ready for Use ---
|
|
# The `root_agent` is now configured with tools protected by OIDC/OAuth2 authentication.
|
|
# When the agent attempts to use one of these tools, the ADK framework will automatically
|
|
# trigger the authentication flow defined by `auth_scheme` and `auth_credential`
|
|
# if valid credentials are not already available in the session.
|
|
# The subsequent interaction flow would guide the user through the login process and handle
|
|
# token exchanging, and automatically attach the exchanged token to the endpoint defined in
|
|
# the tool. |