fix(auth): Make OAuth prompt parameter configurable#5717
Open
akshay-kumar-bm wants to merge 2 commits into
Open
fix(auth): Make OAuth prompt parameter configurable#5717akshay-kumar-bm wants to merge 2 commits into
akshay-kumar-bm wants to merge 2 commits into
Conversation
The `prompt` parameter in `AuthHandler.generate_auth_uri` was hardcoded
to "consent", which forced a consent screen on every OAuth flow. This
broke scenarios where consent is granted at the application level (e.g.
Azure Entra ID admin-consented permissions) — non-admin users would be
unable to complete the flow.
This change adds an optional `prompt` field to `OAuth2Auth`. When unset,
the value falls back to "consent" so existing callers see no behavior
change. Callers can now pass standard OIDC values ("none", "login",
"consent", "select_account") or IdP-specific values (e.g. Azure's
"admin_consent") to control the authorization endpoint behavior.
Fixes google#3046
rohityan
added
the
agent config
Collaborator
|
Hi @akshay-kumar-bm , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Your PR has been received by the team and is currently under review. We will provide feedback as soon as we have an update to share. |
rohityan
added
the
needs review
Collaborator
|
Hi @sasha-gitg , can you please review this. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Makes the OAuth
promptquery parameter configurable onOAuth2Authinstead of being hardcoded to"consent"inAuthHandler.generate_auth_uri.Why
Per #3046, hardcoding
prompt=consentbreaks scenarios where consent is granted at the application level (e.g. Azure Entra ID admin-consented permissions). Non-admin users are sent to a consent screen they cannot complete, blocking the flow. Multiple users have hit this (see issue thread).What changed
src/google/adk/auth/auth_credential.py— Added optionalpromptfield onOAuth2Auth. Typed asLiteral["none", "login", "consent", "select_account"] | str | None— theLiteralgives IDE autocomplete for the RFC 6749 / OIDC standard values, and the| strfallback allows IdP-specific values like Azure's"admin_consent"to pass through unchanged.src/google/adk/auth/auth_handler.py— Forwardsauth_credential.oauth2.promptto the authorization endpoint, falling back to"consent"when unset (preserves existing behavior).tests/unittests/auth/test_auth_handler.py— Added 4 new test cases (default-is-consent, customnone, customselect_account, IdP-specificadmin_consent), strengthened the existingtest_generate_auth_uri_with_audience_and_promptto actually assert the prompt value, and extendedMockOAuth2Session.create_authorization_urlto echo thepromptkwarg (mirrors the existingaudiencepattern).Issue
Fixes #3046
Testing
pytest tests/unittests/auth/test_auth_handler.py— 29 passedpytest tests/unittests/auth/— 185 passedpre-commit run --files <changed files>— all hooks passBackward compatibility
The new field defaults to
None, andNonefalls back to"consent"at the call site, so existing callers see no behavior change. No tests were modified to accommodate new behavior — only the previously-untested default was locked in.Checklist
CONTRIBUTING.md.