Skip to content

fix(tools): Use OAuth2 client-credentials scheme for OpenAPI SA helpers - #6660

Closed
a2105z wants to merge 1 commit into
google:mainfrom
a2105z:fix/openapi-sa-auth-scheme-client-credentials
Closed

fix(tools): Use OAuth2 client-credentials scheme for OpenAPI SA helpers#6660
a2105z wants to merge 1 commit into
google:mainfrom
a2105z:fix/openapi-sa-auth-scheme-client-credentials

Conversation

@a2105z

@a2105z a2105z commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • service_account_scheme_credential / service_account_dict_to_scheme_credential returned HTTPBearer, so CredentialManager._is_client_credentials_flow() was false and get_auth_credential() returned None (agent got adk_request_credential instead of an SA token exchange).
  • Helpers now return an OAuth2 scheme with clientCredentials so CredentialManager can proceed with the service-account exchange.
  • Adds a CredentialManager regression test covering the end-to-end gate.

Fixes #6656

Test plan

  • pytest tests/unittests/tools/openapi_tool/auth/test_auth_helper.py (+ related SA exchanger / google_api_tool tests) — 58 passed
  • Pre-commit on touched files
  • Confirm OpenAPI tool with SA helpers no longer emits adk_request_credential for SA exchange

@a2105z
fix(tools): Use OAuth2 client-credentials scheme for SA helpers
7ae1be1 
service_account_scheme_credential and service_account_dict_to_scheme_credential
returned HTTPBearer, so CredentialManager treated the SA as needing interactive
auth and returned None (adk_request_credential) instead of exchanging it for a
token. Return an OAuth2 client-credentials scheme so SA exchange can proceed.

Fixes google#6656
@a2105z a2105z mentioned this pull request Aug 9, 2026
Closed
@adk-bot adk-bot added the tools [Component] This issue is related to tools label Aug 9, 2026
@a2105z

a2105z commented Aug 9, 2026

Copy link
Copy Markdown
Contributor Author

Hi @DeanChensj @GWeale @Jacksunwei — ready for review when you have a moment.

This fixes #6656: OpenAPI SA helpers were returning HTTPBearer, so CredentialManager skipped SA exchange and returned None (adk_request_credential). Helpers now return an OAuth2 clientCredentials scheme; regression test covers the CredentialManager gate.

cc @idofl (reporter) — would appreciate a look if this matches what you hit.

@idofl

idofl commented Aug 10, 2026

Copy link
Copy Markdown

Hi @DeanChensj @GWeale @Jacksunwei — ready for review when you have a moment.

This fixes #6656: OpenAPI SA helpers were returning HTTPBearer, so CredentialManager skipped SA exchange and returned None (adk_request_credential). Helpers now return an OAuth2 clientCredentials scheme; regression test covers the CredentialManager gate.

cc @idofl (reporter) — would appreciate a look if this matches what you hit.

The code executes as expected with the new revision. Thank you!

@a2105z

a2105z commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

@idofl Thank you. @xuanyang15 @DeanChensj @GWeale @Jacksunwei
Sorry for pinging everyone, but is it possible for you to review this and approve for merge?

@xuanyang15

xuanyang15 commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

@a2105z Thanks for creating this PR! It is currently in review.

copybara-service Bot pushed a commit that referenced this pull request Aug 18, 2026
@a2105z @copybara-github
fix: use OAuth2 client-credentials scheme for OpenAPI SA helpers
9897217 
Merge #6660

Change service-account OpenAPI helpers to return an OAuth2 client-credentials scheme so CredentialManager can perform token exchange.

Also, bypass the credential service caching for all SERVICE_ACCOUNT credentials. This ensures we don't cache exchanged tokens that cannot be refreshed, but means token exchange will run on each tool execution if the manager/exchanger is not reused.

Fixes #6656

PiperOrigin-RevId: 966305100
@adk-bot

adk-bot commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

Thank you @a2105z for your contribution! 🎉

Your changes have been successfully imported and merged via Copybara in commit 9897217.

Closing this PR as the changes are now in the main branch.

@adk-bot adk-bot added the merged [Status] This PR is merged label Aug 18, 2026
@adk-bot adk-bot closed this Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@xuanyang15 xuanyang15

Labels

merged [Status] This PR is merged tools [Component] This issue is related to tools

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

OpenAPITool's helper function for service accounts return incorrect auth_scheme, leading to failure to retrieve SA tokens

4 participants

@a2105z @idofl @xuanyang15 @adk-bot