Issue Station
Sign In
Tools hereToolbox

gemini-cli - ✅(Solved) Fix [Feature] Implement OpenID Connect (OIDC) authentication provider for remote agents [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
google-gemini/gemini-cli#26562•Fetched 2026-05-06 06:35:27
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
alexandrevargaalexandrevarga
Participants
alexandrevargaalexandrevargagemini-cli[bot]gemini-cli[bot]
Timeline (top)
commented ×1cross-referenced ×1issue_type_added ×1labeled ×1

Error Message

Currently, the openIdConnect provider type is unimplemented and throws an error, preventing Gemini CLI from connecting to agents that require OIDC. This enhancement is critical for enterprise adoption, as it allows Gemini CLI to securely interact with remote agents protected by corporate identity providers like Okta, Auth0, or Microsoft Entra ID.

Fix Action

Fixed

PR fix notes

PR #26559: feat(core): implement OpenID Connect (OIDC) auth provider for remote agents

Description (problem / solution / changelog)

Fixes #26562

Description This PR implements the missing openIdConnect authentication provider for Agent-to-Agent (A2A) communication, resolving a pending TODO in the auth factory.

By enabling OIDC, Gemini CLI can now securely connect to enterprise-grade remote agents (e.g., corporate Jira, Slack, or internal tool agents) that require modern identity-based authentication instead of simple API keys.

Key Changes

  • Dynamic Discovery: Implemented OIDC Discovery logic to automatically fetch endpoints from /.well-known/openid-configuration.
  • Type Safety: Used Zod to validate discovery documents, ensuring robust handling of external JSON responses.
  • Architectural Resilience: Implemented lazy loading for MCPOAuthTokenStorage to prevent circular dependency issues during startup.
  • Interactive Flow: Integrated with the existing PKCE and callback server utilities to provide a seamless browser-based login experience.

Testing

  • Unit Tests: Created openIdConnect-provider.test.ts with 100% pass rate, covering discovery and error handling.
  • Regression: Verified that existing OAuth2 and API Key providers remain unaffected (passed 117 tests in auth-provider directory).
  • Manual Verification: Successfully performed a real-world "smoke test" using Google's OIDC issuer, verifying the discovery phase and browser interaction.

Impact This change is a prerequisite for Gemini CLI's adoption in enterprise environments, allowing it to act as a secure client for remote agent ecosystems.

Changed files

  • packages/core/src/agents/auth-provider/factory.ts (modified, +11/-4)
  • packages/core/src/agents/auth-provider/openIdConnect-provider.test.ts (added, +143/-0)
  • packages/core/src/agents/auth-provider/openIdConnect-provider.ts (added, +222/-0)
RAW_BUFFERClick to expand / collapse

What would you like to be added?

I would like to implement the dedicated OpenIdConnectAuthProvider within the auth provider package. This feature should include dynamic endpoint discovery via the standard openid-configuration path, runtime schema validation of discovery documents using Zod, full integration with the existing PKCE-enabled OAuth flow and local callback server, and strict HTTPS enforcement for all authentication endpoints to maintain high security standards.

Why is this needed?

Currently, the openIdConnect provider type is unimplemented and throws an error, preventing Gemini CLI from connecting to agents that require OIDC. This enhancement is critical for enterprise adoption, as it allows Gemini CLI to securely interact with remote agents protected by corporate identity providers like Okta, Auth0, or Microsoft Entra ID.

Additional context

This feature resolves a pending TODO in the auth-provider factory. I have already verified the feasibility through manual smoke tests using real-world OIDC issuers.

extent analysis

TL;DR

Implementing the OpenIdConnectAuthProvider with dynamic endpoint discovery, runtime schema validation, and strict HTTPS enforcement is likely to resolve the issue.

Guidance

  • Implement the OpenIdConnectAuthProvider class within the auth provider package to handle OIDC-specific authentication logic.
  • Use Zod for runtime schema validation of discovery documents to ensure security and data integrity.
  • Integrate the new auth provider with the existing PKCE-enabled OAuth flow and local callback server to maintain consistency and security.
  • Enforce strict HTTPS for all authentication endpoints to prevent security vulnerabilities.

Example

No code snippet is provided due to the lack of specific implementation details in the issue.

Notes

The implementation details may vary depending on the specific requirements and constraints of the project, such as the version of Zod being used or the existing OAuth flow implementation.

Recommendation

Apply workaround by implementing the OpenIdConnectAuthProvider, as it is a critical feature for enterprise adoption and resolves a pending TODO in the auth-provider factory.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#agent execution#callback error#memory management#API rate limit#retriever error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

gemini-cli - ✅(Solved) Fix [Feature] Implement OpenID Connect (OIDC) authentication provider for remote agents [1 pull requests, 1 comments, 2 participants]