{"record":{"id":"d7210b4cdd07d77b","repo":"google-gemini/gemini-cli","slug":"openidconnect-auth-provider-not-yet-implemented","errorCode":null,"errorMessage":"openIdConnect auth provider not yet implemented","messagePattern":"openIdConnect auth provider not yet implemented","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/auth-provider/factory.ts","lineNumber":87,"sourceCode":"\n      case 'oauth2': {\n        // Dynamic import to avoid pulling MCPOAuthTokenStorage into the\n        // factory's static module graph, which causes initialization\n        // conflicts with code_assist/oauth-credential-storage.ts.\n        const { OAuth2AuthProvider } = await import('./oauth2-provider.js');\n        const provider = new OAuth2AuthProvider(\n          authConfig,\n          options.agentName ?? 'unknown',\n          agentCard,\n          options.agentCardUrl,\n        );\n        await provider.initialize();\n        return provider;\n      }\n\n      case 'openIdConnect':\n        // TODO: Implement\n        throw new Error('openIdConnect auth provider not yet implemented');\n\n      default: {\n        const _exhaustive: never = authConfig;\n        throw new Error(\n          `Unknown auth type: ${(_exhaustive as A2AAuthConfig).type}`,\n        );\n      }\n    }\n  }\n\n  /** Create provider directly from config, bypassing AgentCard validation. */\n  static async createFromConfig(\n    authConfig: A2AAuthConfig,\n    agentName?: string,\n  ): Promise<A2AAuthProvider> {\n    const provider = await A2AAuthProviderFactory.create({\n      authConfig,\n      agentName,","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/auth-provider/factory.ts#L69-L105","documentation":"A2AAuthProviderFactory.create switches on authConfig.type and explicitly rejects 'openIdConnect' because no provider is implemented yet (marked TODO). It throws synchronously inside the async factory. Any agent whose frontmatter auth.type resolves to openIdConnect cannot be authenticated until the provider ships.","triggerScenarios":"An agent's frontmatter declares auth: { type: 'openIdConnect', ... }; a remote agent card exposes an openIdConnect security scheme and the loader mapped it to this config type; createFromConfig was called with an OIDC config.","commonSituations":"Adopting an A2A server that only advertises OIDC; testing OIDC support before the provider landed; an agent card auto-discovered from a server that uses OIDC exclusively.","solutions":["Switch the agent to a supported auth type (oauth2, http, apiKey, or google-credentials) if the server supports it.","Wait for / implement the openIdConnect provider in the factory.","If the server offers multiple schemes, configure one that is implemented.","Run the agent without auth if the server permits anonymous access."],"exampleFix":"# before\n---\nname: svc\nkind: remote\nauth:\n  type: openIdConnect\n---\n\n# after (if server also supports oauth2)\n---\nname: svc\nkind: remote\nauth:\n  type: oauth\n  client_id: my-client\n---","handlingStrategy":"type-guard","validationCode":"const supported = new Set(['google-credentials', 'apiKey', 'http', 'oauth2']);\nif (!supported.has(authConfig.type)) {\n  throw new Error(`Auth type '${authConfig.type}' is not supported. Use one of: ${[...supported].join(', ')}`);\n}\nawait A2AAuthProviderFactory.create({ authConfig, agentName });","typeGuard":"function isImplementedAuthType(\n  t: string,\n): t is 'google-credentials' | 'apiKey' | 'http' | 'oauth2' {\n  return ['google-credentials', 'apiKey', 'http', 'oauth2'].includes(t);\n}","tryCatchPattern":null,"preventionTips":["Check the auth.type allowlist before calling the factory.","Track the openIdConnect TODO before depending on it.","Prefer a server-advertised scheme that is already implemented."],"tags":["auth","oidc","not-implemented","factory"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}