Some OIDC Providers require a Nonce parameter.

[DinoChiesa]

SUMMARY

Some OIDC providers require a nonce parameter in the initial authorize request. I don't see a way to configure the inclusion of a nonce.

Details

auth_scheme = OpenIdConnectWithConfig(
    authorization_endpoint=settings["OAUTH2_AUTHZ_ENDPOINT"],
    token_endpoint=settings["OAUTH2_TOKEN_ENDPOINT"],
    scopes=["openid", "read", "write"],
    # I think I should be able to optionally configure here, that a nonce is required for the authz endpoint
)

auth_credential = AuthCredential(
    auth_type=AuthCredentialTypes.OPEN_ID_CONNECT,
    oauth2=OAuth2Auth(
        client_id=settings["OAUTH2_CLIENT_ID"],
        client_secret=settings["OAUTH2_CLIENT_SECRET"],
    ),
)

with open(
    os.path.join(os.path.dirname(__file__), "apispec1.yaml"), "r", encoding="utf-8"
) as f:
    openapi_spec_string = f.read()

products_toolset = OpenAPIToolset(
    spec_str=openapi_spec_string,
    spec_str_type="yaml",
    auth_scheme=auth_scheme,
    auth_credential=auth_credential,
)

# --- Agent Definition ---
root_agent = LlmAgent(
    name="products_query_agent",
    model="gemini-2.5-flash",
    tools=[products_toolset],
    instruction="""You are a Store assistant managing Product information retrieval via an API."""
 )

This works if my OIDC provider does not insist on a Nonce. It does not work if the OIDC requires a nonce.

nonce is an optional query param attached to the authorize endpoint, like state.
The nonce can be anything (like state). Each OIDC provider may enforce its own "no repeats" interval for nonce.

Expected behavior
OpenIdConnectWithConfig optionally allows me to tell ADK to include a nonce in the /authorize endpoint

Further information:

• OS: Linux
• Python version(python -V): 3.12.9
• ADK version(pip show google-adk): 1.7.0

Model Information:
gemini-2.5-flash, but I think it's irrelevant here.

[klateefa]

@DinoChiesa Thanks for reporting!
We are currently reviewing your feature request'
Thank you for understanding.