[Feat] Create a sample that demonstrates in-task authentication (secondary credentials)

[fjuma]

We recently added a security sample that shows how an A2A client can send a message to a secured A2A server agent (see https://github.com/a2aproject/a2a-samples/tree/main/samples/java/agents/magic_8_ball_security).

It would be good to have a sample that demonstrates the case where an A2A server agent requires credentials for a different system or resource (e.g., to access a specific tool on behalf of the user that requires its own auth). See the "In-Task Authentication (Secondary Credentials) section here for more details.

The new sample should be added to the a2a-samples repo.

[fjuma]

I've pushed an initial sample that requires in-task authentication to my branch here:

https://github.com/fjuma/a2a-samples/tree/auth_required/samples/java/agents/auth_required

See the README for details on how to run it.

There's also a detailed file in the repo that explains the complete flow.

The next step is probably to ask @sberyozkin to review to make sure the security configuration is correct / follows best practices and then to submit the PR against the a2a-samples repo and let Rajesh know.

@kabir @ehsavoie @maeste ^ FYI.

[sberyozkin]

Hi All,

Thanks very much @fjuma, and hope all is well.

My initial observation is that perhaps the server component that supports a Google user authentication and accessing the calendar on behalf of the user can be optimized.

Unless a client_credentials grant is used and AFAIK, with Google, they require a client private jwt authentication, quarkus-oidc-client is not required, quarkus-oidc is expected to manage a Google authentication and the OIDC token propagation feature is expected to automatically propagate the current access token. There should be no impact at all at the user code, only an @Authenticated annotation to force a user login and @AccessToken attached to REST Client to access the calendar.

Perhaps https://quarkus.io/blog/gemini-personal-assistant/ can help ? It uses Google to login a user and a custom REST client that uses @AccessToken to propagate a token to Google Calendar. There it does not go via Quarkus MCP Client, but if it is also required, then https://quarkus.io/blog/secure-mcp-client/ is relevant.

@ehsavoie have a look please and ping me anytime if you find that relevant and have any questions, thanks

[mescaja]

@sberyozkin, i have just raise a new ticket (#711) to address a similar question.

Is there any way for the AI Service to make call to an MCP Server passing along/propagating the same access token via the Authorization header without acquiring a new token out of band?