Sessionless user profile retrieval by jeramysoucy · Pull Request #249839 · elastic/kibana

jeramysoucy · 2026-01-21T10:19:52Z

Summary

This PR enhances the user profile getCurrent function API, and subsequently the /internal/security/user_profile endpoint, to retrieve the user profile for requests authenticated via basic and apikey authorization headers.

No breaking changes or release notes - only internal APIs are enhanced and retain original behavior.

Telemetry

This PR adds an OTel counter for invocations of the getCurrent function, with optional attributes for when profile activation or API key retrieval is required.

Note: The counter is not increased if authorization is not via session, basic, or API key. However, in this case nothing happens and null is returned.

Tests

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.test.ts
x-pack/platform/test/security_api_integration/tests/user_profiles/get_current.ts
x-pack/platform/test/cases_api_integration/security_and_spaces/config_basic.ts
x-pack/platform/test/cases_api_integration/security_and_spaces/config_trial.ts

The cases tests had to be updated to account for the additionally activated user profiles. Note: I have temporarily skipped some tests which aimed to confirm when no profile is available. I am currently evaluating whether these tests should remain and how to implement them given the changes.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

jeramysoucy · 2026-01-21T10:20:19Z

/ci

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts

jeramysoucy · 2026-01-22T11:34:07Z

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts

+    const activatedProfile = await this.activate(clusterClient, {
+      type: 'password',
+      username,
+      password,
+    }); // ToDo: should we instead catch and wrap the error, or return gracefully with null?ß


I wonder if it makes more sense to catch and gracefully return null here.

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts

elasticmachine · 2026-01-22T11:43:08Z

Pinging @elastic/kibana-security (Team:Security)

rgodfrey-elastic

Everything looks good and seems to work well! I left a couple comments/questions. Let me know what you think

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts

jeramysoucy · 2026-02-13T15:42:49Z

@rgodfrey-elastic Thanks for the thorough review! I believe I addressed all of your concerns in a3af1ad
Could you have another look?

rgodfrey-elastic

LGTM. Thanks for making those changes

michaelolo24 · 2026-02-18T20:33:57Z

...st/cases_api_integration/security_and_spaces/tests/common/internal/user_actions_get_users.ts

    describe('no profiles', () => {
      it('returns the users correctly without profile ids', async () => {
-        const postedCase = await createCase(supertest, getPostCaseRequest());
+        // We need an API key without security or API privileges to ensure that requests


Thanks for this comment

jeramysoucy · 2026-02-19T09:05:17Z

...form/test/cases_api_integration/security_and_spaces/tests/trial/user_profiles/get_current.ts

-              privileges: ['*'], // 'feature_securitySolutionCases.all', <- not sure why this was not enough
+              privileges: [
+                'feature_securitySolutionCasesV2.all',
+                'feature_securitySolutionFixture.all',


This feature privilege appears to be needed to create the test Case as it is defined.

Most likely due to the configuration here:https://github.com/elastic/kibana/blob/main/x-pack/platform/test/cases_api_integration/common/plugins/security_solution/kibana.jsonc meaning you need access to security solution via this fixture to be able to create a case in security

elasticmachine · 2026-02-19T10:36:29Z

💚 Build Succeeded

Buildkite Build
Commit: 9f7af6a

Metrics [docs]

✅ unchanged

History

💛 Build #395117 was flaky eb35bf9
💛 Build #394725 was flaky a01e01a
💚 Build #391609 succeeded dc977a1
💔 Build #390577 failed ac9d328
💔 Build #390333 failed a5a3036
💔 Build #390004 failed c2851d9

michaelolo24

Thanks for making these changes!

kibanamachine · 2026-02-20T08:22:51Z

Starting backport for target branches: 9.3

https://github.com/elastic/kibana/actions/runs/22216768496

Closes elastic#245091 ## Summary This PR enhances the user profile [getCurrent function](https://github.com/elastic/kibana/blob/a7aca33f10bc8ccf0c4c71c458ffdc06e1e5124a/x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts#L191-L242) API, and subsequently the `/internal/security/user_profile` endpoint, to retrieve the user profile for requests authenticated via `basic` and `apikey` authorization headers. No breaking changes or release notes - only internal APIs are enhanced and retain original behavior. ### Telemetry This PR adds an OTel counter for invocations of the getCurrent function, with optional attributes for when profile activation or API key retrieval is required. Note: The counter is not increased if authorization is not via session, basic, or API key. However, in this case nothing happens and `null` is returned. ### Tests - x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.test.ts - x-pack/platform/test/security_api_integration/tests/user_profiles/get_current.ts - x-pack/platform/test/cases_api_integration/security_and_spaces/config_basic.ts - x-pack/platform/test/cases_api_integration/security_and_spaces/config_trial.ts The cases tests had to be updated to account for the additionally activated user profiles. Note: I have temporarily skipped some tests which aimed to confirm when no profile is available. I am currently evaluating whether these tests should remain and how to implement them given the changes. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 6447a06)

kibanamachine · 2026-02-20T08:31:12Z

💚 All backports created successfully

Status	Branch	Result
✅	9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine · 2026-02-24T08:49:00Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @jeramysoucy

…ouldAddAccessControl (#255065) ## Summary This PR changes how the dashboard save modal determines if access control metadata should be added to a dashboard. Previously it used the user profile service, however, since #249839, the getCurrent function now attempts to retrieve the user profile when the incoming request is authenticated via Basic or API key. This resulted in adding the access control metadata when authenticated to the UI via a proxy or the anonymous authc provider. The Saved Object Repository does not use the user profiles service to determine the current user, but rather the authentication service, which does not retrieve the user profile when authenticated via API key. This caused errors when creating dashboards in the UI when authenticated via a proxy or the anonymous authc provider - the UI would add the access control meta data and the SO repository would reject the operation due to lacking a profile ID for the owner field. This PR implements a short term solution by switching to the authentication service in the dashboard save modal - matching the mechanism of checking for an active profile ID in the SO repository. A longer-term solution might be different, should we want to support creating dashboards with access control via API key. In this case, we would need to modify the SO repository code (actually, the security extension), if feasible, to use the user profile service. However, his may introduce too much overhead. ### Testing The easiest way to test this fix is to configure the anonymous authentication provider. When users are authenticated anonymously they do not activate a user profile. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... ## Release note Fixes an issue where saving a dashboard included access control features when a user profile, which is required for access control, was not available. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…ouldAddAccessControl (elastic#255065) ## Summary This PR changes how the dashboard save modal determines if access control metadata should be added to a dashboard. Previously it used the user profile service, however, since elastic#249839, the getCurrent function now attempts to retrieve the user profile when the incoming request is authenticated via Basic or API key. This resulted in adding the access control metadata when authenticated to the UI via a proxy or the anonymous authc provider. The Saved Object Repository does not use the user profiles service to determine the current user, but rather the authentication service, which does not retrieve the user profile when authenticated via API key. This caused errors when creating dashboards in the UI when authenticated via a proxy or the anonymous authc provider - the UI would add the access control meta data and the SO repository would reject the operation due to lacking a profile ID for the owner field. This PR implements a short term solution by switching to the authentication service in the dashboard save modal - matching the mechanism of checking for an active profile ID in the SO repository. A longer-term solution might be different, should we want to support creating dashboards with access control via API key. In this case, we would need to modify the SO repository code (actually, the security extension), if feasible, to use the user profile service. However, his may introduce too much overhead. ### Testing The easiest way to test this fix is to configure the anonymous authentication provider. When users are authenticated anonymously they do not activate a user profile. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... ## Release note Fixes an issue where saving a dashboard included access control features when a user profile, which is required for access control, was not available. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 009aea1)

… getShouldAddAccessControl (#255065) (#257050) # Backport This will backport the following commits from `main` to `9.3`: - [[Write-restricted dashboards] Update user profile retrieval for getShouldAddAccessControl (#255065)](#255065)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>

…ouldAddAccessControl (#255065) ## Summary This PR changes how the dashboard save modal determines if access control metadata should be added to a dashboard. Previously it used the user profile service, however, since #249839, the getCurrent function now attempts to retrieve the user profile when the incoming request is authenticated via Basic or API key. This resulted in adding the access control metadata when authenticated to the UI via a proxy or the anonymous authc provider. The Saved Object Repository does not use the user profiles service to determine the current user, but rather the authentication service, which does not retrieve the user profile when authenticated via API key. This caused errors when creating dashboards in the UI when authenticated via a proxy or the anonymous authc provider - the UI would add the access control meta data and the SO repository would reject the operation due to lacking a profile ID for the owner field. This PR implements a short term solution by switching to the authentication service in the dashboard save modal - matching the mechanism of checking for an active profile ID in the SO repository. A longer-term solution might be different, should we want to support creating dashboards with access control via API key. In this case, we would need to modify the SO repository code (actually, the security extension), if feasible, to use the user profile service. However, his may introduce too much overhead. ### Testing The easiest way to test this fix is to configure the anonymous authentication provider. When users are authenticated anonymously they do not activate a user profile. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... ## Release note Fixes an issue where saving a dashboard included access control features when a user profile, which is required for access control, was not available. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

POC for sessionless profile retrieval

d6da48e

jeramysoucy added Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// Feature:Security/User Profile labels Jan 21, 2026

Merge branch 'main' into sessionless-profile-retrieval

2421ed6

jeramysoucy commented Jan 21, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts Outdated Show resolved Hide resolved

jeramysoucy commented Jan 21, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts Show resolved Hide resolved

kibanamachine and others added 5 commits January 21, 2026 10:32

Changes from node scripts/lint_ts_projects --fix

7ac1f19

Changes from node scripts/regenerate_moon_projects.js --update

5bcf3f9

Removes comment

2e949c3

Cleans up code - still need to remove todo comments

ab26f29

Fixes unit tests - utiliy functions used capital header keys

55360bd

jeramysoucy commented Jan 22, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts Show resolved Hide resolved

jeramysoucy commented Jan 22, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts Show resolved Hide resolved

jeramysoucy commented Jan 22, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts Show resolved Hide resolved

jeramysoucy added 2 commits January 22, 2026 12:37

Removes todo comments

7760cfd

Merge branch 'main' into sessionless-profile-retrieval

a9fd656

jeramysoucy added the v9.4.0 label Jan 22, 2026

jeramysoucy marked this pull request as ready for review January 22, 2026 11:43

jeramysoucy requested a review from a team as a code owner January 22, 2026 11:43

jeramysoucy requested a review from rgodfrey-elastic January 22, 2026 11:43

jeramysoucy added backport:version Backport to applied version labels v9.3.0 release_note:enhancement release_note:skip Skip the PR/issue when compiling release notes and removed release_note:enhancement labels Jan 22, 2026

kibanamachine added 2 commits January 22, 2026 11:53

Changes from node scripts/lint_ts_projects --fix

da451cf

Changes from node scripts/regenerate_moon_projects.js --update

5ba53c6

rgodfrey-elastic reviewed Feb 12, 2026

View reviewed changes

Addresses review feedback

a3af1ad

jeramysoucy requested a review from rgodfrey-elastic February 13, 2026 15:42

Merge branch 'main' into sessionless-profile-retrieval

a01e01a

rgodfrey-elastic approved these changes Feb 13, 2026

View reviewed changes

Merge branch 'main' into sessionless-profile-retrieval

eb35bf9

michaelolo24 reviewed Feb 18, 2026

View reviewed changes

Updates privileges for cases no profile tests

9f7af6a

jeramysoucy commented Feb 19, 2026

View reviewed changes

jeramysoucy requested a review from michaelolo24 February 19, 2026 13:47

Merge branch 'main' into sessionless-profile-retrieval

d8d2d67

michaelolo24 approved these changes Feb 19, 2026

View reviewed changes

jeramysoucy merged commit 6447a06 into elastic:main Feb 20, 2026
16 checks passed

kibanamachine mentioned this pull request Feb 20, 2026

[9.3] Sessionless user profile retrieval (#249839) #254122

Closed

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Feb 24, 2026

jeramysoucy added backport:skip This PR does not require backporting and removed backport missing Added to PRs automatically when the are determined to be missing a backport. backport:version Backport to applied version labels v9.3.0 labels Feb 24, 2026

jeramysoucy mentioned this pull request Feb 26, 2026

[Write-restricted dashboards] Update user profile retrieval for getShouldAddAccessControl #255065

Merged

10 tasks

Conversation

jeramysoucy commented Jan 21, 2026 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Telemetry

Tests

Checklist

Uh oh!

jeramysoucy commented Jan 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeramysoucy Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Jan 22, 2026

Uh oh!

rgodfrey-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeramysoucy commented Feb 13, 2026

Uh oh!

rgodfrey-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 19, 2026

💚 Build Succeeded

Metrics [docs]

History

Uh oh!

michaelolo24 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Feb 20, 2026

Uh oh!

kibanamachine commented Feb 20, 2026

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

jeramysoucy commented Jan 21, 2026 •

edited by kibanamachine

Loading

jeramysoucy Feb 19, 2026 •

edited

Loading

michaelolo24 Feb 19, 2026 •

edited

Loading