[WorkplaceAI][PerUserAuth] Add hooks for connector code grant OAuth flow by dennis-tismenko · Pull Request #253606 · elastic/kibana

dennis-tismenko · 2026-02-18T01:51:44Z

Summary

Replaces the old useOAuthAuthorize hook with a full set of OAuth lifecycle hooks, a refactored server-side callback route, and a new disconnect route for the connector authorization code grant flow. Changes include:

New useConnectorOAuthConnect hook supports two modes: Redirect and NewTab (opens provider in a new tab, listens for completion via BroadcastChannel).
New useOAuthRedirectResult hook detects OAuth completion from URL query params, broadcasts the result to the opener tab, and auto-closes the tab when applicable.
New useConnectorOAuthDisconnect hook and POST .../connector/{id}/_oauth_disconnect server route to remove stored OAuth tokens.
Refactored OAuth callback route with CSP-compliant callback page (external script via data-* attributes).
Updated edit connector flyout with Authorize/Disconnect actions and success/error toasts.
Shared constants, types, enums, and unit tests.

Demo

Screenshot.2026-02-20.at.17.10.06.mp4

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

… grant OAuth flow

…tion_tests/ci_checks

florent-leborgne

LGTM for docs

…th-action

jcger · 2026-02-19T14:07:41Z

Starting my review. But I already saw a mistake of mine, sorry. We need to move the disconnect/authorize actions to the connectors list and remove them from the flyout. It's important to validate that users with edit privilege can create/update and connect/disconnect to a connector and users with view edit cannot create/update a connector but can connect/disconnect.

maybe with this icons? You'll have to sync with our designer @joana-cps

In order to be able to show connect/disconnect when it should, instead of both at the same time, we need to update the GET Connectors endpoint. While that isn't implemented, please, show both

…r OAuth callback

dennis-tismenko · 2026-02-19T21:36:55Z

Starting my review. But I already saw a mistake of mine, sorry. We need to move the disconnect/authorize actions to the connectors list and remove them from the flyout. It's important to validate that users with edit privilege can create/update and connect/disconnect to a connector and users with view edit cannot create/update a connector but can connect/disconnect.

In order to be able to show connect/disconnect when it should, instead of both at the same time, we need to update the GET Connectors endpoint. While that isn't implemented, please, show both

Moved the UI to the Connectors table in 1a6179c.

I'd like to defer design polish and finalization until after we have the connected status on the connectors page, but I can start a thread if needed.

x-pack/platform/plugins/shared/actions/server/routes/oauth_authorize.ts

jcger · 2026-02-20T09:08:29Z

x-pack/platform/plugins/shared/actions/server/routes/oauth_authorize.ts

+          // HTML page instead of redirecting.
          const requestedReturnUrl = req.body?.returnUrl;
-          let kibanaReturnUrl: string;
+          let kibanaReturnUrl: string | undefined;


I might be missing context, but I don’t see an active caller passing returnUrl today. Is this needed for EARS or a near-term flow? If not, should we keep it as optional future plumbing, or prefer to remove and add back when needed?

I need to double check but I don't remember actually calling with a custom returnUrl for EARS. I think it was more if we have kick off the authorization flow from somewhere else, like the Sources page in WorkplaceAI, we can set our own "returnUrl" to go back to the Active Sources tab for example. But given the refactors to the oauth_callback code I think it might not be needed anymore. Happy to remove it in my PR or a follow-up PR if it is indeed dead code atm.

I'm personally a fan of giving the hook consumers (places in Kibana that want to kickoff the OAuth flow for a connector) the flexibility of specifying a custom returnUrl rather than being completely opinionated as to where we send the user, even if we aren't using it immediately. Also, if any consumer wants to kickoff the flow with OAuthRedirectMode.Redirect then they should absolutely be using it with the redirectUrl param.

But I also understand not wanting to overengineer for scenarios we may not need, so happy to remove it + OAuthRedirectMode.Redirect if you feel that'd be best.

x-pack/platform/plugins/shared/actions/server/routes/oauth_callback.ts

x-pack/platform/plugins/shared/actions/server/routes/oauth_disconnect.ts

jcger · 2026-02-20T09:33:00Z

...ins/shared/triggers_actions_ui/public/application/hooks/oauth/use_connector_oauth_connect.ts

+  isAwaitingCallback: boolean;
+}
+
+const DEFAULT_TIMEOUT_MS = 60 * 1000 * 10; // 10 minutes


IIUC this would keep the "connect" action in loading state up to 10 minutes. I think we should let somehow users know that it can take this long, otherwise it will feel like it's hanging

Yeah, it'd keep it in this state assuming that the user never completes or cancels the OAuth flow from the consent screen (like if the user just closes the opened tab).

I added a cancelConnect function to the hook response so that hook consumers can give users the opportunity to reset isAwaitingCallback. I've also updated the Connectors table to show a cancel button instead of a loading spinner. Again, we can polish the final UX state afterwards but I think this is a better intermediate state to avoid the infinite (/10 minute long) spinner situation 🙂

Implemented in e11b54e

x-pack/platform/plugins/shared/triggers_actions_ui/public/application/hooks/index.ts

jcger · 2026-02-20T09:53:22Z

Nice job! Didn't approve yet because of #253606 (comment), all others can be addressed later

jcger · 2026-02-20T10:15:37Z

Starting my review. But I already saw a mistake of mine, sorry. We need to move the disconnect/authorize actions to the connectors list and remove them from the flyout. It's important to validate that users with edit privilege can create/update and connect/disconnect to a connector and users with view edit cannot create/update a connector but can connect/disconnect.
In order to be able to show connect/disconnect when it should, instead of both at the same time, we need to update the GET Connectors endpoint. While that isn't implemented, please, show both

Moved the UI to the Connectors table in 1a6179c.

I'd like to defer design polish and finalization until after we have the connected status on the connectors page, but I can start a thread if needed.

Perfect, I created a task for it #254142

lorenabalan

Nice tidy up and demo! A couple of questions, but the rest lgtm.

lorenabalan · 2026-02-20T13:18:04Z

x-pack/platform/plugins/shared/actions/server/lib/get_axios_instance.ts

-          }
-        );
+          );
+        } else {


Nice, thank you for this! I found myself having to do sth similar in my own branch.

lorenabalan · 2026-02-20T14:22:01Z

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.ts

      const stateObject = result.saved_objects[0];

+      // Check if createdBy matches
+      if (createdBy && stateObject.attributes.createdBy !== createdBy) {


Why do we need this? It's highly unlikely we'd get the same state value for 2 different objects. If the createdBy was somehow modified in between encryption and decryption, then we fail on L164 and handle it in L174-178.

It's a super valid point, I debated for a while whether it was worth adding it despite the chances of a hash collision being insanely low, but ended up concluding "better safe than sorry". But you're right, probably overengineering, I'll undo this.

Removed in 6ed56e6

I don't see this as a collision prevention, but security, ensuring that the same user that starts the auth process is the same that finish it will avoid that in that 10 minute gap a user logs out, logs in as another and gets the authorization with the wrong user

Yeah true, that's an angle I didn't consider, was only looking at it from a collision standpoint. In the case you describe, it has a super slim exploitation vector, it'd have to be the exact same person changing accounts on the same Kibana instance. So not a vulnerability per-se, but if the user needs to be switching between accounts/profiles on Kibana on a regular basis and accidentally completes the flow on a different account than the one they started, they might be confused.

I'm good either way tbh, I'll defer to your best judgement @jcger — let me know if you want me to bring this change back as a safety fallback. @lorenabalan happy to hear your thoughts as well if you feel strongly about leaving this change out.

Fair point, I don't mind keeping it in it!

Pushing a bit more for my understanding here, wouldn't we want oauth_state SO also stored in the per-user namespace, rather than in the global one? Or does that have any implications on the task manager periodically removing expired states?

we should revisit this, yes. It should be safer to store it by namespace, but it will make clean-up and callback handling a little trickier?

Edit: Adding issue link #254438

lorenabalan · 2026-02-20T14:27:10Z

x-pack/platform/plugins/shared/actions/server/routes/oauth_authorize.ts

+              },
+            });
+          }
+          const { username, profile_uid } = currentUser;


💡 TIL about user profiles.

Me too for this PR! The 💪 behind per-user auth.

x-pack/platform/plugins/shared/actions/server/routes/oauth_callback.ts

lorenabalan · 2026-02-20T14:36:25Z

x-pack/platform/plugins/shared/actions/common/routes/connector/apis/oauth/schemas/v1.ts

Thanks for adding this 🙏

lorenabalan · 2026-02-20T14:37:14Z

x-pack/platform/plugins/shared/actions/common/routes/connector/apis/oauth/types/latest.ts

💡 That's a neat trick, with latest.

x-pack/platform/plugins/shared/actions/server/routes/oauth_disconnect.ts

…rs list

…th-action

elasticmachine · 2026-02-20T20:28:23Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: d7499c4

Failed CI Steps

Test Failures

[job] [logs] Jest Integration Tests #10 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery
[job] [logs] Jest Integration Tests #10 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery

History

jcger · 2026-02-23T12:38:20Z

[job] [logs] Jest Integration Tests #10 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery

can be addressed in the feature branch

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - #246655 - #251873 - #251717 - #252566 - #252104 - #252307 - #252262 - #252501 - #253606 - #254589 - #254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

dennis-tismenko added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Feb 18, 2026

dennis-tismenko force-pushed the connect-disconnect-oauth-action branch 5 times, most recently from 3091f9d to 00aad84 Compare February 18, 2026 08:31

Add connect, disconnect, and handle redirect hooks for connector code…

277972b

… grant OAuth flow

dennis-tismenko force-pushed the connect-disconnect-oauth-action branch from 00aad84 to 277972b Compare February 18, 2026 08:33

dennis-tismenko marked this pull request as ready for review February 18, 2026 08:38

dennis-tismenko requested a review from a team as a code owner February 18, 2026 08:38

Changes from make api-docs

e30add5

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner February 18, 2026 08:54

Changes from node scripts/jest_integration -u src/core/server/integra…

1039ccb

…tion_tests/ci_checks

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner February 18, 2026 09:07

Changes from node scripts/eslint_all_files --no-cache --fix

ce3cb8d

florent-leborgne approved these changes Feb 18, 2026

View reviewed changes

dennis-tismenko changed the title ~~Add connect, disconnect, and handle redirect hooks for connector code grant OAuth flow~~ [WorkplaceAI][PerUserAuth] Add hooks for connector code grant OAuth flow Feb 18, 2026

dennis-tismenko added 3 commits February 18, 2026 09:28

Merge branch 'connectors-auth-code-grant' into connect-disconnect-oau…

648e3a1

…th-action

impl: export hooks for re-use

2fa799e

fix: update limits.yml

7888918

dennis-tismenko requested a review from a team as a code owner February 18, 2026 15:13

dennis-tismenko linked an issue Feb 18, 2026 that may be closed by this pull request

[ResponseOps][PerUserAuth] Connector list UI - connect/disconnect action #250977

Closed

jbudz approved these changes Feb 18, 2026

View reviewed changes

jcger mentioned this pull request Feb 18, 2026

[Connectors v2] OAuth 2.0 Authorization Code Grant #252369

Merged

dennis-tismenko requested a review from jcger February 18, 2026 20:21

dennis-tismenko added 2 commits February 19, 2026 14:08

impl: Use UserConnectorTokenClient instead of ConnectorTokenClient fo…

45b60ea

…r OAuth callback

impl: Move connect/disconnect UI to Connectors table

1a6179c

dennis-tismenko force-pushed the connect-disconnect-oauth-action branch from 9e4cc97 to 1a6179c Compare February 19, 2026 21:24

jcger reviewed Feb 20, 2026

View reviewed changes

jcger mentioned this pull request Feb 20, 2026

[ResponseOps][PerUserAuth] User verification on callback success #251088

Closed

lorenabalan reviewed Feb 20, 2026

View reviewed changes

dennis-tismenko added 3 commits February 20, 2026 13:23

impl: Address PR feedback

6ed56e6

impl: Move hooks to shared package, add disconnect button to connecto…

e11b54e

…rs list

Merge branch 'connectors-auth-code-grant' into connect-disconnect-oau…

0a8e83e

…th-action

dennis-tismenko requested review from jcger and lorenabalan February 20, 2026 19:48

dennis-tismenko added 2 commits February 20, 2026 14:55

ci: Update yarn.lock

3665d0b

fix: inadvertently removed hooks barrel file, cleanup dead exports

d7499c4

jcger mentioned this pull request Feb 23, 2026

[ResponseOps][PerUserAuth] OAuth state per namespace? #254438

Closed

jcger approved these changes Feb 23, 2026

View reviewed changes

dennis-tismenko merged commit b5f4bf4 into elastic:connectors-auth-code-grant Feb 23, 2026
11 of 13 checks passed

Conversation

dennis-tismenko commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Demo

Checklist

Uh oh!

florent-leborgne left a comment

Choose a reason for hiding this comment

Uh oh!

jcger commented Feb 19, 2026

Uh oh!

dennis-tismenko commented Feb 19, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jcger commented Feb 20, 2026

Uh oh!

jcger commented Feb 20, 2026

Uh oh!

lorenabalan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dennis-tismenko Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcger Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dennis-tismenko Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

jcger commented Feb 23, 2026

Uh oh!

Uh oh!

dennis-tismenko commented Feb 18, 2026 •

edited

Loading

dennis-tismenko Feb 20, 2026 •

edited

Loading

jcger Feb 23, 2026 •

edited

Loading

dennis-tismenko Feb 20, 2026 •

edited

Loading

elasticmachine commented Feb 20, 2026 •

edited

Loading