[ResponseOps][Connectors] Use profileUid in actions client by jcger · Pull Request #254589 · elastic/kibana

jcger · 2026-02-23T20:14:20Z

Summary

Adds a getCurrentUserProfileId method to the Actions plugin so OAuth authorization-code connectors can use the user’s profile UID when running in per-user auth mode. Like proposed by the PoC bcb8207#diff-77a930ac5bc56dbf3f1c1165f9cc35b729e38a36a9b3dae00fc47782ec646b19R615

Add { unknowns: 'allow' } to the query schema so OAuth providers can include extra query parameters (e.g. scope, authuser) in the redirect URL without validation failures.

…a into issue-251047-use-profile-uid-task-exe_stack

x-pack/platform/plugins/shared/actions/server/plugin.ts

lorenabalan

Small qs & nits but LGTM otherwise

x-pack/platform/plugins/shared/actions/server/types.ts

x-pack/platform/plugins/shared/actions/server/routes/oauth_callback.ts

x-pack/platform/plugins/shared/actions/server/routes/oauth_callback.test.ts

lorenabalan · 2026-02-24T13:40:12Z

x-pack/platform/plugins/shared/actions/server/lib/get_oauth_authorization_code_access_token.ts

      return null;
    }

-    const token = connectorToken as ConnectorToken;


Why not keep the casting here but add the | UserConnectorToken? Wouldn't it be valid for L182-185 too?

typescript wouldn't complain, but I think it's unnecessary because the properties we use (expiresAt/refreshTokenExpiresAt) exist in both types. It's also dangerous for us, hypothetically, you could have a per-user token here and the type would allow you to cast it as a ConnectorToken, but it would be wrong because per-user tokens have no top level token/refreshToken

x-pack/platform/plugins/shared/actions/server/lib/get_oauth_authorization_code_access_token.ts

lorenabalan · 2026-02-24T13:51:30Z

x-pack/platform/plugins/shared/actions/server/lib/get_oauth_authorization_code_access_token.ts

+  accessToken: string | null;
+  refreshToken: string | undefined;


Why do we have this distinction null vs undefined, rather than both undefined? 🤔

you can see null as "unexpected shape" error, whereas undefined means it's ok but just not set

...platform/plugins/shared/actions/server/lib/get_oauth_authorization_code_access_token.test.ts

js-jankisalvi

Tested locally with google drive workflow, works as expected 🎉

…com:jcger/kibana into issue-251047-use-profile-uid-task-exe_stack

…a into issue-251047-use-profile-uid-task-exe_stack

elasticmachine · 2026-02-25T11:11:07Z

💔 Build Failed

Buildkite Build
Commit: 17ee43d

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #8 / discover responsive sidebar should not render buttons in data view picker when in viewer mode
[job] [logs] Jest Integration Tests #9 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery
[job] [logs] Jest Integration Tests #9 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery
[job] [logs] Jest Tests #1 / Stack Connectors Plugin setup() should register built in connector types
[job] [logs] Jest Tests #1 / Stack Connectors Plugin setup() should register built in connector types
[job] [logs] FTR Configs #29 / task_manager check_registered_task_types should check changes on all registered task types
[job] [logs] FTR Configs #29 / task_manager check_registered_task_types should check changes on all registered task types
[job] [logs] Jest Integration Tests #8 / workflow with retry retry is on workflow level does not perform retries when condition is ${{error.type == "SomeOtherError"}} should have correct workflow duration

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [e7e0dd0]

History

jcger · 2026-02-25T11:59:26Z

Merging because CI errors seem to come from the feature branch, not this one

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - #246655 - #251873 - #251717 - #252566 - #252104 - #252307 - #252262 - #252501 - #253606 - #254589 - #254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

add getCurrentUserProfileId actionExecutor method

54c22ab

jcger mentioned this pull request Feb 23, 2026

[Connectors v2] OAuth 2.0 Authorization Code Grant #252369

Merged

jcger marked this pull request as ready for review February 23, 2026 20:17

jcger requested a review from a team as a code owner February 23, 2026 20:17

jcger added 4 commits February 23, 2026 21:55

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

d8560ad

…a into issue-251047-use-profile-uid-task-exe_stack

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

d1c44cf

…a into issue-251047-use-profile-uid-task-exe_stack

add tests

65d5e8f

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

b40e318

…a into issue-251047-use-profile-uid-task-exe_stack

cnasikas approved these changes Feb 24, 2026

View reviewed changes

x-pack/platform/plugins/shared/actions/server/plugin.ts Outdated Show resolved Hide resolved

lorenabalan approved these changes Feb 24, 2026

View reviewed changes

js-jankisalvi approved these changes Feb 24, 2026

View reviewed changes

jcger and others added 5 commits February 24, 2026 18:26

rename from getCurrentUserProfileId to getCurrentUserProfileIdFromAPIKey

09e3b00

AuthMode type

5c8f686

Changes from node scripts/eslint_all_files --no-cache --fix

b3a4429

fix lint + test

43f2bbf

Merge branch 'issue-251047-use-profile-uid-task-exe_stack' of github.…

38ab147

…com:jcger/kibana into issue-251047-use-profile-uid-task-exe_stack

jcger force-pushed the connectors-auth-code-grant branch from 47b9df6 to 1907ce9 Compare February 24, 2026 22:08

jcger requested review from a team as code owners February 24, 2026 22:08

jcger force-pushed the issue-251047-use-profile-uid-task-exe_stack branch from 1d06d8e to 14a0a7e Compare February 24, 2026 22:12

jcger removed request for a team February 24, 2026 22:12

jcger force-pushed the issue-251047-use-profile-uid-task-exe_stack branch from ad54e5c to c7ac44d Compare February 25, 2026 09:39

jcger force-pushed the connectors-auth-code-grant branch from 20719b9 to e7e0dd0 Compare February 25, 2026 09:40

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

7bfc7a7

…a into issue-251047-use-profile-uid-task-exe_stack

jcger force-pushed the issue-251047-use-profile-uid-task-exe_stack branch from c7ac44d to 7bfc7a7 Compare February 25, 2026 09:42

Changes from make api-docs

17ee43d

jcger merged commit 82a2597 into elastic:connectors-auth-code-grant Feb 25, 2026
12 of 13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ResponseOps][Connectors] Use profileUid in actions client#254589

[ResponseOps][Connectors] Use profileUid in actions client#254589
jcger merged 12 commits intoelastic:connectors-auth-code-grantfrom
jcger:issue-251047-use-profile-uid-task-exe_stack

jcger commented Feb 23, 2026

Uh oh!

Uh oh!

lorenabalan left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lorenabalan Feb 24, 2026

Uh oh!

jcger Feb 24, 2026

Uh oh!

Uh oh!

lorenabalan Feb 24, 2026

Uh oh!

jcger Feb 24, 2026

Uh oh!

Uh oh!

js-jankisalvi left a comment

Uh oh!

elasticmachine commented Feb 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

jcger commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

		accessToken: string \| null;
		refreshToken: string \| undefined;

Conversation

jcger commented Feb 23, 2026

Summary

Uh oh!

Uh oh!

lorenabalan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lorenabalan Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

jcger Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lorenabalan Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

jcger Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

js-jankisalvi left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

Uh oh!

jcger commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

elasticmachine commented Feb 25, 2026 •

edited

Loading