feat(security,serverless): enable UIAM mode by default by azasypkin · Pull Request #260546 · elastic/kibana

azasypkin · 2026-03-31T17:17:15Z

Summary

Now that UIAM powers all our environments by default, it's time to enable UIAM mode by default for local dev and CI setups (all Serverless tets).

For a couple of months, I'm still keeping the --no-uiam flags for both Kibana and Elasticsearch as an escape hatch for developers in case things go awry. While the risk of such an event is low, local/CI UIAM involves two additional containers, so it's better to be safe.

azasypkin · 2026-04-01T01:56:46Z

src/platform/packages/shared/kbn-es/src/utils/docker_uiam.ts

      '--env',
      `quarkus.log.category."co.elastic.cloud.uiam".level=${env.UIAM_APP_LOGGING_LEVEL}`,
      '--env',
+      `quarkus.log.category."co.elastic.cloud.uiam.app.authentication.ClientCertificateExtractor".level=${env.UIAM_LOGGING_LEVEL}`,


note: it's a way too noisy.

azasypkin · 2026-04-01T19:13:29Z

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

  const customRolesFileName = process.env.ROLES_FILENAME_OVERRIDE;
  const cloudUsersFilePath = resolve(REPO_ROOT, '.ftr', customRolesFileName ?? 'role_users.json');

+  const kbnServerOptions = getopts(config.get('kbnTestServer.serverArgs'), {


note: Replicates what we do for Scout.

azasypkin · 2026-04-01T19:14:45Z

x-pack/platform/test/serverless/api_integration/configs/security/config.group1.ts

@@ -47,7 +47,7 @@ export default createTestConfig({
    // useful for testing (also enabled in MKI QA)
    '--coreApp.allowDynamicConfigOverrides=true',
    `--xpack.securitySolutionServerless.cloudSecurityUsageReportingTaskInterval=5s`,
-    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8081`,
+    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8089`,


note: 8081 conflicts with UIAM containers that occupy 8081, 8082, and 8443.

azasypkin · 2026-04-01T19:15:20Z

x-pack/platform/test/serverless/api_integration/test_suites/data_usage/mock_api.ts

@@ -17,7 +18,7 @@ export const setupMockServer = () => {
 };

 const autoOpsHandler = http.post(
-  '/monitoring/serverless/v1/projects/fakeprojectid/metrics',
+  `/monitoring/serverless/v1/projects/${MOCK_IDP_UIAM_PROJECT_ID}/metrics`,


note: we use project ID that follows the proper project ID format.

azasypkin · 2026-04-01T19:15:52Z

x-pack/solutions/security/test/serverless/api_integration/configs/config.graph.ts

@@ -19,7 +19,7 @@ export default createTestConfig({
    `--xpack.task_manager.unsafe.exclude_task_types=${JSON.stringify(['Fleet-Metrics-Task'])}`,
    '--coreApp.allowDynamicConfigOverrides=true',
    `--xpack.securitySolutionServerless.cloudSecurityUsageReportingTaskInterval=5s`,
-    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8081`,
+    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8089`,


note: 8081 conflicts with UIAM containers that occupy 8081, 8082, and 8443.

azasypkin · 2026-04-01T19:16:00Z

x-pack/solutions/security/test/serverless/api_integration/configs/config.ts

@@ -25,7 +25,7 @@ export default createTestConfig({
    // useful for testing (also enabled in MKI QA)
    '--coreApp.allowDynamicConfigOverrides=true',
    `--xpack.securitySolutionServerless.cloudSecurityUsageReportingTaskInterval=5s`,
-    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8081`,
+    `--xpack.securitySolutionServerless.usageApi.url=http://localhost:8089`,


note: 8081 conflicts with UIAM containers that occupy 8081, 8082, and 8443.

azasypkin · 2026-04-01T19:16:07Z

...ntegration/test_suites/cloud_security_posture/serverless_metering/cloud_security_metering.ts

@@ -51,7 +51,7 @@ export default function (providerContext: FtrProviderContext) {
    let roleAuthc: RoleCredentials;
    let internalRequestHeader: { 'x-elastic-internal-origin': string; 'kbn-xsrf': string };
    before(async () => {
-      mockUsageApiServer = mockUsageApiApp.listen(8081); // Start the usage api mock server on port 8081
+      mockUsageApiServer = mockUsageApiApp.listen(8089); // Start the usage api mock server on port 8089


note: 8081 conflicts with UIAM containers that occupy 8081, 8082, and 8443.

szwarckonrad

DW changes LGTM!

azasypkin · 2026-04-01T21:26:24Z

x-pack/platform/plugins/shared/alerting/test/scout/api/parallel_tests/rules.spec.ts

You can now switch from { tag: tags.serverless.observability.complete } to { tag: tags.serverless.all } if you want to.

dmlemeshko · 2026-04-02T07:46:31Z

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

+      ? {
+          uiam: kbnServerOptions['xpack.security.uiam.enabled'] ?? false,
+          projectType: kbnServerOptions.serverless as ServerlessProjectType,
+          organizationId: kbnServerOptions['xpack.cloud.organization_id']!,


question: how important to have OrgId defined in tests and should we consider default value?

It is required by the UIAM session token, so it must be defined in ECS and is optional for non-Cloud users in ECH.

should we consider default value?

I'm setting it in the base config for both Serverless Scout and API integration tests, or do you think it should be defined elsewhere?

All good, thank you 👍

dmlemeshko · 2026-04-02T07:50:36Z

...hared/kbn-scout/src/servers/configs/config_sets/default/serverless/serverless.base.config.ts

+          ? 'ci:ZXMwMTo5MjIwJDo5MjIwJGtpYmFuYTo5MjIw'
+          : 'local-dev:ZG9ja2VyLmludGVybmFsOjkyMjAkaG9zdDo5MjIwJGtpYmFuYTo5MjIw'


question: I'm not sure what package suits best, but could we move it to a single place and imports as const in kbn/scout and default FTR configs?

I recently decoupled few packages from kbn/test and we don't want Scout to depend on kbn/test, so if there is no good spot I'm ok with duplication.

I'm not sure what package suits best, but could we move it to a single place and imports as const in kbn/scout and default FTR configs?

Yeah, it's a good idea, maybe I'll just move it to src/platform/packages/private/kbn-mock-idp-utils/src/constants.ts where we have the rest of the similar consts.

dmlemeshko

Scout/FTR config changes LGTM

ersin-erdal

ResponseOps changes LGTM

mattkime

code owner changes lgtm

elasticmachine · 2026-04-07T10:17:59Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: bc28cb9
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-260546-bc28cb9c8537

Failed CI Steps

affected Scout: [ platform / navigation ] plugin

Test Failures

[job] [logs] affected Scout: [ platform / navigation ] plugin / local-serverless-security_complete - navigation - has security serverless side nav
[job] [logs] affected Scout: [ platform / navigation ] plugin / local-serverless-security_complete - navigation - opens panel on legacy management landing page

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/mock-idp-utils`	61	62	+1

Unknown metric groups

API count

id	before	after	diff
`@kbn/mock-idp-utils`	69	70	+1

History

💛 Build #421180 was flaky 3dba652
💚 Build #420790 succeeded 2f2bde2
💔 Build #420662 failed 4b76ad5
💔 Build #420559 failed ae068f9
💔 Build #420196 failed b754e12

kc13greiner

LGTM 🚀

## Summary Now that UIAM powers all our environments by default, it's time to enable UIAM mode by default for local dev and CI setups (all Serverless tets). For a couple of months, I'm still keeping the `--no-uiam` flags for both Kibana and Elasticsearch as an escape hatch for developers in case things go awry. While the risk of such an event is low, local/CI UIAM involves two additional containers, so it's better to be safe.

…)" This reverts commit 17ac072.

…entication (#261873) ## Summary Switch Security Cypress tests to use UIAM authentication. __Related:__ #260546

azasypkin mentioned this pull request Mar 31, 2026

Fix observability UIAM config and add CPS observability variant #260485

Merged

2 tasks

azasypkin force-pushed the issue-xxx-enable-uiam-by-default branch 5 times, most recently from 6248c55 to 2ae720e Compare April 1, 2026 01:55

azasypkin commented Apr 1, 2026

View reviewed changes

azasypkin force-pushed the issue-xxx-enable-uiam-by-default branch 4 times, most recently from ae068f9 to 4b76ad5 Compare April 1, 2026 15:00

feat(security,serverless): enable UIAM mode by default

2f2bde2

azasypkin force-pushed the issue-xxx-enable-uiam-by-default branch from 4b76ad5 to 2f2bde2 Compare April 1, 2026 17:48

azasypkin commented Apr 1, 2026

View reviewed changes

azasypkin marked this pull request as ready for review April 1, 2026 19:16

azasypkin requested review from a team as code owners April 1, 2026 19:16

azasypkin requested review from ashokaditya, kc13greiner and szwarckonrad April 1, 2026 19:16

szwarckonrad approved these changes Apr 1, 2026

View reviewed changes

azasypkin added ci:build-serverless-image release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Apr 1, 2026

azasypkin commented Apr 1, 2026

View reviewed changes

Ikuni17 approved these changes Apr 2, 2026

View reviewed changes

dmlemeshko reviewed Apr 2, 2026

View reviewed changes

dmlemeshko approved these changes Apr 2, 2026

View reviewed changes

Merge branch 'main' into issue-xxx-enable-uiam-by-default

3dba652

mgiota approved these changes Apr 2, 2026

View reviewed changes

ersin-erdal approved these changes Apr 2, 2026

View reviewed changes

azasypkin removed the request for review from ashokaditya April 2, 2026 11:27

mattkime approved these changes Apr 2, 2026

View reviewed changes

seanrathier approved these changes Apr 2, 2026

View reviewed changes

neptunian approved these changes Apr 3, 2026

View reviewed changes

Merge branch 'main' into issue-xxx-enable-uiam-by-default

bc28cb9

kc13greiner approved these changes Apr 7, 2026

View reviewed changes

azasypkin merged commit 17ac072 into elastic:main Apr 7, 2026
18 checks passed

azasypkin deleted the issue-xxx-enable-uiam-by-default branch April 7, 2026 12:27

kibanamachine added the v9.4.0 label Apr 7, 2026

tylersmalley added a commit that referenced this pull request Apr 7, 2026

Revert "feat(security,serverless): enable UIAM mode by default (#260546…

a886b0b

…)" This reverts commit 17ac072.

tylersmalley mentioned this pull request Apr 7, 2026

Revert "feat(security,serverless): enable UIAM mode by default" #261852

Closed

azasypkin mentioned this pull request Apr 8, 2026

fix(serverless,tests): switch Security Cypress tests to use UIAM authentication #261873

Merged

azasypkin added a commit that referenced this pull request Apr 9, 2026

fix(serverless,tests): switch Security Cypress tests to use UIAM auth…

58459c2

…entication (#261873) ## Summary Switch Security Cypress tests to use UIAM authentication. __Related:__ #260546

		? 'ci:ZXMwMTo5MjIwJDo5MjIwJGtpYmFuYTo5MjIw'
		: 'local-dev:ZG9ja2VyLmludGVybmFsOjkyMjAkaG9zdDo5MjIwJGtpYmFuYTo5MjIw'

Conversation

azasypkin commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

szwarckonrad left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmlemeshko left a comment

Choose a reason for hiding this comment

Uh oh!

ersin-erdal left a comment

Choose a reason for hiding this comment

Uh oh!

mattkime left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

API count

History

Uh oh!

kc13greiner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

azasypkin commented Mar 31, 2026 •

edited

Loading

elasticmachine commented Apr 7, 2026 •

edited

Loading