[WorkplaceAI][PerUserAuth] Implement Encrypted Saved Objects recommendations by lorenabalan · Pull Request #252104 · elastic/kibana

lorenabalan · 2026-02-06T14:59:25Z

Summary

Addressing #246655 (review) & #251873 (comment)

Changes:

Reduced the AAD footprint of the oauth_state SO (this SO was first introduced in the feature branch, so we don't need to issue a migration for it, we can just iterate directly)
Used createModelVersion wrapper (as per docs) for connector_token SO. In the feature branch we had enhanced the object by adding refreshTokenExpiresAt as a new AAD and refreshToken as a new encrypted field. expiresAt was also turned into an optional field.

Testing

Tests run by default with the oauth_authorization_code feature flag disabled. In order to check the tests with it enabled you need to modify x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts :

bump ESO_TYPES_COUNT to 21 (the extra models registered are oauth_state and user_connector_token)

then update beforeAll() to contain

    root = createRootWithCorePlugins(
      { xpack: { actions: { auth: { oauth_authorization_code: { enabled: true } } } } },
      { oss: false }
    );

Run both

node scripts/jest_integration x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts -u

and

node scripts/jest_integration src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts -u

You should see updates to toMatchInlineSnapshot in the tests like

-"connector_token": "16ca2154c13c5ee3d3a45b55d4ea6cd33aeaceaef3dc229b002d25470bfc9b3b",
+ "connector_token": "e446f5ff0fbf516f63398e474f126332b4c31e316daa613c6cb8c863400110c5",
...
+ "oauth_state": "b01289e5c133db9d4d802a2b838e43cce4a8399566dedb21de551da57c88894a",
...
+ "user_connector_token": "b443b022b46b79c0ff9fa674aecc64176a5fcbd09c2db2d9f050a6a88435732e",

⚠️⚠️⚠️ When we enable the feature by default, we'll probably also have to update this test file (uncomment)

Misc

Old question
What's not entirely clear to me is release strategy for the connectors-auth-code-grant feature branch, given https://docs.elastic.dev/kibana-dev-docs/key-concepts/encrypted-saved-objects-intro#serverless-considerations

This will require 2 Serverless release stages.
Release 1: Add the attribute to the ESO's attributesToIncludeInAAD. Do not yet populate or use the new attribute. Release 2: Implement a Model Version and wrap it in a call to createModelVersion, providing the former EncryptedSavedObjectTypeRegistration as the input type, and the new EncryptedSavedObjectTypeRegistration as the output type. Implement a Model Version backfill change as needed. The attribute can safely be populated in this release.

Do we need to first merge a small PR to main that adds the refreshTokenExpiresAt field to the connector_token SO, then wait a day and merge the rest of the feature branch?

Answer: #252735 (review)

lorenabalan · 2026-02-10T13:54:48Z

x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts

    // redirectUri: {
    //   type: 'keyword',
    // },
-    // authorizationUrl: {


This field doesn't actually look like it exists anymore looking at the schema, must've been a leftover from a refactoring.

x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts

...plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts

…tion_tests/ci_checks

...plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts

## Summary Closes elastic/kibana-team#2867 The `Check Saved Objects` CI check performs automated upgrade and rollback testing for any updated SO types. None of the Encrypted Saved Objects had been updated since the check was put in place, up until recently. To add support for ESOs, the `KibanaMigratorTestKit` must accept an _encryptedSavedObjects_ service, so that the underlying SOR can be built with the encryption extension. This PR adds a workaround to support encryption / decryption in the `KibanaMigratorTestKit`, unblocking #252104. Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: “jeramysoucy” <jeramy.soucy@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…tion_tests/ci_checks

elasticmachine · 2026-02-26T11:28:07Z

💔 Build Failed

Buildkite Build
Commit: dd2171f

Failed CI Steps

Test Failures

[job] [logs] x-pack/platform/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts / alerting api integration security and spaces enabled - Group 2 Connectors Jira Jira - Action Creation should return 200 when creating a jira action successfully
[job] [logs] x-pack/platform/test/alerting_api_integration/security_and_spaces/group2/config.ts / alerting api integration security and spaces enabled - Group 2 Connectors Jira Jira - Action Creation should return 200 when creating a jira action successfully
[job] [logs] x-pack/platform/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts / alerting api integration security and spaces enabled - Group 2 Connectors Jira Jira - Action Creation should return 200 when creating a jira action successfully

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [bc79bda]

History

…53470) ## Summary Closes elastic/kibana-team#2867 The `Check Saved Objects` CI check performs automated upgrade and rollback testing for any updated SO types. None of the Encrypted Saved Objects had been updated since the check was put in place, up until recently. To add support for ESOs, the `KibanaMigratorTestKit` must accept an _encryptedSavedObjects_ service, so that the underlying SOR can be built with the encryption extension. This PR adds a workaround to support encryption / decryption in the `KibanaMigratorTestKit`, unblocking elastic#252104. Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: “jeramysoucy” <jeramy.soucy@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - #246655 - #251873 - #251717 - #252566 - #252104 - #252307 - #252262 - #252501 - #253606 - #254589 - #254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

lorenabalan added 2 commits February 6, 2026 15:18

Wrap in createModelVersion for ESO

08ef5a0

Reduce AAD fields

bb88fc9

This was referenced Feb 6, 2026

[WorkplaceAI][PerUserAuth] Support connectors created in non default space #251873

Merged

[Connectors v2] OAuth 2.0 Authorization Code Grant #252369

Merged

lorenabalan added 2 commits February 10, 2026 12:51

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

2c7519d

Finalize AAD fields

cfac73e

lorenabalan marked this pull request as ready for review February 10, 2026 13:52

lorenabalan requested review from a team as code owners February 10, 2026 13:52

lorenabalan requested a review from jeramysoucy February 10, 2026 13:52

lorenabalan commented Feb 10, 2026

View reviewed changes

Remove redirectUri from AAD

4f90ecb

lorenabalan force-pushed the lb/fix-eso branch from 649828b to 4f90ecb Compare February 10, 2026 15:44

lorenabalan commented Feb 10, 2026

View reviewed changes

x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts Outdated Show resolved Hide resolved

jeramysoucy reviewed Feb 11, 2026

View reviewed changes

...plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts Show resolved Hide resolved

lorenabalan mentioned this pull request Feb 11, 2026

[WorkplaceAI][PerUserAuth] Add new attribute to AAD of connector_token SO #252735

Closed

10 tasks

lorenabalan and others added 3 commits February 13, 2026 10:37

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

66acb29

Fix tests

2bd0ccf

Changes from node scripts/jest_integration -u src/core/server/integra…

57c1028

…tion_tests/ci_checks

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner February 13, 2026 11:01

lorenabalan requested a review from jeramysoucy February 13, 2026 11:28

jcger reviewed Feb 18, 2026

View reviewed changes

...plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts Show resolved Hide resolved

jcger approved these changes Feb 20, 2026

View reviewed changes

gsoldevila mentioned this pull request Feb 20, 2026

Add support for ESOs in the "Check Saved Objects" CI check #253470

Merged

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

980dca9

jcger force-pushed the connectors-auth-code-grant branch from 20719b9 to e7e0dd0 Compare February 25, 2026 09:40

lorenabalan and others added 3 commits February 25, 2026 14:47

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

53387ea

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

adbc880

Changes from make api-docs

db62932

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner February 25, 2026 14:34

kibanamachine and others added 8 commits February 25, 2026 14:54

Changes from node scripts/jest_integration -u src/core/server/integra…

cbff161

…tion_tests/ci_checks

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

7f70f2b

Update snapshottt

0205bd9

Merge branch 'connectors-auth-code-grant' into lb/fix-eso

99625e1

Fix post-merge

9474dc4

Update snapshot

c29f9f1

Fix test

3bdb05e

Fix unintentional change from merge

dd2171f

lorenabalan merged commit e3bb9cd into connectors-auth-code-grant Feb 26, 2026
11 of 13 checks passed

lorenabalan deleted the lb/fix-eso branch February 26, 2026 11:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WorkplaceAI][PerUserAuth] Implement Encrypted Saved Objects recommendations#252104

[WorkplaceAI][PerUserAuth] Implement Encrypted Saved Objects recommendations#252104
lorenabalan merged 20 commits intoconnectors-auth-code-grantfrom
lb/fix-eso

lorenabalan commented Feb 6, 2026 •

edited

Loading

Uh oh!

lorenabalan Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

lorenabalan commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Misc

Uh oh!

lorenabalan Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lorenabalan commented Feb 6, 2026 •

edited

Loading

elasticmachine commented Feb 26, 2026 •

edited

Loading