[Connectors v2] OAuth 2.0 Authorization Code Grant by jcger · Pull Request #252369 · elastic/kibana

jcger · 2026-02-09T15:48:00Z

Description

Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method.

2-step release

As there are changes that require a 2-step release, this PR won't add oauth_authorization_code auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are:

we are adding refreshTokenExpiresAt to AAD for connector_token SO
we are adding refreshToken as an encrypted attribute for connector_token SO

Config to run this locally

uiSettings:
  overrides:
    'workflows:ui:enabled': true
server.publicBaseUrl: 'http://localhost:5601'

Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info.

Involved PRs:

@seanstory

## Summary Closes elastic/search-team#12248 ~WIP. Don't review yet.~ This branch implements ~a _rough_, proof-of-concept,~ Authorization Code Grant Flow for the (yet unmerged) Sharepoint Online v2 connector, as well as for the merged (modified here) Notion v2 connector. The goal is to use this as a concrete example to frame discussion around, and it iterate off of. ![code-grant-flow](https://github.com/user-attachments/assets/a9c06f4f-287b-42ef-b7da-653c89ac6375) **Initial implementation:** @seanstory: This has been entirely generated by code assistants, so thorough review will eventually be needed, _especially_ because this is an implementation of a hairy security protocol. Also, this implementation is missing a LOT of necessary bits. Some of which are: 1. cleanup of stale state with taskmanager task ✅ 2. get refresh tokens working ✅ 3. unit tests 🟡 4. check on rate limiting of these endpoints? Potential resource exhaustion ✅ 5. prompt for `tenant-id`, instead of auth URL and token URL? 6. redirect to actual page, not HTML template ✅ 1. PM feedback first 7. telemetry 8. documentation 🟡 **Additional changes:** @lorenabalan: #246655 (comment) ### What's in the box? 1. New Auth Type (oauth_authorization_code.ts) - Zod schema defining OAuth configuration (authorizationUrl, tokenUrl, clientId, clientSecret, scope) - configure() method that retrieves and refreshes tokens via ctx.getToken() - Integration with existing connector auth framework 2. OAuth State Management (oauth_state_client.ts) - PKCE state/verifier generation using crypto.randomBytes - State storage in new oauth_state saved object type - 10-minute expiration with cleanup capability - Encrypted storage of code_verifier 3. Token Management (extended connector_token_client.ts) - New methods: createWithRefreshToken(), updateWithRefreshToken(), getRefreshToken() - Encrypted storage of access_token and refresh_token - Tracks expiration for both tokens 4. HTTP Routes - POST /api/actions/connector/{id}/_oauth_authorize - Initiates OAuth flow, returns authorization URL - GET /api/actions/connector/_oauth_callback - Handles OAuth callback, exchanges code for tokens 5. Token Retrieval (get_oauth_authorization_code_access_token.ts) - Fetches stored access token - Auto-refreshes expired tokens using refresh token - Returns null if authorization needed 6. OAuth Token Requests - request_oauth_authorization_code_token.ts - Exchanges authorization code for tokens - request_oauth_refresh_token.ts - Refreshes access token 7. Integration Points - Updated ActionsClient.getOAuthAccessToken() to support "authorization_code" type - Modified getAxiosInstanceWithAuth() to call getOAuthAuthorizationCodeAccessToken() - Added 401 interceptor with user-friendly error messages 8. UI Components - useOAuthAuthorize hook - Calls authorize endpoint and opens popup - Updated connector flyout footer with "Authorize" button for OAuth connectors - checkOAuthAuthCode() helper to detect OAuth auth type 9. SharePoint Online Connector - Changed from undefined auth to oauth_authorization_code - Defaults for Microsoft OAuth endpoints (with {tenant-id} placeholder) - Scope: https://graph.microsoft.com/.default offline_access ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co>

## Summary Closes #252277 This PR will be merged into a feature branch

…s-auth-code-grant

… space (#251873) ## Summary **TL;DR** Closes elastic/search-team#12683 * Added `spaceId` to the state object we store while user completes authorization. * While here, also fixing some SO tests broken by #246655 Tested by creating a new space, adding a new connector there, then authorizing it and using it in a workflow. All worked well end-to-end. 👌 <img width="681" height="960" alt="Screenshot 2026-02-05 at 17 10 18" src="https://github.com/user-attachments/assets/a3b83e1f-2d59-4eb1-880b-e21d4044716d" /> <img width="2554" height="907" alt="Screenshot 2026-02-05 at 17 10 08" src="https://github.com/user-attachments/assets/31909dcb-62a4-499f-924d-3df05ecab4de" /> #### Alternatives considered 1️⃣ Initially tried doing sth like ```typescript const spaceId = spaces ? spaces.spacesService.getSpaceId(req) : 'default'; const namespace = spaces.spacesService.spaceIdToNamespace(spaceId) ``` in both callback and authorize enpoints... but realised the first line was always returning `default` in callback, due to the redirect_uri not having the space prefix. 2️⃣ Went for storing `spaceId` in the state rather than encoding the namespace in the `redirect_uri` because that would mean the OAuth apps config would have to allow all possible redirect_uris, for each namespace, which isn't ideal UX. 3️⃣ Went for storing `spaceId` rather than `namespace` directly mainly for readability. Given `namespace: undefined` is an actual valid value, would've had to bypass the `omitBy` for this one field, which I think would've been confusing when reading the code. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…nt params (#251717) ## Summary Fixes elastic/search-team#12682 While here, also fixing some SO tests broken by #246655 The Scout and AB tests should be fixed by merging latest `main` into feature branch. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

… apis (#252262) ## Summary Resolves #250976 This PR introduces a new authMode attribute for connectors that allows configuring authentication modes as either shared (default) or per-user. This enables support for different authentication patterns where connectors can use: - **shared**: Single set of credentials shared across all users - **per-user**: Individual user credentials for personalized authentication **Note**: The `per-user` mode is primarily intended for OAuth-based connectors where each user will authenticate with their own account. Implementing the actual per-user credential storage and OAuth flows is not part of this PR. At this stage, both modes use the same single-credential storage. The `per-user` flag is a declaration of intent for future OAuth capabilities. ### Key Changes - Saved object schema: Introduced v2 schema with `authMode` field support - Data migration: Model version 2 automatically backfills `authMode: 'shared'` for existing connectors that have `config.authType `set ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Release note: Create a connector with auth_mode attribute --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Julian Gernun <17549662+jcger@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>

…#252762) ## Summary Closes elastic/search-team#12900 --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…252566) ## Summary Closes elastic/search-team#12681

…le (#252929) ## Summary Resolves elastic/kibana-team#2803 <img width="3456" height="1372" alt="image (20)" src="https://github.com/user-attachments/assets/82bd25f9-5020-48d9-8115-381488d0f5d9" /> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Release note:

This PR is part of a series of PRs, it will be merged into a feature branch ## Summary Closes #250979 ### User connector token SO Added a new saved object type user_connector_token so connector tokens (e.g. OAuth) can be stored per user (by profileUid) instead of only globally. Includes mappings, model versions, and encrypted SO registration. ### Token client split Replaced the single implementation with two clients and a facade: * SharedConnectorTokenClient – existing behavior; uses connector_token SO (shared tokens). * UserConnectorTokenClient – new; uses user_connector_token SO, keyed by profileUid + connectorId (and optional credentialType / tokenType). * ConnectorTokenClient – thin facade: if profileUid is set it delegates to the user client, otherwise to the shared client. Adds debug logging for which client is used. ### API Existing ConnectorTokenClient methods now accept an optional profileUid. When present, operations are personal (user SO); when absent, they stay shared. Token IDs use prefixes personal: / shared: so the facade can route updates/deletes correctly. ### Call sites OAuth callback (and other callers that have a user context) can pass profileUid so tokens are stored per user. No change for callers that don’t pass profileUid. ### Tests Added unit tests for SharedConnectorTokenClient and UserConnectorTokenClient; updated ConnectorTokenClient tests for the facade and delegation. Removed the old assertion on deleteConnectorTokens return value because the implementation now returns Promise<void> (refactor in this PR). ### Misc Explicit Promise<void> return types and small cleanups (e.g. token id validation) in the shared/user clients. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>

# Slack Data Source (MVP) ### What's introduced in this PR - A Slack v2 connector with three actions: - `searchMessages` - `sendMessage` - `resolveChannelId` (retained as a power-user action, no mapping to a Workflow) - Accepts an authorization token as a Bearer token (no OAuth flow yet) - The Slack Data Source definition with three workflow YAML files: - `search_messages.yml` - `send_messages.yml` ## A word about authorization This PR was originally meant to merge into the `connectors-auth-code-grant` [feature branch](#252369). However, in the spirit of keeping things moving and keeping PR sizes manageable, this Data Source is now targeting `main` and bypassing any OAuth flow for the time being. Getting an authorization token will thus require you to go through an OAuth playground to acquire it before copy/pasting it as a `Bearer` token during Slack v2 connector setup. **This is a temporary measure**. Once the auth code grant feature branch is merged + EARS Slack service is available, a follow-up PR will be made to wire up the correct OAuth flow, and the Bearer token authentication method will be removed. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ## Release notes A Slack Data Source for Workplace AI --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Julian Gernun <17549662+jcger@users.noreply.github.com> Co-authored-by: Arianna Laudazzi <arianna.laudazzi@elastic.co>

…low (#253606) ## Summary Replaces the old `useOAuthAuthorize` hook with a full set of OAuth lifecycle hooks, a refactored server-side callback route, and a new disconnect route for the connector authorization code grant flow. Changes include: - New `useConnectorOAuthConnect` hook supports two modes: `Redirect` and `NewTab` (opens provider in a new tab, listens for completion via `BroadcastChannel`). - New `useOAuthRedirectResult` hook detects OAuth completion from URL query params, broadcasts the result to the opener tab, and auto-closes the tab when applicable. - New `useConnectorOAuthDisconnect` hook and `POST .../connector/{id}/_oauth_disconnect` server route to remove stored OAuth tokens. - Refactored OAuth callback route with CSP-compliant callback page (external script via `data-*` attributes). - Updated edit connector flyout with Authorize/Disconnect actions and success/error toasts. - Shared constants, types, enums, and unit tests. ## Demo https://github.com/user-attachments/assets/32a7c619-7d48-49b8-92d2-634baed097ad ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…ode-grant

## Summary * Add missing unit test file * Fixed issue where expired oauth_state weren't being cleaned up

…a into connectors-auth-code-grant

x-pack/platform/plugins/shared/actions/server/config.ts

…ode-grant

jcger · 2026-03-13T15:52:29Z

This LGTM for docs - I just think we may be missing the availability information for the non-serverless version of the addition, if relevant (like Added in 9.4) (see https://www.elastic.co/docs/contribute-docs/api-docs/kibana-api-docs-quickstart#make-your-docs-changes)

Thank you @florent-leborgne, I've created a follow up item #257715

…ode-grant

## Summary State client was generating a PKCE code longer than recommended 128 characters. This should fix it.

…ode-grant

…a into connectors-auth-code-grant

tomsonpl

Defend workflows LGTM 👍

…ode-grant

elasticmachine · 2026-03-18T15:49:24Z

💚 Build Succeeded

Buildkite Build
Commit: 48d9381

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`actions`	15	16	+1
`stackConnectors`	768	769	+1
`triggersActionsUi`	1319	1326	+7
`workflowsManagement`	1293	1294	+1
total			+10

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/alerts-ui-shared`	318	319	+1
`@kbn/connector-specs`	147	149	+2
`@kbn/response-ops-oauth-hooks`	-	24	+24
`actions`	364	375	+11
total			+38

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`apm`	2.7MB	2.7MB	+42.0B
`datasetQuality`	568.0KB	568.1KB	+42.0B
`discover`	1.6MB	1.6MB	+42.0B
`infra`	1.3MB	1.3MB	+42.0B
`ml`	5.8MB	5.8MB	+42.0B
`monitoring`	634.7KB	634.8KB	+42.0B
`observability`	2.0MB	2.0MB	+42.0B
`securitySolution`	11.3MB	11.3MB	+42.0B
`slo`	1.1MB	1.1MB	+42.0B
`stackConnectors`	1.4MB	1.4MB	+1.0KB
`synthetics`	1.0MB	1.0MB	+42.0B
`transform`	626.4KB	626.4KB	+42.0B
`triggersActionsUi`	1.9MB	1.9MB	+7.3KB
`uptime`	491.4KB	491.5KB	+42.0B
`workflowsManagement`	1.8MB	1.8MB	+542.0B
total			+9.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`actions`	18.2KB	18.5KB	+312.0B
`stackConnectors`	82.3KB	82.3KB	+3.0B
`triggersActionsUi`	109.4KB	109.4KB	+42.0B
total			+357.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/alerts-ui-shared`	358	359	+1
`@kbn/connector-specs`	156	158	+2
`@kbn/response-ops-oauth-hooks`	-	27	+27
`actions`	372	383	+11
total			+41

References to deprecated APIs

id	before	after	diff
`actions`	41	61	+20

Unreferenced deprecated APIs

id	before	after	diff
`actions`	41	61	+20

History

💔 Build #412131 failed 8db18f9
💔 Build #412095 failed b022fa7
💛 Build #411173 was flaky f6ece32
💔 Build #411154 failed 2f57826
💛 Build #410730 was flaky d96a184
💔 Build #410454 failed f8597ab

gsoldevila

Changes in Saved Objects LGTM (code review only)

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

…k routes (#262292) ## Summary Closes #257715 Adds availability: { since: '9.4.0' } to the two public OAuth routes introduced in #252369 (OAuth 2.0 Authorization Code Grant): - GET /api/actions/connector/_oauth_callback - GET /api/actions/connector/_oauth_callback_script This ensures the generated API docs show "Added in 9.4" for both serverless and stack (non-serverless) documentation. The two internal routes (_start_oauth_flow, _oauth_disconnect) don't need this annotation — the framework only applies availability to public routes, and internal routes are excluded from the OAS output. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

seanstory and others added 8 commits February 5, 2026 01:51

[ResponseOps][Connectors] Add auth mode to auth types (#252307)

01cf3be

## Summary Closes #252277 This PR will be merged into a feature branch

Merge branch 'main' of https://github.com/jcger/kibana into connector…

c989b64

…s-auth-code-grant

Merge branch 'main' into connectors-auth-code-grant

b8f0483

[WorkplaceAI][PerUserAuth] Remove redirectUri from oauth_state SO (…

f1e5cf2

…#252762) ## Summary Closes elastic/search-team#12900 --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

mattnowzari mentioned this pull request Feb 13, 2026

[Workplace AI] Slack Data Source #252972

Merged

5 tasks

jcger and others added 6 commits February 16, 2026 13:31

Merge branch 'main' into connectors-auth-code-grant

a63cbfd

[WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow (#…

fe99023

…252566) ## Summary Closes elastic/search-team#12681

Merge branch 'main' into connectors-auth-code-grant

da1e500

Merge branch 'main' into connectors-auth-code-grant

df98a36

dennis-tismenko and others added 9 commits February 23, 2026 09:19

Merge branch 'main' into connectors-auth-code-grant

1b86769

Changes from node scripts/generate codeowners

b403663

Changes from node scripts/regenerate_moon_projects.js --update

f004982

Merge branch 'main' of github.com:jcger/kibana into connectors-auth-c…

25a6409

…ode-grant

Small fixes (#254557)

c942aef

## Summary * Add missing unit test file * Fixed issue where expired oauth_state weren't being cleaned up

fix SO count test + docs

a4b08c0

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

460ebf7

…a into connectors-auth-code-grant

Changes from make api-docs

e8bcea2

jcger commented Feb 24, 2026

View reviewed changes

x-pack/platform/plugins/shared/actions/server/config.ts Outdated Show resolved Hide resolved

jcger force-pushed the connectors-auth-code-grant branch from 47b9df6 to 1907ce9 Compare February 24, 2026 22:08

add xpack.actions.auth.oauth_authorization_code.enabled flag

e7e0dd0

jcger force-pushed the connectors-auth-code-grant branch from 20719b9 to e7e0dd0 Compare February 25, 2026 09:40

Changes from make api-docs

2fd16c9

jcger added 3 commits March 13, 2026 16:14

Merge branch 'main' of github.com:jcger/kibana into connectors-auth-c…

354c11c

…ode-grant

remove logs

3f46049

add test and reenable basic auth for client_secret_basic

81d9c25

jcger mentioned this pull request Mar 13, 2026

[ResponseOps][PerUserAuth] 9.4 related documentation #257715

Closed

dennis-tismenko approved these changes Mar 13, 2026

View reviewed changes

jcger and others added 7 commits March 16, 2026 10:52

Merge branch 'main' into connectors-auth-code-grant

3324000

Merge branch 'main' into connectors-auth-code-grant

f8597ab

Merge branch 'main' of github.com:jcger/kibana into connectors-auth-c…

831232e

…ode-grant

Fix PKCE code (#257441)

d96a184

## Summary State client was generating a PKCE code longer than recommended 128 characters. This should fix it.

Merge branch 'main' of github.com:jcger/kibana into connectors-auth-c…

0463c1c

…ode-grant

Merge branch 'connectors-auth-code-grant' of github.com:elastic/kiban…

2f57826

…a into connectors-auth-code-grant

update limits

f6ece32

jcger force-pushed the connectors-auth-code-grant branch from f6e060e to f6ece32 Compare March 17, 2026 09:34

tomsonpl approved these changes Mar 18, 2026

View reviewed changes

jcger added 3 commits March 18, 2026 13:51

Merge branch 'main' of github.com:jcger/kibana into connectors-auth-c…

b022fa7

…ode-grant

fix forgotten conflict

8db18f9

update limit

48d9381

jcger requested review from jesuswr and rudolf March 18, 2026 16:20

gsoldevila approved these changes Mar 18, 2026

View reviewed changes

jcger merged commit 87a42ae into main Mar 18, 2026
19 checks passed

jcger deleted the connectors-auth-code-grant branch March 18, 2026 16:45

sophiec20 added the KibanaPlatEngineSolDep label Mar 18, 2026

jeramysoucy mentioned this pull request Mar 18, 2026

[PerUserAuth] Add EARS auth type for Connectors V2 #253695

Merged

5 tasks

jcger mentioned this pull request Apr 9, 2026

[ResponseOps][PerUserAuth] Add API availability docs to OAuth callback routes #262292

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Connectors v2] OAuth 2.0 Authorization Code Grant#252369

[Connectors v2] OAuth 2.0 Authorization Code Grant#252369
jcger merged 76 commits intomainfrom
connectors-auth-code-grant

jcger commented Feb 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

jcger commented Mar 13, 2026

Uh oh!

tomsonpl left a comment

Uh oh!

elasticmachine commented Mar 18, 2026

API count

References to deprecated APIs

Unreferenced deprecated APIs

Uh oh!

gsoldevila left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

jcger commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

2-step release

Config to run this locally

Involved PRs:

Uh oh!

Uh oh!

jcger commented Mar 13, 2026

Uh oh!

tomsonpl left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 18, 2026

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

References to deprecated APIs

Unreferenced deprecated APIs

History

Uh oh!

gsoldevila left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

jcger commented Feb 9, 2026 •

edited

Loading