[Connectors v2] OAuth 2.0 Authorization Code Grant

.github/CODEOWNERS

@@ -1032,6 +1032,7 @@ x-pack/platform/packages/shared/response-ops/alerts-fields-browser @elastic/resp
 x-pack/platform/packages/shared/response-ops/alerts-filters-form @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/alerts-table @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/form-generator @elastic/response-ops
+x-pack/platform/packages/shared/response-ops/oauth-hooks @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/recurring-schedule-form @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/retry-service @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/rule_form @elastic/response-ops

oas_docs/output/kibana.serverless.yaml

@@ -410,6 +410,81 @@ paths:
       x-metaTags:
         - content: Kibana, Elastic Cloud Serverless
           name: product_name
+  /api/actions/connector/_oauth_callback:
+    get:
+      description: |-
+        **Spaces method and path for this operation:**
+
+        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback</span></div>
+
+        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
+
+        Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.
+      operationId: get-actions-connector-oauth-callback
+      parameters:
+        - description: The authorization code returned by the OAuth provider.
+          in: query
+          name: code
+          required: false
+          schema:
+            type: string
+        - description: The state parameter for CSRF protection.
+          in: query
+          name: state
+          required: false
+          schema:
+            type: string
+        - description: Error code if the authorization failed.
+          in: query
+          name: error
+          required: false
+          schema:
+            type: string
+        - description: Human-readable error description.
+          in: query
+          name: error_description
+          required: false
+          schema:
+            type: string
+        - description: Session state from the OAuth provider (e.g., Microsoft).
+          in: query
+          name: session_state
+          required: false
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Returns an HTML callback page.
+        '302':
+          description: Redirects to the return URL with authorization result query parameters.
+        '401':
+          description: User is not authenticated.
+      summary: Handle OAuth callback
+      tags:
+        - connectors
+      x-metaTags:
+        - content: Kibana, Elastic Cloud Serverless
+          name: product_name
+  /api/actions/connector/_oauth_callback_script:
+    get:
+      description: |-
+        **Spaces method and path for this operation:**
+
+        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback_script</span></div>
+
+        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
+
+        Returns the OAuth callback script
+      operationId: get-actions-connector-oauth-callback-script
+      parameters: []
+      responses:
+        '200':
+          description: Returns the OAuth callback script
+      summary: ''
+      tags: []
+      x-metaTags:
+        - content: Kibana, Elastic Cloud Serverless
+          name: product_name
   /api/actions/connector/{id}:
     delete:
       description: |-
@@ -463,6 +538,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -620,6 +701,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -772,6 +859,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -900,6 +993,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -970,6 +1069,12 @@ paths:
                   additionalProperties: false
                   type: object
                   properties:
+                    auth_mode:
+                      description: The authentication mode used for the connector.
+                      enum:
+                        - shared
+                        - per-user
+                      type: string
                     config:
                       additionalProperties: {}
                       type: object

oas_docs/output/kibana.yaml

@@ -481,6 +481,81 @@ paths:
       x-metaTags:
         - content: Kibana
           name: product_name
+  /api/actions/connector/_oauth_callback:
+    get:
+      description: |-
+        **Spaces method and path for this operation:**
+
+        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback</span></div>
+
+        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
+
+        Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.
+      operationId: get-actions-connector-oauth-callback
+      parameters:
+        - description: The authorization code returned by the OAuth provider.
+          in: query
+          name: code
+          required: false
+          schema:
+            type: string
+        - description: The state parameter for CSRF protection.
+          in: query
+          name: state
+          required: false
+          schema:
+            type: string
+        - description: Error code if the authorization failed.
+          in: query
+          name: error
+          required: false
+          schema:
+            type: string
+        - description: Human-readable error description.
+          in: query
+          name: error_description
+          required: false
+          schema:
+            type: string
+        - description: Session state from the OAuth provider (e.g., Microsoft).
+          in: query
+          name: session_state
+          required: false
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Returns an HTML callback page.
+        '302':
+          description: Redirects to the return URL with authorization result query parameters.
+        '401':
+          description: User is not authenticated.
+      summary: Handle OAuth callback
+      tags:
+        - connectors
+      x-metaTags:
+        - content: Kibana
+          name: product_name
+  /api/actions/connector/_oauth_callback_script:
+    get:
+      description: |-
+        **Spaces method and path for this operation:**
+
+        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback_script</span></div>
+
+        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
+
+        Returns the OAuth callback script
+      operationId: get-actions-connector-oauth-callback-script
+      parameters: []
+      responses:
+        '200':
+          description: Returns the OAuth callback script
+      summary: ''
+      tags: []
+      x-metaTags:
+        - content: Kibana
+          name: product_name
   /api/actions/connector/{id}:
     delete:
       description: |-
@@ -534,6 +609,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -691,6 +772,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -843,6 +930,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -971,6 +1064,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -1041,6 +1140,12 @@ paths:
                   additionalProperties: false
                   type: object
                   properties:
+                    auth_mode:
+                      description: The authentication mode used for the connector.
+                      enum:
+                        - shared
+                        - per-user
+                      type: string
                     config:
                       additionalProperties: {}
                       type: object

package.json

@@ -929,6 +929,7 @@
     "@kbn/response-ops-alerts-filters-form": "link:x-pack/platform/packages/shared/response-ops/alerts-filters-form",
     "@kbn/response-ops-alerts-table": "link:x-pack/platform/packages/shared/response-ops/alerts-table",
     "@kbn/response-ops-form-generator": "link:x-pack/platform/packages/shared/response-ops/form-generator",
+    "@kbn/response-ops-oauth-hooks": "link:x-pack/platform/packages/shared/response-ops/oauth-hooks",
     "@kbn/response-ops-recurring-schedule-form": "link:x-pack/platform/packages/shared/response-ops/recurring-schedule-form",
     "@kbn/response-ops-retry-service": "link:x-pack/platform/packages/shared/response-ops/retry-service",
     "@kbn/response-ops-rule-form": "link:x-pack/platform/packages/shared/response-ops/rule_form",

packages/kbn-check-saved-objects-cli/current_fields.json

@@ -967,6 +967,11 @@
   "monitoring-telemetry": [
     "reportedClusterUuids"
   ],
+  "oauth_state": [
+    "connectorId",
+    "expiresAt",
+    "state"
+  ],
   "observability-onboarding-state": [
     "progress",
     "state",
@@ -1394,6 +1399,11 @@
   "usage-counters": [
     "domainId"
   ],
+  "user_connector_token": [
+    "connectorId",
+    "credentialType",
+    "profileUid"
+  ],
   "visualization": [
     "description",
     "kibanaSavedObjectMeta",

packages/kbn-check-saved-objects-cli/current_mappings.json

@@ -3228,6 +3228,20 @@
       }
     }
   },
+  "oauth_state": {
+    "dynamic": false,
+    "properties": {
+      "connectorId": {
+        "type": "keyword"
+      },
+      "expiresAt": {
+        "type": "date"
+      },
+      "state": {
+        "type": "keyword"
+      }
+    }
+  },
   "observability-onboarding-state": {
     "properties": {
       "progress": {
@@ -4634,6 +4648,20 @@
       }
     }
   },
+  "user_connector_token": {
+    "dynamic": false,
+    "properties": {
+      "connectorId": {
+        "type": "keyword"
+      },
+      "credentialType": {
+        "type": "keyword"
+      },
+      "profileUid": {
+        "type": "keyword"
+      }
+    }
+  },
   "visualization": {
     "dynamic": false,
     "properties": {