[Connectors v2] OAuth 2.0 Authorization Code Grant

.github/CODEOWNERS

@@ -1021,6 +1021,7 @@ x-pack/platform/packages/shared/response-ops/alerts-fields-browser @elastic/resp
 x-pack/platform/packages/shared/response-ops/alerts-filters-form @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/alerts-table @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/form-generator @elastic/response-ops
+x-pack/platform/packages/shared/response-ops/oauth-hooks @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/recurring-schedule-form @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/retry-service @elastic/response-ops
 x-pack/platform/packages/shared/response-ops/rule_form @elastic/response-ops

oas_docs/output/kibana.serverless.yaml

@@ -463,6 +463,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -620,6 +626,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -772,6 +784,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -900,6 +918,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -970,6 +994,12 @@ paths:
                   additionalProperties: false
                   type: object
                   properties:
+                    auth_mode:
+                      description: The authentication mode used for the connector.
+                      enum:
+                        - shared
+                        - per-user
+                      type: string
                     config:
                       additionalProperties: {}
                       type: object

oas_docs/output/kibana.yaml

@@ -534,6 +534,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -691,6 +697,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -843,6 +855,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -971,6 +989,12 @@ paths:
                 additionalProperties: false
                 type: object
                 properties:
+                  auth_mode:
+                    description: The authentication mode used for the connector.
+                    enum:
+                      - shared
+                      - per-user
+                    type: string
                   config:
                     additionalProperties: {}
                     type: object
@@ -1041,6 +1065,12 @@ paths:
                   additionalProperties: false
                   type: object
                   properties:
+                    auth_mode:
+                      description: The authentication mode used for the connector.
+                      enum:
+                        - shared
+                        - per-user
+                      type: string
                     config:
                       additionalProperties: {}
                       type: object

package.json

@@ -913,6 +913,7 @@
     "@kbn/response-ops-alerts-filters-form": "link:x-pack/platform/packages/shared/response-ops/alerts-filters-form",
     "@kbn/response-ops-alerts-table": "link:x-pack/platform/packages/shared/response-ops/alerts-table",
     "@kbn/response-ops-form-generator": "link:x-pack/platform/packages/shared/response-ops/form-generator",
+    "@kbn/response-ops-oauth-hooks": "link:x-pack/platform/packages/shared/response-ops/oauth-hooks",
     "@kbn/response-ops-recurring-schedule-form": "link:x-pack/platform/packages/shared/response-ops/recurring-schedule-form",
     "@kbn/response-ops-retry-service": "link:x-pack/platform/packages/shared/response-ops/retry-service",
     "@kbn/response-ops-rule-form": "link:x-pack/platform/packages/shared/response-ops/rule_form",

packages/kbn-optimizer/limits.yml

@@ -181,7 +181,7 @@ pageLoadAssetSize:
   telemetryManagementSection: 5522
   timelines: 192134
   transform: 16515
-  triggersActionsUi: 112000
+  triggersActionsUi: 126052
   uiActions: 35278
   unifiedDocViewer: 14513
   unifiedSearch: 19500

src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts

@@ -57,7 +57,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
 
     expect(hashMap).toMatchInlineSnapshot(`
       Object {
-        "action": "f57d48f1be0e7895817648ecc89db8a5b594edc5185ad7c60b5ab743c960311b",
+        "action": "3ab1aa6b6d32d7704fa2dc5fe34c65d632d869af3736f5d08a761d09b93430e2",
         "action_task_params": "6751dc8a4707a432bc9b90f5a025f183aefc84bca5ec26c29ce6939b24ea81e4",
         "ad_hoc_run_params": "9c372f2a8f8b468e9b699a6df633c7f14fab7f13216c9ec160813e75bae56098",
         "alert": "ab52f596c3499231d37ab4c0ee346010789a9a0b9d64d61a6631986e1e62b2aa",
@@ -89,7 +89,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "cloud-security-posture-settings": "86ac8eba7ea80c15ab48bf424f7c15f1d935774f84ff32c5c1e04c95c67e72b6",
         "config": "d368f46c1a9920560f23b0d2793379995ee24bbff8e0438661bc3d9f528f4947",
         "config-global": "e306e70563eb2f3204aff45506f3ca1c3c67461971a45fba471c72bd8eb4435b",
-        "connector_token": "6e14114a9a7ca64becf611b7db23d59438cd332fd5228fbf7c6cc2144e0459d0",
+        "connector_token": "04838c9e72fae94ee65cd2e0b7ac9acf883506c390304c5b02626961905d1656",
         "core-usage-stats": "0e76782718b2eef6104d2ddec46ed356339220997ad8da8d4f86433c3b46f77a",
         "csp-rule-template": "6fec028650a7aa0ef5a07d3d2906c32c2505da013adb2e51fa0e66bbf0ff70c5",
         "dashboard": "3cfab5e285c531092dd9abed38565e6e048b843d75ba9a6c1f5c3017a42db0c6",
@@ -237,6 +237,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "action|global: 04984aae6011426601f8a2a06278e30080f6da3a",
         "action|mappings: c4a658c865d4c30b51ae9b49e1dec06d012bc213",
         "action|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
+        "action|10.2.0: 4367848750ed49705e88d5ffbe6229bf25312bd17e0f66f1848ec0031b6667b8",
         "action|10.1.0: e588c3ab049a6d529d68099cac0cb5b8256603d421f28dd475bbcd2146451d6f",
         "action|8.3.0: 89bd5d9dfbcd73496bf7ff424f5ed670b074078e",
         "action|8.0.0: 89bd5d9dfbcd73496bf7ff424f5ed670b074078e",
@@ -535,6 +536,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "connector_token|global: 9c6972571df6c56a0d542bdca734a55a7a3859e5",
         "connector_token|mappings: 8c3f381518f3a37955cc7a434e72a81c11e28f1c",
         "connector_token|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
+        "connector_token|10.2.0: 796867ae86b9d9eb58eb4647bc61fdb58fbeca3024cf4ff556f18e34b7b70060",
         "connector_token|10.1.0: ab76db77c61eebd5d731958f792a26402d8c216ed20de984c25f17bd0b59b784",
         "========================================================================================",
         "core-usage-stats|global: 0f6c6a66d1ec3ccababd15890476caf7f6f57700",
@@ -1330,7 +1332,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
     // WARNING Existing entries' semvers should NEVER be downgraded. Never validate changes if they cause a downgrade.
     expect(map).toMatchInlineSnapshot(`
       Object {
-        "action": "10.1.0",
+        "action": "10.2.0",
         "action_task_params": "10.2.0",
         "ad_hoc_run_params": "10.3.0",
         "alert": "10.9.0",
@@ -1362,7 +1364,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "cloud-security-posture-settings": "10.1.0",
         "config": "10.2.0",
         "config-global": "10.0.0",
-        "connector_token": "10.1.0",
+        "connector_token": "10.2.0",
         "core-usage-stats": "10.0.0",
         "csp-rule-template": "10.0.0",
         "dashboard": "10.3.0",
@@ -1486,7 +1488,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
     // WARNING Existing entries' semvers should NEVER be downgraded. Never validate changes if they cause a downgrade.
     expect(map).toMatchInlineSnapshot(`
       Object {
-        "action": "10.1.0",
+        "action": "10.2.0",
         "action_task_params": "10.2.0",
         "ad_hoc_run_params": "10.3.0",
         "alert": "10.9.0",
@@ -1518,7 +1520,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "cloud-security-posture-settings": "10.1.0",
         "config": "10.2.0",
         "config-global": "0.0.0",
-        "connector_token": "10.1.0",
+        "connector_token": "10.2.0",
         "core-usage-stats": "7.14.1",
         "csp-rule-template": "8.7.0",
         "dashboard": "10.3.0",

src/platform/packages/shared/kbn-alerts-ui-shared/src/common/apis/fetch_connectors/transform_connectors_response.ts

@@ -28,6 +28,7 @@ const transformConnector: RewriteRequestCase<
   is_missing_secrets: isMissingSecrets,
   is_system_action: isSystemAction,
   is_connector_type_deprecated: isConnectorTypeDeprecated,
+  auth_mode: authMode,
   ...res
 }) => ({
   actionTypeId,
@@ -37,5 +38,6 @@ const transformConnector: RewriteRequestCase<
   isMissingSecrets,
   isSystemAction,
   isConnectorTypeDeprecated,
+  ...(authMode !== undefined ? { authMode } : {}),
   ...res,
 });

src/platform/packages/shared/kbn-alerts-ui-shared/src/common/types/action_types.ts

@@ -46,6 +46,7 @@ export interface ActionConnectorProps<Config, Secrets> {
   isMissingSecrets?: boolean;
   isConnectorTypeDeprecated: boolean;
   source?: ActionTypeSource;
+  authMode?: 'shared' | 'per-user';
 }
 
 export type SystemAction = Omit<ActionConnectorProps<never, never>, 'config' | 'secrets'> & {

src/platform/packages/shared/kbn-connector-specs/src/all_auth_types.ts

@@ -12,6 +12,7 @@ export * from './auth_types/bearer';
 export * from './auth_types/basic';
 export * from './auth_types/none';
 export * from './auth_types/oauth';
+export * from './auth_types/oauth_authorization_code';
 
 // Skipping PFX and CRT exports for now as they will require updates to
 // the formbuilder to support file upload fields.

src/platform/packages/shared/kbn-connector-specs/src/auth_types/oauth_authorization_code.ts

@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { z } from '@kbn/zod/v4';
+import type { AxiosInstance } from 'axios';
+import type { AuthContext, AuthTypeSpec } from '../connector_spec';
+import * as i18n from './translations';
+
+const authSchema = z
+  .object({
+    authorizationUrl: z.url().meta({ label: i18n.OAUTH_AUTHORIZATION_URL_LABEL }),
+    tokenUrl: z.url().meta({ label: i18n.OAUTH_TOKEN_URL_LABEL }),
+    clientId: z
+      .string()
+      .min(1, { message: i18n.OAUTH_CLIENT_ID_REQUIRED_MESSAGE })
+      .meta({ label: i18n.OAUTH_CLIENT_ID_LABEL }),
+    scope: z.string().meta({ label: i18n.OAUTH_SCOPE_LABEL }).optional(),
+    clientSecret: z
+      .string()
+      .min(1, { message: i18n.OAUTH_CLIENT_SECRET_REQUIRED_MESSAGE })
+      .meta({ label: i18n.OAUTH_CLIENT_SECRET_LABEL, sensitive: true }),
+    useBasicAuth: z.boolean().default(true).optional().meta({
+      hidden: true, // Hidden from UI - uses connector spec defaults
+    }),
+  })
+  .meta({ label: i18n.OAUTH_AUTHORIZATION_CODE_LABEL });
+
+type AuthSchemaType = z.infer<typeof authSchema>;
+
+/**
+ * OAuth2 Authorization Code Flow with PKCE
+ *
+ * This is a generic, reusable auth type for any OAuth2 provider that supports the
+ * Authorization Code flow (Microsoft, Google, Salesforce, Slack, etc.).
+ *
+ * ## How it works:
+ * 1. User clicks the "Authorize" button in the connector UI
+ * 2. _start_oauth_flow route generates PKCE parameters and returns the provider's authorization URL
+ * 3. UI opens the authorization URL where user authorizes the app
+ * 4. Provider redirects back to the _oauth_callback route with the authorization code
+ * 5. Callback route exchanges code for access/refresh tokens and stores them
+ * 6. Tokens are auto-refreshed when expired during connector execution
+ *
+ * ## Usage in connector specs:
+ * Different providers use different OAuth endpoints - specify these in your connector's auth defaults:
+ *
+ * ```typescript
+ * // Example: Microsoft/SharePoint
+ * auth: {
+ *   types: [{
+ *     type: 'oauth_authorization_code',
+ *     defaults: {
+ *       authorizationUrl: 'https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize',
+ *       tokenUrl: 'https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token',
+ *       scope: 'https://graph.microsoft.com/.default offline_access'
+ *     }
+ *   }]
+ * }
+ *
+ * // Example: Google Drive
+ * auth: {
+ *   types: [{
+ *     type: 'oauth_authorization_code',
+ *     defaults: {
+ *       authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+ *       tokenUrl: 'https://oauth2.googleapis.com/token',
+ *       scope: 'https://www.googleapis.com/auth/drive.readonly'
+ *     }
+ *   }]
+ * }
+ * ```
+ *
+ * Users will fill in their client ID, client secret, and can customize URLs/scopes if needed.
+ * The _start_oauth_flow and _oauth_callback routes are generic and work with any provider.
+ */
+export const OAuthAuthorizationCode: AuthTypeSpec<AuthSchemaType> = {
+  id: 'oauth_authorization_code',
+  schema: authSchema,
+  authMode: 'per-user',
+  configure: async (
+    ctx: AuthContext,
+    axiosInstance: AxiosInstance,
+    secret: AuthSchemaType
+  ): Promise<AxiosInstance> => {
+    // For authorization code flow, tokens are managed separately via callback routes
+    // The getToken() method will retrieve already-stored tokens and auto-refresh if needed
+    // For this auth spec, getToken() calls getOAuthAuthorizationCodeAccessToken()
+    let token;
+    try {
+      token = await ctx.getToken({
+        tokenUrl: secret.tokenUrl,
+        scope: secret.scope,
+        clientId: secret.clientId,
+        clientSecret: secret.clientSecret,
+      });
+    } catch (error) {
+      throw new Error(
+        `Unable to retrieve/refresh the access token. User may need to re-authorize: ${error.message}`
+      );
+    }
+
+    if (!token) {
+      throw new Error(`No access token available. User must complete OAuth authorization flow.`);
+    }
+
+    // set global defaults
+    axiosInstance.defaults.headers.common.Authorization = token;
+
+    return axiosInstance;
+  },
+};

src/platform/packages/shared/kbn-connector-specs/src/auth_types/translations.ts

@@ -117,6 +117,20 @@ export const OAUTH_CLIENT_SECRET_REQUIRED_MESSAGE = i18n.translate(
   }
 );
 
+export const OAUTH_AUTHORIZATION_CODE_LABEL = i18n.translate(
+  'connectorSpecs.oauthAuthorizationCode.label',
+  {
+    defaultMessage: 'OAuth2 Authorization Code',
+  }
+);
+
+export const OAUTH_AUTHORIZATION_URL_LABEL = i18n.translate(
+  'connectorSpecs.oauthAuthorizationUrl.label',
+  {
+    defaultMessage: 'Authorization URL',
+  }
+);
+
 export const CRT_AUTH_LABEL = i18n.translate('connectorSpecs.crt.label', {
   defaultMessage: 'SSL CRT and Key authentication',
 });