Skip to content

[ResponseOps][PerUserAuth] Delete user tokens on connector delete and update#254916

Merged
js-jankisalvi merged 1 commit intoelastic:connectors-auth-code-grantfrom
js-jankisalvi:delete-user-tokens
Feb 25, 2026
Merged

[ResponseOps][PerUserAuth] Delete user tokens on connector delete and update#254916
js-jankisalvi merged 1 commit intoelastic:connectors-auth-code-grantfrom
js-jankisalvi:delete-user-tokens

Conversation

@js-jankisalvi
Copy link
Copy Markdown
Contributor

@js-jankisalvi js-jankisalvi commented Feb 25, 2026

Summary

Resolves #254123

This PR deletes user tokens from user_connector_token SO after updating the connector or deleting the connector.

How to test

  • Create google drive connector with oauth 2.0
  • Authorize the connector
  • Create a workflow with it and verify it runs successfully
  • Verify use_connector_token SO exist with created connector id 
    GET .kibana_alerting_cases/_search
{
   "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "type": "user_connector_token"
            }
          }
        ]
      }
    }
}
  • Update the connector
  • Verify the user_connector_token SO entry is deleted
  • Reauthorize the connector and verify SO entry exist
  • Delete the connector
  • Verify the user_connector_token SO entry is deleted

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@js-jankisalvi js-jankisalvi self-assigned this Feb 25, 2026
@js-jankisalvi js-jankisalvi requested a review from a team as a code owner February 25, 2026 12:47
@js-jankisalvi js-jankisalvi added Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v9.4.0 labels Feb 25, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 25, 2026

Pinging @elastic/response-ops (Team:ResponseOps)

@js-jankisalvi js-jankisalvi added release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels labels Feb 25, 2026
@jcger jcger mentioned this pull request Feb 25, 2026
Merged
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 25, 2026 •
edited
Loading

💔 Build Failed

Failed CI Steps

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [82a2597]

History

cc @js-jankisalvi

@jcger
Copy link
Copy Markdown
Contributor

jcger commented Feb 25, 2026

LGTM!

@js-jankisalvi js-jankisalvi merged commit bf90b46 into elastic:connectors-auth-code-grant Feb 25, 2026
23 of 24 checks passed
@js-jankisalvi js-jankisalvi deleted the delete-user-tokens branch February 25, 2026 14:50
jcger added a commit that referenced this pull request Mar 18, 2026
@jcger @seanstory
@kibanamachine @lorenabalan @js-jankisalvi @cursoragent @cnasikas @dennis-tismenko
[Connectors v2] OAuth 2.0 Authorization Code Grant (#252369)
87a42ae 
## Description

Currently, all Kibana connectors use a shared service account for
authentication. This approach lacks per user level access support, as it
does not distinguish between individual users and service account user
levels of permission. To support more secure, flexible, and user-aware
integrations, we need to introduce per-user authentication for
connectors in Kibana, alongside the existing service account method.

## 2-step release

As there are changes that require a 2-step release, this PR won't add
`oauth_authorization_code` auth type to any connector type. Therefore,
it won't be usable for now. The changes that require a 2-step release
are:
- we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO
- we are adding `refreshToken` as an encrypted attribute for
`connector_token` SO

## Config to run this locally
```
uiSettings:
  overrides:
    'workflows:ui:enabled': true
server.publicBaseUrl: 'http://localhost:5601'
```
Also, the auth type needs to be used in a connector. Reach out privately
to get the necessary info.

## Involved PRs:

- #246655
- #251873
- #251717
- #252566
- #252104
- #252307
- #252262
- #252501
- #253606
- #254589
- #254916
- Rename rate limit kbn setting 15d2c19
- Fix refresh token 34708e5

---------

Co-authored-by: Sean Story <sean.story@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lorena Bălan <lorena.balan@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>
qn895 pushed a commit to qn895/kibana that referenced this pull request Mar 18, 2026
@jcger @seanstory
@kibanamachine @lorenabalan @js-jankisalvi @cursoragent @cnasikas @dennis-tismenko @qn895
[Connectors v2] OAuth 2.0 Authorization Code Grant (elastic#252369)
38155ad 
## Description

Currently, all Kibana connectors use a shared service account for
authentication. This approach lacks per user level access support, as it
does not distinguish between individual users and service account user
levels of permission. To support more secure, flexible, and user-aware
integrations, we need to introduce per-user authentication for
connectors in Kibana, alongside the existing service account method.

## 2-step release

As there are changes that require a 2-step release, this PR won't add
`oauth_authorization_code` auth type to any connector type. Therefore,
it won't be usable for now. The changes that require a 2-step release
are:
- we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO
- we are adding `refreshToken` as an encrypted attribute for
`connector_token` SO

## Config to run this locally
```
uiSettings:
  overrides:
    'workflows:ui:enabled': true
server.publicBaseUrl: 'http://localhost:5601'
```
Also, the auth type needs to be used in a connector. Reach out privately
to get the necessary info.

## Involved PRs:

- elastic#246655
- elastic#251873
- elastic#251717
- elastic#252566
- elastic#252104
- elastic#252307
- elastic#252262
- elastic#252501
- elastic#253606
- elastic#254589
- elastic#254916
- Rename rate limit kbn setting 15d2c19
- Fix refresh token 34708e5

---------

Co-authored-by: Sean Story <sean.story@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lorena Bălan <lorena.balan@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026
@jcger @seanstory
@kibanamachine @lorenabalan @js-jankisalvi @cursoragent @cnasikas @dennis-tismenko @jeramysoucy
[Connectors v2] OAuth 2.0 Authorization Code Grant (elastic#252369)
52d45bd 
## Description

Currently, all Kibana connectors use a shared service account for
authentication. This approach lacks per user level access support, as it
does not distinguish between individual users and service account user
levels of permission. To support more secure, flexible, and user-aware
integrations, we need to introduce per-user authentication for
connectors in Kibana, alongside the existing service account method.

## 2-step release

As there are changes that require a 2-step release, this PR won't add
`oauth_authorization_code` auth type to any connector type. Therefore,
it won't be usable for now. The changes that require a 2-step release
are:
- we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO
- we are adding `refreshToken` as an encrypted attribute for
`connector_token` SO

## Config to run this locally
```
uiSettings:
  overrides:
    'workflows:ui:enabled': true
server.publicBaseUrl: 'http://localhost:5601'
```
Also, the auth type needs to be used in a connector. Reach out privately
to get the necessary info.

## Involved PRs:

- elastic#246655
- elastic#251873
- elastic#251717
- elastic#252566
- elastic#252104
- elastic#252307
- elastic#252262
- elastic#252501
- elastic#253606
- elastic#254589
- elastic#254916
- Rename rate limit kbn setting 15d2c19
- Fix refresh token 34708e5

---------

Co-authored-by: Sean Story <sean.story@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lorena Bălan <lorena.balan@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jcger jcger jcger approved these changes

Assignees

@js-jankisalvi js-jankisalvi

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@js-jankisalvi @elasticmachine @jcger