[Auth] Added authentication strategy for UIAM OAuth by elena-shostak · Pull Request #256182 · elastic/kibana

elena-shostak · 2026-03-05T10:30:44Z

Summary

Added authentication strategy for UIAM OAuth.

How to check

## Start Scout servers
$ node scripts/scout.js start-server --arch serverless --domain security_complete --serverConfigSet uiam_local

## Run Scout tests
$ npx playwright test --config x-pack/platform/plugins/shared/security/test/scout_uiam_local/api/parallel.playwright.config.ts \
  --project local \
  --grep "UIAM OAuth token exchange"

Checklist

Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Closes: https://github.com/elastic/kibana-team/issues/2754

x-pack/platform/plugins/shared/security/server/uiam/uiam_service.ts

elasticmachine · 2026-03-06T20:01:23Z

Pinging @elastic/kibana-security (Team:Security)

azasypkin · 2026-03-25T14:09:03Z

ACK: Sorry for the delay, will finish review today.

azasypkin

Looks good! Just a few questions and suggestions.

azasypkin · 2026-03-25T15:38:11Z

x-pack/platform/plugins/shared/security/server/authentication/authenticator.ts

note: I'm fine with the dedicated option, but options.config.uiam?.enabled is also available in the provider, since we always pass the full options object to the constructor via can use it directly.

azasypkin · 2026-03-25T15:44:07Z

x-pack/platform/plugins/shared/security/server/authentication/authenticator.ts

note: I see you pass this config value to set acceptUiamOAuth in the HTTP auth provider, but we also pass options.uiam to every provider (including HTTP), which is only non-null when options.config.uiam?.enabled is true. That's what we rely on in the SAML authc provider to decide whether we need to support UIAM flows. Dedicated option is fine by me too, but relying on options.uiam might be simpler and more consistent with the rest of the code base.

azasypkin · 2026-03-25T15:45:07Z

x-pack/platform/plugins/shared/security/server/authentication/providers/http.ts

question: do you know if there will be a way to distinguish OAuth UIAM tokens from any other UIAM credentials?

Since these are the only ones that come from outside with Bearer scheme it's not a problem for us, but it'd be great if these could be easily distinguishable these from other types of credentials.

hmm, seems there is no easy way to do that, it has different type claim, but it doesn't help us much

Roger that, thanks for checking!

azasypkin · 2026-03-25T15:47:36Z

x-pack/platform/plugins/shared/security/server/authentication/providers/http.ts

question: I'm wondering if it would be safer to do this inside the UIAM service itself, so we don't have to depend on the consumer to perform the check for us (and we won't need to pass expected audience as argument)?

https://github.com/elastic/kibana/pull/256182/changes#diff-b18af47b9dc65be9cce719afafcd71875bd504c197bbc8c52de568a390967e2fR439-R442 I have added UiamServiceOptions that passes down es and kibana urls, so we can incapsulate the audience check inside exchangeOAuthToken method. Lmk if that's okay with you

Yep, looks good to me, thanks 👍

x-pack/platform/plugins/shared/security/server/uiam/uiam_service.ts

...s/shared/security/test/scout_uiam_local/api/parallel_tests/uiam_oauth_token_exchange.spec.ts

…ak/kibana into 2754-authentication-strategy

elasticmachine · 2026-03-30T16:28:35Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: b7b020f

Failed CI Steps

Test Failures

[job] [logs] Agent Builder API Smoke Tests #1 / Agent Builder - LLM Smoke tests EIS Models (dynamically configured) Connector: google-gemini-3.1-pro can continue a text conversation
[job] [logs] Jest Tests #6 / discover responsive sidebar should render buttons in data view picker correctly
[job] [logs] Jest Tests #11 / Security Plugin start() exposes proper contract
[job] [logs] Jest Tests #11 / Security Plugin start() exposes proper contract

History

💔 Build #418926 failed 6b98d39
💛 Build #418790 was flaky 0115f85
💛 Build #406219 was flaky e9d19c8
💔 Build #406186 failed 9fb4d22

…e_for_children6 * commit '3402744f63ca1196e97b11ffac4e7f7efab240df': (80 commits) [PerUserAuth] Add EARS auth type for Connectors V2 (elastic#253695) Fix `@elastic/eui/require-aria-label-for-modals` lint violations across `@elastic/kibana-core` files (elastic#259757) [Entity Analytics][Leads generation][4] Add API routes, LeadDataClient, and async generation (elastic#257046) [Agent Builder] Agent-centric UX redesign (elastic#258005) fix query streams failing test (elastic#260277) [Lens as code] Add list layout to the new API (elastic#259967) [FTR] Add warning comments to deployment-agnostic FTR base configs (elastic#260018) [Discover][Logs profile] Fix missing search highlights (elastic#260056) Plugin system: safe deletion (elastic#259038) [Infra] Fix Hosts filter options to match selected schema (elastic#259825) Manual Entity Resolution and flyout representation (elastic#260162) [Cascade] Handle grouping on fields with unset values (elastic#260033) [Fleet] generate OTel config for integration packages with otelcol inputs (elastic#259968) [Search] Switch over to V2 index management details (elastic#259866) [inference] increase timeout for ES inference calls (elastic#260382) [ES|QL] Enable subqueries (elastic#257455) [ES|QL] Change Point order free options (elastic#260282) [Auth] Added authentication strategy for UIAM OAuth (elastic#256182) [Security Solution] Add "alerts_candidate_count" rule execution metric (elastic#259917) [api-docs] 2026-03-31 Daily api_docs build (elastic#260380) ...

## Summary Added authentication strategy for UIAM OAuth. --- ### How to check ```shell ## Start Scout servers $ node scripts/scout.js start-server --arch serverless --domain security_complete --serverConfigSet uiam_local ## Run Scout tests $ npx playwright test --config x-pack/platform/plugins/shared/security/test/scout_uiam_local/api/parallel.playwright.config.ts \ --project local \ --grep "UIAM OAuth token exchange" ``` ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) __Closes: https://github.com/elastic/kibana-team/issues/2754__

elena-shostak commented Mar 5, 2026

View reviewed changes

x-pack/platform/plugins/shared/security/server/uiam/uiam_service.ts Outdated Show resolved Hide resolved

elena-shostak mentioned this pull request Mar 5, 2026

OAuth 2.0 Protected Resource Metadata endpoint #256274

Closed

2 tasks

elena-shostak added 4 commits March 6, 2026 16:53

[Auth] Added authentication strategy for UIAM OAuth

2cee799

Adjustments

d3edf26

Scout tests

4a39fc2

Fixes

9fb4d22

elena-shostak added backport:skip This PR does not require backporting release_note:enhancement release_note:skip Skip the PR/issue when compiling release notes Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// and removed release_note:enhancement labels Mar 6, 2026

elena-shostak force-pushed the 2754-authentication-strategy branch from b3d83ef to 9fb4d22 Compare March 6, 2026 19:37

elena-shostak requested a review from azasypkin March 6, 2026 20:00

elena-shostak marked this pull request as ready for review March 6, 2026 20:01

elena-shostak requested review from a team as code owners March 6, 2026 20:01

Fixes

e9d19c8

pgayvallet approved these changes Mar 20, 2026

View reviewed changes

azasypkin approved these changes Mar 25, 2026

View reviewed changes

elena-shostak and others added 6 commits March 30, 2026 14:02

wip

bdb2191

Merge branch 'main' into 2754-authentication-strategy

b50f615

Merge branch '2754-authentication-strategy' of github.com:elena-shost…

0c324da

…ak/kibana into 2754-authentication-strategy

Added scout test for audience mismatch

0115f85

Incapsulated audience check to UIAM service

6b98d39

Fix

b7b020f

Test fixes

6b24e2d

elena-shostak merged commit 6b45ad7 into elastic:main Mar 31, 2026
18 checks passed

kibanamachine added the v9.4.0 label Mar 31, 2026

elena-shostak mentioned this pull request Apr 2, 2026

OAuth 2.0 Protected Resource Metadata endpoint #260773

Open

1 task

maximpn mentioned this pull request Apr 10, 2026

Prebuilt rules installation and review endpoints OOM in production #262086

Open

Conversation

elena-shostak commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to check

Checklist

Uh oh!

Uh oh!

elasticmachine commented Mar 6, 2026

Uh oh!

azasypkin commented Mar 25, 2026

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Mar 30, 2026

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

elena-shostak commented Mar 5, 2026 •

edited

Loading