[performance] Apply minimal auth to the search route by drewdaemon · Pull Request #257497 · elastic/kibana

drewdaemon · 2026-03-12T20:16:33Z

Summary

Enable minimal authentication for the search route!

…ta-plugin

drewdaemon · 2026-04-01T18:50:14Z

-        const user = getCurrentUser(request);
-        if (user?.roles.length === 0) {
-          this.logger.warn(
-            `A user authenticated with the "${user.authentication_realm.name}" (${user.authentication_realm.type}) realm doesn't have any roles and isn't authorized to perform request.`
-          );
-        }


This log statement was creating a server error in some cases:

Error: Property "authentication_realm" is not available for minimally authenticated users.

Thanks!

Context: "With minimal auth, we won’t always have roles available, so this message will become more and more misleading when debugging issues."

drewdaemon · 2026-04-02T21:52:45Z

   * to reduce number of saved object updates and reduce a chance of running over update retries limit
   * @internal
   */
  public trackId = async (


trackId is called from the now-minimally-authenticated search route, so it needs to avoid accessing authentication_realm

drewdaemon · 2026-04-02T21:53:09Z

   * request can continue rather than restart.
   * @internal
   */
  public getId = async (


getId is called from the now-minimally-authenticated search route, so it needs to avoid accessing authentication_realm

does it mean that it's possible to get search sessions from other users?

getId is called when restoring a search, so technically it's possible for them to get a search ID from another search session (in the rare case that they have the same username but different realms) but it shouldn't matter all that much because they still won't have access to the results from that ID.

yeah or your could add a search to another user's session with trackId. But the same data access controls ultimately apply

AlexGPlay

took me a bit to understand but i think now i get it, but let me go over it just in case:

the search route now has minimal auth which means we only care about the credentials being there and the full auth is deferred to elastic
this means we now don't have authentication_realm present so we can't run those checks
getId and trackId are called from this route so this two can't run the ownership checks now - this last part was the one that i didn't get, but if i'm not mistaken this 2 functions are only used from that route so it makes sense now

i'm happy to give my approval as i think it makes sense, not sure if you prefer to have it also from Lukas

jeramysoucy

Kibana Security changed LGTM!

jeramysoucy · 2026-04-07T11:33:30Z

-        const user = getCurrentUser(request);
-        if (user?.roles.length === 0) {
-          this.logger.warn(
-            `A user authenticated with the "${user.authentication_realm.name}" (${user.authentication_realm.type}) realm doesn't have any roles and isn't authorized to perform request.`
-          );
-        }


Thanks!

Context: "With minimal auth, we won’t always have roles available, so this message will become more and more misleading when debugging issues."

walterra

datavis owned changes LGTM, just added some nit comments/considerations.

walterra · 2026-04-07T11:42:57Z

        },
+        authc: {
+          enabled: 'minimal',
+          reason: `This route is optimized for performant retrieval of data from Elasticsearch.`,


Absolute nit: This string should be find with regular single quotes '.

walterra · 2026-04-07T11:52:36Z


-    const session = await this.get(deps, user, sessionId);
+    // Skip user check for getId - called from minimal auth search route
+    const session = await this.get(deps, user, sessionId, true);


This looks fine for now, just a thought about possible future route that would use full auth also calling getId/trackId, they would silently skip the user check too. Is it worth hardening this down a bit more to avoid this slipping through in a future update?

walterra · 2026-04-07T11:52:54Z

+              queue[0].user,
+              sessionId,
+              { idMapping: batchedIdMapping },
+              true // Skip user check for trackId - called from minimal auth search route


This looks fine for now, just a thought about possible future route that would use full auth also calling getId/trackId, they would silently skip the user check too. Is it worth hardening this down a bit more to avoid this slipping through in a future update?

This is unlikely to happen, but I still think it's good feedback. I'll look at turning off this check from route instead of by default.

walterra · 2026-04-07T11:54:37Z

      });
+
+      it('works with minimal auth user (no authentication_realm access)', async () => {
+        const minimalAuthUser = new Proxy(


This could be moved to a shared factory at the top of the file to avoid code duplication.

walterra · 2026-04-07T11:54:45Z

      });
+
+      it('works with minimal auth user (no authentication_realm access)', async () => {
+        const minimalAuthUser = new Proxy(


This could be moved to a shared factory at the top of the file to avoid code duplication.

drewdaemon · 2026-04-07T17:06:22Z

@AlexGPlay

took me a bit to understand but i think now i get it, but let me go over it just in case:

Your understanding is correct!

i'm happy to give my approval as i think it makes sense, not sure if you prefer to have it also from Lukas

I'd like a review from both of you. I changed some things in d3ea63a, feel free to re-check.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

AlexGPlay

nice 😄

lukasolson

LGTM, just a couple of small comments below

lukasolson · 2026-04-10T22:57:18Z

    searchId: string,
-    options: ISearchOptions
+    options: ISearchOptions,
+    skipRealmCheck: boolean = false


Since trackId is always called with skipRealmCheck: true does it make sense to even have this parameter?

lol, well I got the opposite feedback above #257497 (comment)

lukasolson · 2026-04-10T22:58:00Z

    searchRequest: IKibanaSearchRequest,
-    { sessionId, isStored, isRestore, requestHash }: ISearchOptions
+    { sessionId, isStored, isRestore, requestHash }: ISearchOptions,
+    skipRealmCheck: boolean = false


Same question as above, isn't this always called with true now?

lukasolson · 2026-04-10T22:59:21Z

   * request can continue rather than restart.
   * @internal
   */
  public getId = async (


getId is called when restoring a search, so technically it's possible for them to get a search ID from another search session (in the rare case that they have the same username but different realms) but it shouldn't matter all that much because they still won't have access to the results from that ID.

elasticmachine · 2026-04-13T16:42:39Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: f384a3f

Failed CI Steps

FTR Configs #191

Test Failures

[job] [logs] FTR Configs #191 / console app console autocomplete feature ESQL queries does not suggest ESQL when inside non-query triple quotes

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`data`	2619	2621	+2

Unknown metric groups

API count

id	before	after	diff
`data`	3243	3245	+2

History

💛 Build #423511 was flaky b6353bb
💔 Build #423436 failed 84dda73

* commit '11ed3645c5ededae2a6e29f2a79b31f52208b441': (157 commits) remove sync register uiAction methods (elastic#254590) [performance] Apply minimal auth to the search route (elastic#257497) [ES|QL] Reports correctly the controls server side errors (elastic#263020) [SecuritySolution][Navigation] Enable classic nav updates (elastic#262358) [Inference] Use pretty name and logo on feature settings page (elastic#262531) [Security Solution] fix AT-AB cypress test (elastic#262991) [SigEvents] Seed sigevents env script (elastic#261172) Adjust conditions for validating no refetch for expanded row (elastic#262978) [Agent Builder] update copy for the announcement modal (elastic#263034) [Search] Hide index management links for users without privileges (elastic#262627) Simplify OAS schema for GET `/api/spaces/space` query params (elastic#260831) Fix fleet output OAS regressions: SSL type explosion and Kafka union wrappers (elastic#260842) [Dashboards in chat] fix agent confusing the axes in a horizontal chat (elastic#263064) [One Workflow] Add alert state checkbox UI for workflow connector (elastic#259770) [One Workflow] Deprecate legacy Cases step types in workflow authoring (elastic#262070) skip failing test suite (elastic#248090) fix flaky test: MonitorDetails filter apply button not enabled (elastic#260788) fix: propagate AbortSignal to executeAsReasoningAgent for task cancellation (elastic#262811) [Security Solution][Alert KPI] Fix white space bug in alert KPIs (elastic#260803) [Streams] Move helpers and format_size_unit to utils folder (elastic#262550) ... # Conflicts: # x-pack/platform/plugins/shared/dashboard_agent/public/attachment_types/canvas_integration/dashboard_canvas_content.test.tsx # x-pack/platform/plugins/shared/dashboard_agent/public/attachment_types/canvas_integration/dashboard_canvas_content.tsx # x-pack/platform/plugins/shared/dashboard_agent/public/attachment_types/canvas_integration/use_register_canvas_action_buttons.ts # x-pack/platform/plugins/shared/dashboard_agent/public/attachment_types/index.test.tsx # x-pack/platform/plugins/shared/dashboard_agent/public/attachment_types/index.tsx

azasypkin and others added 5 commits March 9, 2026 13:19

feat(security, authc): implement optional "minimal" authentication mode

2fd34a0

fix: #1

a11b5ff

feat(iteration #2): update all providers to use session instead of state

4d76173

minimal auth for the search route

069b265

skip flaky journey

16ba70c

azasypkin mentioned this pull request Mar 20, 2026

feat(security, authc): implement optional "minimal" authentication mode #251119

Merged

drewdaemon added 3 commits March 23, 2026 16:44

Merge branch 'main' of github.com:elastic/kibana into minimal-auth-da…

f6b28c0

…ta-plugin

Merge branch 'main' of github.com:elastic/kibana into minimal-auth-da…

6b2251d

…ta-plugin

Remove problematic log statement

c34791e

drewdaemon commented Apr 1, 2026

View reviewed changes

drewdaemon added 2 commits April 2, 2026 15:38

only check for user in session routes

37bb98c

update tests

84ada1b

drewdaemon commented Apr 2, 2026

View reviewed changes

drewdaemon changed the title ~~Minimal auth data plugin~~ Apply minimal auth to the search route Apr 2, 2026

drewdaemon marked this pull request as ready for review April 3, 2026 15:58

drewdaemon requested review from a team as code owners April 3, 2026 15:58

drewdaemon requested a review from jeramysoucy April 3, 2026 15:58

Merge branch 'main' into minimal-auth-data-plugin

555fb1d

drewdaemon added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Apr 3, 2026

drewdaemon changed the title ~~Apply minimal auth to the search route~~ [performance] Apply minimal auth to the search route Apr 3, 2026

drewdaemon added 2 commits April 6, 2026 09:05

Merge branch 'main' into minimal-auth-data-plugin

9d006d2

Merge branch 'main' into minimal-auth-data-plugin

2b46eb7

elastic deleted a comment from elasticmachine Apr 6, 2026

AlexGPlay approved these changes Apr 7, 2026

View reviewed changes

jeramysoucy approved these changes Apr 7, 2026

View reviewed changes

walterra approved these changes Apr 7, 2026

View reviewed changes

move skip config to the route, narrow the skip to just the realm

d3ea63a

macroscopeapp Bot reviewed Apr 7, 2026

View reviewed changes

Comment thread src/platform/plugins/shared/data/server/search/session/session_service.ts

drewdaemon requested a review from AlexGPlay April 7, 2026 17:06

capture realm check setting

84dda73

drewdaemon requested a review from lukasolson April 7, 2026 17:29

fix trackId test to include skipRealmCheck parameter

b6353bb

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

AlexGPlay approved these changes Apr 8, 2026

View reviewed changes

lukasolson approved these changes Apr 10, 2026

View reviewed changes

Merge branch 'main' into minimal-auth-data-plugin

440e0bf

drewdaemon enabled auto-merge (squash) April 11, 2026 02:20

drewdaemon disabled auto-merge April 11, 2026 02:21

Merge branch 'main' into minimal-auth-data-plugin

f384a3f

drewdaemon enabled auto-merge (squash) April 13, 2026 15:25

drewdaemon disabled auto-merge April 13, 2026 15:26

drewdaemon merged commit c92af98 into elastic:main Apr 14, 2026
19 checks passed

kibanamachine added the v9.5.0 label Apr 14, 2026

drewdaemon mentioned this pull request Apr 27, 2026

[data.search] optimize network activity in the data plugin #84923

Closed

Conversation

drewdaemon commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

drewdaemon Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlexGPlay left a comment

Choose a reason for hiding this comment

Uh oh!

jeramysoucy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

walterra left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

drewdaemon commented Apr 7, 2026

Uh oh!

AlexGPlay left a comment

Choose a reason for hiding this comment

Uh oh!

lukasolson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 13, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

API count

History

Uh oh!

drewdaemon commented Mar 12, 2026 •

edited

Loading

drewdaemon Apr 1, 2026 •

edited

Loading