[9.3] [Osquery] Fix profile_uid dropped in getUserInfo authc fallback (#258866)#259258
Merged
csr merged 5 commits intoelastic:9.3from Apr 1, 2026
Merged
[9.3] [Osquery] Fix profile_uid dropped in getUserInfo authc fallback (#258866)#259258csr merged 5 commits intoelastic:9.3from
profile_uid dropped in getUserInfo authc fallback (#258866)#259258csr merged 5 commits intoelastic:9.3from
Conversation
…lastic#258866) I'm working on adding Scout API tests (elastic#258534) and noticed that `created_by_profile_uid` and `updated_by_profile_uid` fields are absent from all Osquery API responses on ECH (Elastic Cloud Hosted), even though the authenticated user clearly has a `profile_uid` available. ## Test it yourself on ECH (dev console) Confirm the user has a `profile_uid`: ```bash GET kbn:/internal/security/me ``` This returns `{ "profile_uid": "u_..." }`. Now create a saved query and check the response keys: ```bash POST kbn:/api/osquery/saved_queries {"id":"profile-uid-test","query":"select 1;","interval":"3600"} ``` The `created_by_profile_uid` and `updated_by_profile_uid` fields are missing from the response on ECH. On local stateful they appear just fine. ## Hypothesis (LLM-assisted) `getUserInfo()` has two code paths for resolving user identity: 1. **Primary**: `userProfiles.getCurrent()` — returns `profile_uid` from the user profile service 2. **Fallback**: `authc.getCurrentUser()` — used when the primary fails or returns `null` The fallback hardcodes `profile_uid: null` instead of reading `user.profile_uid` from the `AuthenticatedUser` object (available since 2022, PR elastic#141092). On ECH (Elastic Cloud Hosted), `userProfiles.getCurrent()` returns `null`, so the fallback is always used. The hardcoded `null` then cascades through route handlers: - Converted to `undefined` via `?? undefined` - Stripped by `JSON.stringify` (packs) or `pickBy` (saved queries) ## Why didn't we spot this sooner and why Scout comes to the rescue The existing FTR API tests [[1](https://github.com/elastic/kibana/blob/main/x-pack/platform/test/api_integration/apis/osquery/saved_queries.ts#L90-L126)] [[2](https://github.com/elastic/kibana/blob/main/x-pack/platform/test/api_integration/apis/osquery/packs.ts#L191-L251)] covering this ground aren't run on ECH. Scout is designed to be [deployment-agnostic](https://www.elastic.co/docs/extend/kibana/scout/best-practices#design-tests-with-a-cloud-first-mindset), so we're easily able to run the same set of tests on different testing surfaces :-) (cherry picked from commit fe7e247) # Conflicts: # x-pack/platform/plugins/shared/osquery/server/lib/get_user_info.test.ts
csr
commented
Mar 24, 2026
| @@ -0,0 +1,97 @@ | |||
| /* | |||
Member
Author
There was a problem hiding this comment.
This test file was introduced in #249173 and doesn't exist on 9.3 (the PR wasn't backported). Is it OK if we introduce it in this backport PR? It adds coverage related to the change.
csr
requested review from
a team,
ashokaditya and
parkiino
and removed request for
a team
Member
Author
|
Osquery Serverless tests were failing but were recently disabled by #259898. Rebasing |
Contributor
💚 Build Succeeded
Metrics [docs]
History
|
szwarckonrad
approved these changes
Apr 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto9.3:profile_uiddropped ingetUserInfoauthc fallback (#258866)Questions ?
Please refer to the Backport tool documentation