[Response Ops][Connectors] New `xpack.actions.webhook.ssl.pfx.enabled` config by jcger · Pull Request #222507 · elastic/kibana

jcger · 2025-06-04T07:57:31Z

Summary

Closes #220416

Release note

New xpack.actions.webhook.ssl.pfx.enabled Kibana setting to disable Webhook connector PFX file support for SSL client authentication

…config-disable-ptx-files

elasticmachine · 2025-06-10T11:21:08Z

Pinging @elastic/response-ops (Team:ResponseOps)

kibanamachine · 2025-06-10T14:33:16Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8359

[✅] x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/webhook_disabled_ssl_pfx/config.ts: 100/100 tests passed.
[✅] x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts: 100/100 tests passed.

see run history

azasypkin

Changes in src/platform/test/plugin_functional/test_suites/core_plugins/rendering.ts LGTM.

That being said, maybe it's just me, but xpack.actions.webhook.ssl.pfx for a boolean config looks a bit confusing compared to something with an xxxEnabled or xxxSupported postfix, but I'll defer to the code owners 🙂

x-pack/platform/plugins/shared/actions/server/actions_config.test.ts

adcoelho · 2025-06-12T08:12:42Z

x-pack/platform/plugins/shared/stack_connectors/server/connector_types/webhook/index.ts

    );
  }
+
+  if (configObject.certType === SSLCertType.PFX) {


In the UI, the change was done in public/common/auth/ssl_cert_fields.tsx. That component is shared by all connectors that allow SSL authentication, so whenever the configuration option is set, it will not be visible. Not only for the webhook connector.

By chance, for now, the only connectors that allow SSL/PFX are the webhook connectors(cases webhook too).

On the other hand, in the backend, we validate specifically in server/connector_types/webhook/index.ts. If a connector is added or updated to allow SSL authentication, we will have to remember to copy this validation block there.

So, although the config option is webhook.ssl.pfx, in the FE we hide it everywhere, and in the BE we throw only for webhooks.

Even if the original ticket only mentions the webhook connector, wouldn't it make more sense to disallow PFX completely if the option is set?

We could move this validation somewhere else (maybe to action_executor.ts?), rename the configuration option to something like xpack.actions.ssl.pfx, and be done with it.

Thanks! To make it affect just the webhook connector I'm adding a prop isPfxEnabled to the AuthConfig component (this is shared by the cases-webhook and the webhook connectors). By default it's set to true and for the webhook connector it's gonna be set to the value of xpack.actions.webhook.ssl.pfx.

Asking if it also should affect cases-webhook. If it does, it's just activating that new prop

Edit: Got the answer, we won't add it to cases-webhook

x-pack/platform/plugins/shared/stack_connectors/server/connector_types/webhook/index.ts

x-pack/platform/plugins/shared/actions/public/plugin.ts

jcger · 2025-06-13T11:20:50Z

Changes in src/platform/test/plugin_functional/test_suites/core_plugins/rendering.ts LGTM.

That being said, maybe it's just me, but xpack.actions.webhook.ssl.pfx for a boolean config looks a bit confusing compared to something with an xxxEnabled or xxxSupported postfix, but I'll defer to the code owners 🙂

Thanks for the suggestion! We'll rename it to xpack.actions.webhook.ssl.pfx.enabled

adcoelho · 2025-06-16T13:28:47Z

...atform/plugins/shared/stack_connectors/public/connector_types/webhook/webhook_connectors.tsx

      </EuiFlexGroup>
      <EuiSpacer size="m" />
-      <AuthConfig readOnly={readOnly} />
+      <AuthConfig readOnly={readOnly} isPfxEnabled={isPfxEnabled} />


Yup, this is better now 🙌

nastasha-solomon

Just a couple minor fixes. Thanks for writing this!

docs/reference/configuration-reference/alerting-settings.md

docs/settings-gen/source/kibana-alert-action-settings.yml

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

kibanamachine · 2025-06-17T07:31:35Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15700987277

elasticmachine · 2025-06-17T07:32:06Z

💚 Build Succeeded

Buildkite Build
Commit: a88508e

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`actions`	334	335	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`stackConnectors`	624.5KB	624.9KB	+359.0B
`triggersActionsUi`	1.5MB	1.5MB	+58.0B
total			+417.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`actions`	16.7KB	16.9KB	+229.0B

Unknown metric groups

API count

id	before	after	diff
`actions`	340	341	+1

History

💚 Build #308292 succeeded aa039cb
💔 Build #308208 failed 758fd3e
💔 Build #307970 failed 2694031
💚 Build #307063 succeeded 30c49aa
💔 Build #306934 failed ac2029d
💔 Build #306622 failed d981181

kibanamachine · 2025-06-17T07:37:51Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts You might need to backport the following PRs to 8.19: - Fix that gap can be stuck "in-progress" (#221473) - [Response Ops][Alerting] Cannot read properties of undefined (reading 'getActiveCount') (#221799) - [Unzyme] rewrite a few enzyme tests to rtl (#223410) - [Discover] Fix `isLogsDataSourceContext` check for logs data source sub profiles (#223988) - [Maps] [A11y] make the Add layer wizard unordered list (#223532) - [Automatic Migration] Adds ability to change settings when re-processing Rule Migration (#222542) - [APM] Unified (APM/OTel) Trace waterfall (#222569) - 🌊 Streams: Prevent concurrent access (#222961) - [Discover] SCSS to Emotions migration part 3/4 (#222947) - chore(NA): bump sass-embedded version to v1.79.6 (#223995)

Manual backport

To create the backport manually run:

node scripts/backport --pr 222507

Questions ?

Please refer to the Backport tool documentation

jcger · 2025-06-17T08:35:41Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…` config (elastic#222507) ## Summary Closes elastic#220416 ## Release note New `xpack.actions.webhook.ssl.pfx.enabled` Kibana setting to disable Webhook connector PFX file support for SSL client authentication --------- Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> (cherry picked from commit 25b4f50) # Conflicts: # docs/reference/configuration-reference/alerting-settings.md # docs/settings-gen/source/kibana-alert-action-settings.yml

…enabled` config (#222507) (#224188)

Available since 9.1 - 8.19 - #223363 - #221389 - #221389 - #222507

…c#228215) Available since 9.1 - 8.19 - elastic#223363 - elastic#221389 - elastic#221389 - elastic#222507 (cherry picked from commit 39dda35)

…c#228215) Available since 9.1 - 8.19 - elastic#223363 - elastic#221389 - elastic#221389 - elastic#222507

first commit

999a7aa

This comment was marked as outdated.

Sign in to view

make the new provider conf optional

69fbd57

jcger force-pushed the issue-220416-kbn-config-disable-ptx-files branch from 21734de to 69fbd57 Compare June 4, 2025 17:01

jcger added 8 commits June 5, 2025 12:36

fix tests

6563e31

Merge branch 'main' into issue-220416-kbn-config-disable-ptx-files

b7dc42e

Merge branch 'main' into issue-220416-kbn-config-disable-ptx-files

431decf

create connector api rejects if pfx disabled

b12211c

add action_config mock fn

40a432b

Merge branch 'main' of github.com:jcger/kibana into issue-220416-kbn-…

57b197f

…config-disable-ptx-files

use i18 values

d981181

Merge branch 'main' of github.com:jcger/kibana into issue-220416-kbn-…

ac2029d

…config-disable-ptx-files

jcger marked this pull request as ready for review June 10, 2025 11:20

jcger requested review from a team as code owners June 10, 2025 11:20

jcger added Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v9.1.0 v8.19.0 labels Jun 10, 2025

jcger marked this pull request as draft June 10, 2025 13:42

remove unnecessesary config param

30c49aa

jcger marked this pull request as ready for review June 11, 2025 07:48

azasypkin approved these changes Jun 11, 2025

View reviewed changes

jbudz approved these changes Jun 11, 2025

View reviewed changes

adcoelho reviewed Jun 12, 2025

View reviewed changes

jcger requested a review from a team as a code owner June 13, 2025 09:11

jcger requested a review from adcoelho June 13, 2025 10:05

jcger changed the title ~~[Response Ops][Connectors] New xpack.actions.webhook.ssl.pfx config~~ Jun 13, 2025

jcger added 3 commits June 13, 2025 13:58

rename to xpack.actions.webhook.ssl.pfx.enabled

082d23b

fix functional test

aa039cb

Merge branch 'main' into issue-220416-kbn-config-disable-ptx-files

e38706e

adcoelho reviewed Jun 16, 2025

View reviewed changes

adcoelho approved these changes Jun 16, 2025

View reviewed changes

nastasha-solomon approved these changes Jun 16, 2025

View reviewed changes

docs/reference/configuration-reference/alerting-settings.md Outdated Show resolved Hide resolved

docs/reference/configuration-reference/alerting-settings.md Show resolved Hide resolved

docs/settings-gen/source/kibana-alert-action-settings.yml Outdated Show resolved Hide resolved

jcger and others added 4 commits June 17, 2025 08:00

Update docs/reference/configuration-reference/alerting-settings.md

692ba3d

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update docs/reference/configuration-reference/alerting-settings.md

da94d02

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update docs/settings-gen/source/kibana-alert-action-settings.yml

f165763

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Merge branch 'main' into issue-220416-kbn-config-disable-ptx-files

a88508e

jcger enabled auto-merge (squash) June 17, 2025 06:01

jcger merged commit 25b4f50 into elastic:main Jun 17, 2025
10 checks passed

jcger mentioned this pull request Jun 17, 2025

[8.19] [Response Ops][Connectors] New xpack.actions.webhook.ssl.pfx.enabled config (#222507) #224188

Merged

kibanamachine mentioned this pull request Jun 17, 2025

[Test retry service] Add initialDelay option #224156

Merged

jcger added a commit that referenced this pull request Jun 18, 2025

[8.19] [Response Ops][Connectors] New `xpack.actions.webhook.ssl.pfx.…

c4c6056

…enabled` config (#222507) (#224188)

jcger mentioned this pull request Jul 16, 2025

[Response Ops][Docs] Add missing actions settings in ECH docs #228215

Merged

jcger added a commit that referenced this pull request Jul 18, 2025

[Response Ops][Docs] Add missing actions settings in ECH docs (#228215)

39dda35

Available since 9.1 - 8.19 - #223363 - #221389 - #221389 - #222507

Bluefinger pushed a commit to Bluefinger/kibana that referenced this pull request Jul 22, 2025

[Response Ops][Docs] Add missing actions settings in ECH docs (elasti…

8323742

…c#228215) Available since 9.1 - 8.19 - elastic#223363 - elastic#221389 - elastic#221389 - elastic#222507

kertal pushed a commit to kertal/kibana that referenced this pull request Jul 25, 2025

[Response Ops][Docs] Add missing actions settings in ECH docs (elasti…

49e0e69

…c#228215) Available since 9.1 - 8.19 - elastic#223363 - elastic#221389 - elastic#221389 - elastic#222507

florent-leborgne added a commit to florent-leborgne/kibana that referenced this pull request Jul 25, 2025

Missed applies_to in elastic#222507

0060155

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Response Ops][Connectors] New `xpack.actions.webhook.ssl.pfx.enabled` config#222507

[Response Ops][Connectors] New `xpack.actions.webhook.ssl.pfx.enabled` config#222507
jcger merged 21 commits intoelastic:mainfrom
jcger:issue-220416-kbn-config-disable-ptx-files

jcger commented Jun 4, 2025 •

edited by kibanamachine

Loading

This comment was marked as outdated.

elasticmachine commented Jun 10, 2025

kibanamachine commented Jun 10, 2025

azasypkin left a comment

Uh oh!

adcoelho Jun 12, 2025

jcger Jun 13, 2025 •

edited

Loading

Uh oh!

Uh oh!

jcger commented Jun 13, 2025

adcoelho Jun 16, 2025

nastasha-solomon left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kibanamachine commented Jun 17, 2025

elasticmachine commented Jun 17, 2025

API count

kibanamachine commented Jun 17, 2025

jcger commented Jun 17, 2025

Labels

7 participants

Conversation

jcger commented Jun 4, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release note

This comment was marked as outdated.

elasticmachine commented Jun 10, 2025

kibanamachine commented Jun 10, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8359

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

adcoelho Jun 12, 2025

Choose a reason for hiding this comment

jcger Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jcger commented Jun 13, 2025

adcoelho Jun 16, 2025

Choose a reason for hiding this comment

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kibanamachine commented Jun 17, 2025

elasticmachine commented Jun 17, 2025

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Async chunks

Page load bundle

API count

History

kibanamachine commented Jun 17, 2025

💔 All backports failed

Manual backport

Questions ?

jcger commented Jun 17, 2025

💚 All backports created successfully

Questions ?

Labels

7 participants

jcger commented Jun 4, 2025 •

edited by kibanamachine

Loading

jcger Jun 13, 2025 •

edited

Loading