Add origin configuration to authc providers by rgodfrey-elastic · Pull Request #239993 · elastic/kibana

rgodfrey-elastic · 2025-10-21T21:13:22Z

Summary

Added origin configuration to authc providers.
Changed login form to hide providers based on the origin configuration and the current browser window origin.
Filtered providers on the back end based on the origin header and the configured provider origin properties.
Origin configuration is optional and can be one value or an array of values.
All values provided in the origin config must be a valid URI
An error is displayed in the UI if there are no valid auth providers for the domain

Example 1

xpack.security.authc.providers:
  basic.basic1:
    order: 0
    origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com]
  saml.saml1:
    order: 1
    realm: saml1
    origin: http://127.0.0.1:5601
  saml.saml2:
    order: 2
    realm: saml2
    origin: http://localhost:5601
  saml.saml3:
    order: 3
    realm: saml3
    origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com]
  saml.saml4:
    order: 4
    realm: saml4

Example 2

xpack.security.authc.providers:
  basic.basic1:
    order: 0
    origin: [http://127.0.0.1:5601, https://elastic.com]
  saml.saml1:
    order: 1
    realm: saml1
    origin: https://elastic.com

Release Notes

Adds the ability to specify the origin(s) where an authentication provider will appear to users in the Login Selector UI.

github-actions · 2025-10-21T21:15:35Z

🔍 Preview links for changed docs

docs/reference/configuration-reference/security-settings.md

…filter available providers based on the origin configuration and the current browser window origin. Also filtered available providers based on the origin header and the configured provider origin properties # Conflicts: # x-pack/platform/plugins/shared/security/server/authentication/authenticator.ts

…ge message to use translate function

…no-cache --fix'

….com:rgodfrey-elastic/kibana into feature/add-origin-config-to-authc-providers

elasticmachine · 2025-10-28T12:29:16Z

Pinging @elastic/kibana-security (Team:Security)

docs/reference/configuration-reference/security-settings.md

Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

azasypkin · 2025-10-30T14:50:13Z

ACK: will review later today or tomorrow, sorry for the delay!

azasypkin

Great job! I've left just a few questions and nits.

...orm/plugins/shared/security/public/authentication/login/components/login_form/login_form.tsx

...lugins/shared/security/public/authentication/login/components/login_form/login_form.test.tsx

x-pack/platform/plugins/shared/security/server/authentication/providers/base.ts

x-pack/platform/plugins/shared/security/server/config.ts

x-pack/platform/plugins/shared/security/server/config.test.ts

x-pack/platform/plugins/shared/security/server/routes/views/login.ts

x-pack/platform/plugins/shared/security/server/authentication/authenticator.ts

x-pack/platform/test/security_functional/login_selector.config.ts

docs/reference/configuration-reference/security-settings.md

...lugins/shared/security/public/authentication/login/components/login_form/login_form.test.tsx

rgodfrey-elastic · 2025-11-04T20:52:04Z

@elasticmachine merge upstream

azasypkin

LGTM, tested locally - everything works as expected, thanks! Would you also mind updating the Release Notes section in the issue description to better align with your updates in the doc (these are being used to compile release notes for every release)?

docs/reference/configuration-reference/security-settings.md

x-pack/platform/plugins/shared/security/server/config.ts

...lugins/shared/security/public/authentication/login/components/login_form/login_form.test.tsx

docs/reference/configuration-reference/security-settings.md

...lugins/shared/security/public/authentication/login/components/login_form/login_form.test.tsx

rgodfrey-elastic · 2025-11-05T18:43:24Z

@elasticmachine merge upstream

elasticmachine · 2025-11-05T20:17:03Z

💚 Build Succeeded

Buildkite Build
Commit: 3056036

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`security`	486.5KB	487.1KB	+638.0B

History

💚 Build #358653 succeeded 352ea5a
💛 Build #358319 was flaky c895205
💔 Build #358290 failed f69e2d5
💔 Build #358214 failed 069cc4c
💚 Build #355491 succeeded 07a2170
💔 Build #355289 failed 8c1578d

cc @rgodfrey-elastic

florent-leborgne

Docs LGTM, thanks!

Closes [109525](elastic#109525) ## Summary - Added origin configuration to authc providers. - Changed login form to hide providers based on the origin configuration and the current browser window origin. - Filtered providers on the back end based on the origin header and the configured provider origin properties. - Origin configuration is optional and can be one value or an array of values. - All values provided in the origin config must be a valid URI - An error is displayed in the UI if there are no valid auth providers for the domain ### Example 1 ``` xpack.security.authc.providers: basic.basic1: order: 0 origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com] saml.saml1: order: 1 realm: saml1 origin: http://127.0.0.1:5601 saml.saml2: order: 2 realm: saml2 origin: http://localhost:5601 saml.saml3: order: 3 realm: saml3 origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com] saml.saml4: order: 4 realm: saml4 ``` <img width="735" height="585" alt="image" src="https://github.com/user-attachments/assets/d691f692-6470-4d59-aba1-bc598b4b49a2" /> <img width="725" height="597" alt="image" src="https://github.com/user-attachments/assets/28a61462-ef00-484f-b2c9-1816bc50fc54" /> ### Example 2 ``` xpack.security.authc.providers: basic.basic1: order: 0 origin: [http://127.0.0.1:5601, https://elastic.com] saml.saml1: order: 1 realm: saml1 origin: https://elastic.com ``` <img width="772" height="443" alt="image" src="https://github.com/user-attachments/assets/9c332a42-2a48-43ea-b4c5-0d9ab6660b6a" /> ## Release Notes Adds the ability to specify the origin(s) where an authentication provider will appear to users in the Login Selector UI. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: florent-leborgne <florent.leborgne@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

## Summary Added note about new `origin` setting available for authentication providers added with elastic/kibana#239993

Closes [109525](elastic#109525) ## Summary - Added origin configuration to authc providers. - Changed login form to hide providers based on the origin configuration and the current browser window origin. - Filtered providers on the back end based on the origin header and the configured provider origin properties. - Origin configuration is optional and can be one value or an array of values. - All values provided in the origin config must be a valid URI - An error is displayed in the UI if there are no valid auth providers for the domain ### Example 1 ``` xpack.security.authc.providers: basic.basic1: order: 0 origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com] saml.saml1: order: 1 realm: saml1 origin: http://127.0.0.1:5601 saml.saml2: order: 2 realm: saml2 origin: http://localhost:5601 saml.saml3: order: 3 realm: saml3 origin: [http://127.0.0.1:5601, http://localhost:5601, https://elastic.com] saml.saml4: order: 4 realm: saml4 ``` <img width="735" height="585" alt="image" src="https://github.com/user-attachments/assets/d691f692-6470-4d59-aba1-bc598b4b49a2" /> <img width="725" height="597" alt="image" src="https://github.com/user-attachments/assets/28a61462-ef00-484f-b2c9-1816bc50fc54" /> ### Example 2 ``` xpack.security.authc.providers: basic.basic1: order: 0 origin: [http://127.0.0.1:5601, https://elastic.com] saml.saml1: order: 1 realm: saml1 origin: https://elastic.com ``` <img width="772" height="443" alt="image" src="https://github.com/user-attachments/assets/9c332a42-2a48-43ea-b4c5-0d9ab6660b6a" /> ## Release Notes Adds the ability to specify the origin(s) where an authentication provider will appear to users in the Login Selector UI. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: florent-leborgne <florent.leborgne@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

rgodfrey-elastic self-assigned this Oct 21, 2025

rgodfrey-elastic added 3 commits October 24, 2025 15:27

Updated security settings for new origin setting and updated login pa…

feff385

…ge message to use translate function

added tests for origin config changes

34bb5d3

rgodfrey-elastic force-pushed the feature/add-origin-config-to-authc-providers branch from 37fa181 to 34bb5d3 Compare October 24, 2025 19:40

rgodfrey-elastic added enhancement New value added to drive a business result release_note:enhancement Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// labels Oct 24, 2025

rgodfrey-elastic linked an issue Oct 24, 2025 that may be closed by this pull request

Limit authentication providers based on hostname #109525

Closed

rgodfrey-elastic added Feature:Security/Authentication Platform Security - Authentication backport:skip This PR does not require backporting labels Oct 24, 2025

kibanamachine and others added 4 commits October 24, 2025 20:51

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

e5bb791

…no-cache --fix'

added integration tests for auth provider origin config

d047e40

Merge branch 'feature/add-origin-config-to-authc-providers' of github…

8c1578d

….com:rgodfrey-elastic/kibana into feature/add-origin-config-to-authc-providers

added config tests for new origin property. fixed merge conflict error

07a2170

rgodfrey-elastic marked this pull request as ready for review October 28, 2025 12:29

rgodfrey-elastic requested review from a team as code owners October 28, 2025 12:29

florent-leborgne reviewed Oct 28, 2025

View reviewed changes

docs/reference/configuration-reference/security-settings.md Outdated Show resolved Hide resolved

legrego requested a review from azasypkin October 29, 2025 10:58

Add applies_to version to security-settings documentation

fdbf917

Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

azasypkin reviewed Oct 31, 2025

View reviewed changes

addressed PR comments

069cc4c

rgodfrey-elastic commented Nov 4, 2025

View reviewed changes

...lugins/shared/security/public/authentication/login/components/login_form/login_form.test.tsx Outdated Show resolved Hide resolved

reverted back end tests for authenticator origin config

f69e2d5

Merge branch 'main' into feature/add-origin-config-to-authc-providers

c895205

azasypkin self-requested a review November 5, 2025 14:35

moved no origin message declaration inside login form class

352ea5a

azasypkin approved these changes Nov 5, 2025

View reviewed changes

rgodfrey-elastic mentioned this pull request Nov 5, 2025

added note about origin setting for authentication providers elastic/docs-content#3827

Merged

reworded documentation update. removed unneeded try catch

24a3152

Merge branch 'main' into feature/add-origin-config-to-authc-providers

3056036

rgodfrey-elastic requested a review from florent-leborgne November 5, 2025 20:21

florent-leborgne approved these changes Nov 6, 2025

View reviewed changes

rgodfrey-elastic merged commit f7a755a into elastic:main Nov 6, 2025
12 checks passed

rgodfrey-elastic deleted the feature/add-origin-config-to-authc-providers branch November 6, 2025 13:35

kibanamachine added the v9.3.0 label Nov 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add origin configuration to authc providers#239993

Add origin configuration to authc providers#239993
rgodfrey-elastic merged 14 commits intoelastic:mainfrom
rgodfrey-elastic:feature/add-origin-config-to-authc-providers

rgodfrey-elastic commented Oct 21, 2025 •

edited

Loading

github-actions bot commented Oct 21, 2025 •

edited

Loading

elasticmachine commented Oct 28, 2025

Uh oh!

azasypkin commented Oct 30, 2025

azasypkin left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic commented Nov 4, 2025

azasypkin left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic commented Nov 5, 2025

elasticmachine commented Nov 5, 2025

florent-leborgne left a comment

Uh oh!

Labels

5 participants

Conversation

rgodfrey-elastic commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Example 1

Example 2

Release Notes

github-actions bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

elasticmachine commented Oct 28, 2025

Uh oh!

azasypkin commented Oct 30, 2025

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic commented Nov 4, 2025

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic commented Nov 5, 2025

elasticmachine commented Nov 5, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

History

florent-leborgne left a comment

Choose a reason for hiding this comment

Uh oh!

Labels

5 participants

rgodfrey-elastic commented Oct 21, 2025 •

edited

Loading

github-actions bot commented Oct 21, 2025 •

edited

Loading