[Breaking change] Provide sensible defaults for xpack.security.session.{lifespan|idleTimeout}

[legrego]

Change description

Which release will ship the breaking change?

8.0

Describe the change. How will it manifest to users?

When security is enabled, the default behavior is to create sessions without an idle timeout or a lifetime. This means that once a user is logged in, their session will remain active until they manually log out, or clear their browser session.

As discussed in #68885, we would like to change the default configuration to provide sensible defaults so that all sessions will have both an idle timeout and a lifespan.

How many users will be affected?

Users who do not specify their own xpack.security.session.idleTimeout or xpack.security.session.lifespan will suddenly find themselves with our defaults applied. If they wish to restore the existing behavior, then they will need to adjust their kibana.yml manually.

What can users do to address the change manually?

Update their kibana.yml to adjust the session timeout/lifespan

How could we make migration easier with the Upgrade Assistant?

I don't think this is something that warrants a custom UI, but having the deprecation warning appear in the UA would be beneficial.

Are there any edge cases?

Test Data

Provide test data. We can’t build a solution without data to test it against.

Cross links

Cross-link to relevant Elasticsearch breaking changes.

• Original Kibana issue: Provide sensible defaults for xpack.security.session.{lifespan|idleTimeout} #68885

[elasticmachine]

Pinging @elastic/es-ui (Team:Elasticsearch UI)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[alisonelizabeth]

I'm going to remove the Elasticsearch UI team label. This deprecation should be registered by the plugin owner via the core deprecations service (#94845). All registered deprecations will be displayed in the Upgrade Assistant (to be implemented via #97159). Feel free to reach out to myself or the core team with any questions!

[legrego]

Resolved via #106061