[Breaking change] New format for the authentication config

[azasypkin]

Change description

Which release will ship the breaking change?

8.0 (Edit Joe 9/1/21: this is deprecated but we are not sure when we will get rid of it)

Describe the change. How will it manifest to users?

In 8.0 we dropped support for xpack.security.authProviders and xpack.security.public settings and going to drop xpack.security.authc.{saml | oidc}.realm and remove support for the legacy array-based format for xpack.security.authc.providers. The reason is that we need to promote the new config format a bit more aggressively as it's required for lots of new features we ship or going to ship (e.g. Cloud SSO won't be enabled automatically if the old config format is used).

If users continue to use the old settings then config validation will fail and Kibana won't start.

How many users will be affected?

Quite a lot. I still see people use 6.x format in the recent 7.x deployments.

What can users do to address the change manually?

Just migrate to a new format, we have a good explanation in our docs.

How could we make migration easier with the Upgrade Assistant?

It's easy to check if anything deprecated is used and how it should look like in the new format. We can either point users to the docs or even do the conversion job for them and provide a config snippet they should use instead.

Cross links

• PR that dropped xpack.security.authProviders and xpack.security.public. Edit Joe 9/1/21: this is not the correct PR, but: these have been removed in master, so we need to add them back in master
• Issue to forbid old format for xpack.security.authc.providers

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[elasticmachine]

Pinging @elastic/es-ui (Team:Elasticsearch UI)

[alisonelizabeth]

Hi @azasypkin! I'm going to remove the Elasticsearch UI team label. The Upgrade Assistant/ES UI team will no longer be responsible for adding individual deprecation logic. Please consider using the deprecations service (#94845) provided by core to register this deprecation instead. All registered deprecations will be displayed in the Upgrade Assistant (to be implemented via #97159). Feel free to reach out to myself or the core team with any questions!

[azasypkin]

Great, thanks for the update @alisonelizabeth !

[legrego]

Closing as we have no immediate plans on removing the legacy configuration. We can open this back up if we plan on revisiting this decision

[jhguo93]

xpack.security.public:
hostname: link-to-elastic-cloud.com
port: 443
protocol: https

Hello there, we had the above config in Kibana and they are deprecated. I have been reading this doc but it did not mention the change for this config. Can you help me? Thanks

[azasypkin]

Hi @jhguo93,

The GitHub issues are intended for bug reports, enhancement requests and etc. The question you have fits better for our Discuss forum, would you mind posting your question there instead? There much more users like you that can help and probably already solved the problem you have.

But, in general, you don't need xpack.security.public anymore as long as you specify realm name in Kibana config: https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#saml