[Connectors] implement support for proxy-authorization by pmuellr · Pull Request #258443 · elastic/kibana

pmuellr · 2026-03-18T20:17:55Z

Release Note

Adds support for proxy-authorization for connectors with Kibana config settings xpack.actions.proxyUser and xpack.actions.proxyPassword.

Summary

Initial commit generated with Cursor

cursor prompt

Add two new Kibana config settings, xpack.actions.proxyUser and xpack.actions.proxyPassword in the actions plugin. These will be for the authentication of the proxy itself. The file src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker should be updated with these config values. The documentation docs/reference/configuration-reference/alerting-settings.md should be updated. These values should be used when the axios code in the actions plugin, when a proxy is used and has these values set. Jest unit tests should be added. Function tests should be added.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

resolves elastic#106770 Initial commit generated with Cursor <details><summary>cursor prompt</summary> Add two new Kibana config settings, `xpack.actions.proxyUser` and `xpack.actions.proxyPassword` in the actions plugin. These will be for the authentication of the proxy itself. The file `src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker` should be updated with these config values. The documentation `docs/reference/configuration-reference/alerting-settings.md` should be updated. These values should be used when the axios code in the actions plugin, when a proxy is used and has these values set. Jest unit tests should be added. Function tests should be added. </details>

github-actions · 2026-03-18T20:19:54Z

🔍 Preview links for changed docs

docs/reference/configuration-reference/alerting-settings.md

github-actions · 2026-03-18T20:20:36Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

pmuellr · 2026-03-24T20:58:58Z

+  );
+  let proxyAuth: string | undefined;
+  if (hasUrlAuth) {
+    proxyAuth = `${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`;


I was surprised to learn that the username/password from URL are encoded!

$ node -p 'new URL("https://elas<tic:changeme@example.com")' URL { ... username: 'elas%3Ctic', ... }

pmuellr · 2026-03-24T21:17:38Z

+    const withAuth = new URL(proxySettings.proxyUrl);
+    withAuth.username = proxySettings.proxyUser as string;
+    withAuth.password = proxySettings.proxyPassword as string;
+    httpProxyAgentUrl = withAuth.toString();


This adds the auth info to the URL. Which the http agents we use check for explicitly (I don't remember them doing that when we first started using it), and send the appropriate auth headers for.

You'll also see we set the auth option for the HttpsProxyAgent, to the same value. It looks like the HttpProxyAgent also accepts options now (I think it didn't use to, except maybe timeout?). So seems like these should be aligned.

Yeah, should we align them with this PR?
Because proxyAuth is decoded but httpProxyAgentUrl is not, they may send different credentials.

pmuellr · 2026-03-25T22:33:32Z

As of commit 00c13ed, I've tested the proxy code with mitmproxy - nice tool. Configured it for http proxy with auth, created a webhook pointed to GET kibana's root URL, everything seemed to work as expected, traced it via VSCode debugging.

Just got to get the FT working ...

elasticmachine · 2026-03-30T13:55:06Z

Pinging @elastic/response-ops (Team:ResponseOps)

elasticmachine · 2026-03-30T14:57:02Z

💔 Build Failed

Buildkite Build
Commit: 64d2234

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #8 / getColumns rule column renders rule name as a PreviewLink when hidePreviewLink is false
[job] [logs] Jest Tests #8 / getColumns rule column renders rule name as a PreviewLink when hidePreviewLink is false
[job] [logs] Jest Tests #8 / getColumns rule column renders rule name as plain text when user cannot read rules
[job] [logs] Jest Tests #8 / getColumns rule column renders rule name as plain text when user cannot read rules

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/actions-utils`	26	27	+1
`@kbn/alerting-api-integration-helpers`	28	29	+1
total			+2

Any counts in public APIs

Total count of every any typed public API. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats any for more detailed information.

id	before	after	diff
`@kbn/alerting-api-integration-helpers`	3	1	-2

Unknown metric groups

API count

id	before	after	diff
`@kbn/actions-utils`	26	28	+2
`@kbn/alerting-api-integration-helpers`	28	29	+1
total			+3

ESLint disabled line counts

id	before	after	diff
`@kbn/alerting-api-integration-helpers`	0	2	+2

Total ESLint disabled count

id	before	after	diff
`@kbn/alerting-api-integration-helpers`	0	2	+2

History

florent-leborgne

LGTM for docs - just some quick additions needed to specify the version in which these become available

florent-leborgne · 2026-03-31T16:07:35Z


+$$$action-config-proxy-user$$$
+
+`xpack.actions.proxyUser` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')


Suggested change

`xpack.actions.proxyUser` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')

`xpack.actions.proxyUser` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}') {applies_to}`stack: ga 9.4+`

florent-leborgne · 2026-03-31T16:07:48Z

+
+$$$action-config-proxy-password$$$
+
+`xpack.actions.proxyPassword` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')


Suggested change

`xpack.actions.proxyPassword` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')

`xpack.actions.proxyPassword` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}') {applies_to}`stack: ga 9.4+`

florent-leborgne · 2026-03-31T16:08:04Z

    If your proxy is using the https protocol (vs the http protocol), the setting `xpack.actions.ssl.proxyVerificationMode: none` will likely be needed, unless your proxy’s certificates are signed using a publicly available certificate authority.

-    There is currently no support for using basic authentication with a proxy (authentication for the proxy itself, not the URL being requested through the proxy).
+    You can supply proxy credentials in the URL (`http://user:password@proxy-host:8080`) or use [`xpack.actions.proxyUser`](#action-config-proxy-user) and [`xpack.actions.proxyPassword`](#action-config-proxy-password). If the URL already includes a username and password, those take precedence over the separate settings.


Suggested change

You can supply proxy credentials in the URL (`http://user:password@proxy-host:8080`) or use [`xpack.actions.proxyUser`](#action-config-proxy-user) and [`xpack.actions.proxyPassword`](#action-config-proxy-password). If the URL already includes a username and password, those take precedence over the separate settings.

{applies_to}`stack: ga 9.4+` You can supply proxy credentials in the URL (`http://user:password@proxy-host:8080`) or use [`xpack.actions.proxyUser`](#action-config-proxy-user) and [`xpack.actions.proxyPassword`](#action-config-proxy-password). If the URL already includes a username and password, those take precedence over the separate settings.

ersin-erdal

Overall looks good but I asked some question, if we think they are OK or we can address with separate PRs I can approve.

ersin-erdal · 2026-04-01T15:57:32Z

    headers: proxySettings.proxyHeaders,
-    ...(proxyUrl.username &&
-      proxyUrl.password && { auth: `${proxyUrl.username}:${proxyUrl.password}` }),
+    ...(proxyAuth && { auth: proxyAuth }),


Could this be a breaking change for the existing users if they have special characters in their creds?

ersin-erdal · 2026-04-01T16:18:58Z

+    proxySettings.proxyUser &&
+      proxySettings.proxyPassword &&
+      proxySettings.proxyUser !== '' &&
+      proxySettings.proxyPassword !== ''


Nit: Boolean('') is already false.

ersin-erdal · 2026-04-01T16:22:37Z

+      expect(proxyAuthHeader).to.eql(BasicAuthHeader);
+    });
+  });
+}


Maybe a negative test too?

ersin-erdal · 2026-04-01T16:25:56Z

+      proxyServer.web(req, res);
+    });
+    server.listen(proxyPort);
+    return server as unknown as httpProxy;


Would changing the return type to httpProxy | http.Server fix this?

ersin-erdal · 2026-04-01T16:45:50Z

+    const withAuth = new URL(proxySettings.proxyUrl);
+    withAuth.username = proxySettings.proxyUser as string;
+    withAuth.password = proxySettings.proxyPassword as string;
+    httpProxyAgentUrl = withAuth.toString();


Yeah, should we align them with this PR?
Because proxyAuth is decoded but httpProxyAgentUrl is not, they may send different credentials.

pmuellr · 2026-06-23T14:15:21Z

We have another proxy package upgrade in the works, so will pick this up again when it merges: #267282

florent-leborgne · 2026-07-27T17:40:41Z

Not moving, turning into draft to stop getting the review reminders

pmuellr · 2026-09-15T14:05:29Z

Support for this was added in #256491 , and there is still a doc issue open to document the new capability: elastic/docs-content#5731 (comment)

pmuellr commented Mar 24, 2026

View reviewed changes

pmuellr and others added 3 commits March 24, 2026 20:38

fix function tests

3199152

Merge branch 'main' into 106770-proxy-auth

38f46f6

Changes from node scripts/lint.js --fix

00c13ed

pmuellr added 6 commits March 25, 2026 23:35

got the FT working

307e3c0

merge main, fix conflicts, however, now the new test breaks :-(

9efc7ba

get FT working again

943fc92

remove .only on FT

fb3e499

Merge branch 'main' into 106770-proxy-auth

2e6691b

fix FT

64d2234

pmuellr marked this pull request as ready for review March 30, 2026 13:53

pmuellr requested review from a team as code owners March 30, 2026 13:53

pmuellr added Feature:Actions Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// release_note:feature Makes this part of the condensed release notes backport:all-open Backport to all branches that could still receive a release labels Mar 30, 2026

jbudz approved these changes Mar 30, 2026

View reviewed changes

Merge branch 'main' into 106770-proxy-auth

5503818

florent-leborgne reviewed Mar 31, 2026

View reviewed changes

darnautov requested a review from ersin-erdal April 1, 2026 09:02

ersin-erdal reviewed Apr 1, 2026

View reviewed changes

nastasha-solomon mentioned this pull request Apr 7, 2026

[Internal]: Document basic authentication support for xpack.actions.proxyUrl elastic/docs-content#5731

Open

florent-leborgne marked this pull request as draft July 27, 2026 17:40

bmorelli25 mentioned this pull request Aug 5, 2026

[Q1 Release] Kibana 9.5 Analytics and Platform updates elastic/docs-content#4835

Closed

79 tasks

pmuellr closed this Sep 15, 2026


		$$$action-config-proxy-user$$$

		`xpack.actions.proxyUser` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')


		$$$action-config-proxy-password$$$

		`xpack.actions.proxyPassword` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg 'Supported on {{ech}}')

	You can supply proxy credentials in the URL (`http://user:password@proxy-host:8080`) or use [`xpack.actions.proxyUser`](#action-config-proxy-user) and [`xpack.actions.proxyPassword`](#action-config-proxy-password). If the URL already includes a username and password, those take precedence over the separate settings.
	{applies_to}`stack: ga 9.4+` You can supply proxy credentials in the URL (`http://user:password@proxy-host:8080`) or use [`xpack.actions.proxyUser`](#action-config-proxy-user) and [`xpack.actions.proxyPassword`](#action-config-proxy-password). If the URL already includes a username and password, those take precedence over the separate settings.

Uh oh!

Conversation

pmuellr commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Note

Summary

Checklist

Uh oh!

github-actions Bot commented Mar 18, 2026

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Mar 18, 2026

✅ Vale Linting Results

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmuellr Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmuellr commented Mar 25, 2026

Uh oh!

elasticmachine commented Mar 30, 2026

Uh oh!

elasticmachine commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

Any counts in public APIs

API count

ESLint disabled line counts

Total ESLint disabled count

History

Uh oh!

florent-leborgne left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ersin-erdal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmuellr commented Jun 23, 2026

Uh oh!

florent-leborgne commented Jul 27, 2026

Uh oh!

pmuellr commented Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

pmuellr commented Mar 18, 2026 •

edited

Loading

pmuellr Mar 24, 2026 •

edited

Loading

elasticmachine commented Mar 30, 2026 •

edited

Loading