feat(security,uiam): support both ES native and UIAM session tokens when in UIAM mode

[azasypkin]

Summary

During the transitional period and staged rollout, Kibana needs to be able to handle sessions using either UIAM or ES native access and refresh tokens, even when UIAM mode is enabled in Kibana. To achieve this, in addition to checking the UIAM configuration, Kibana also checks whether the access token returned by the Elasticsearch SAML realm starts with the well-known UIAM token prefix: essu_.

How to test

UIAM mode with UIAM tokens

Start both ES and Kibana in UIAM mode and check if you can log in.

$ yarn es serverless --projectType security --uiam
$ yarn start --serverless=security --uiam

UIAM mode with ES native tokens

Start only Kibana in UIAM mode and check if you can log in.

$ yarn es serverless --projectType security
$ yarn start --serverless=security --uiam

/cc @slobodanadamovic

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 5d080c1

Failed CI Steps

• FTR Configs #104

Metrics [docs]

✅ unchanged

History

• 💔 Build #368305 failed 2beb71a

cc @azasypkin

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)