search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.67k stars 8.23k forks source link

[Meta] Deprecating Exchange Online Basic Authentication #112151

Open YulNaumenko opened 3 years ago

YulNaumenko commented 3 years ago
  1. Initial issue was created by the community, based on the info from Microsoft about deprecating basic auth for exchange
  2. Based on the options, which Microsoft gave us for authenticating SMTP integration application, the next step was to do the research issue for supporting generic OAuth 2.0 Authorization Code flow. Based on that we created POC. In addition to the POC, we created RFC for supporting generic OAuth 2.0 Authorization Code flow across Kibana and the proper issues for implementation: #107898, #107846, #107847, #107918, #107904. Those was closed later in favor of the other approach.
  3. As an alternative to the implementing OAuth 2.0 Authorization Code flow, was done the research on the usage OAuth 2.0 Client Credentials flow, which is more server to server communication sufficient. The main Cons here is a stepping out of the current SMTP integration in favor of MS Exchange specific way of sending emails based on MS Graph API. Created POC
  4. Other OAuth 2.0 alternatives research:

Based on the comparison of the different research results, the team made the decision to move with implementing OAuth 2.0 Client Credentials flow and using MS Graph API for sending emails for MS Exchange Server service provider. Summary with pros and cons: https://github.com/elastic/kibana/issues/93466#issuecomment-914440697

In addition to the fixing cons about non-generic way of sending emails for MS Exchange, Microsoft has on the roadmap to add OAuth 2.0 Client Credentials support for SMTP integration.

For the selected approach opened next implementation issues:

elasticmachine commented 3 years ago

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)