diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts index 19378bfd8488b..dbefcc8be670a 100644 --- a/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts +++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts @@ -26,6 +26,7 @@ describe('Security UsageCollector', () => { allowAccessAgreement = true, allowAuditLogging = true, allowRbac = true, + allowFips = true, isLicenseAvailable, }: Partial & { isLicenseAvailable: boolean }) => { const license = licenseMock.create(); @@ -34,6 +35,7 @@ describe('Security UsageCollector', () => { allowAccessAgreement, allowAuditLogging, allowRbac, + allowFips, } as SecurityLicenseFeatures); return license; }; @@ -44,6 +46,7 @@ describe('Security UsageCollector', () => { accessAgreementEnabled: false, authProviderCount: 1, enabledAuthProviders: ['basic'], + fipsModeEnabled: false, loginSelectorEnabled: false, httpAuthSchemes: ['apikey', 'bearer'], sessionIdleTimeoutInMinutes: 4320, @@ -104,6 +107,7 @@ describe('Security UsageCollector', () => { expect(usage).toEqual({ auditLoggingEnabled: false, accessAgreementEnabled: false, + allowFips: false, authProviderCount: 0, enabledAuthProviders: [], loginSelectorEnabled: false, @@ -426,6 +430,55 @@ describe('Security UsageCollector', () => { }); }); + describe('fipsMode enabled', () => { + it('reports when fipsMode is enabled', async () => { + const config = createSecurityConfig( + ConfigSchema.validate({ + fipsMode: { + enabled: true, + }, + }) + ); + const usageCollection = usageCollectionPluginMock.createSetupContract(); + const license = createSecurityLicense({ + isLicenseAvailable: true, + allowFips: true, + }); + registerSecurityUsageCollector({ usageCollection, config, license }); + + const usage = await usageCollection + .getCollectorByType('security') + ?.fetch(collectorFetchContext); + + expect(usage).toEqual({ + ...DEFAULT_USAGE, + fipsModeEnabled: true, + }); + }); + + it('does not report fipsMode when the license does not permit it', async () => { + const config = createSecurityConfig( + ConfigSchema.validate({ + fipsMode: { + enabled: true, + }, + }) + ); + const usageCollection = usageCollectionPluginMock.createSetupContract(); + const license = createSecurityLicense({ isLicenseAvailable: true, allowFips: false }); + registerSecurityUsageCollector({ usageCollection, config, license }); + + const usage = await usageCollection + .getCollectorByType('security') + ?.fetch(collectorFetchContext); + + expect(usage).toEqual({ + ...DEFAULT_USAGE, + fipsModeEnabled: false, + }); + }); + }); + describe('http auth schemes', () => { it('reports customized http auth schemes', async () => { const config = createSecurityConfig( diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts index fc761fb13a50e..1a099eb17bb6d 100644 --- a/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts +++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts @@ -93,6 +93,12 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens }, }, }, + fipsModeEnabled: { + type: 'boolean', + _meta: { + description: 'Indicates if Kibana is being run in FIPS mode.', + }, + }, httpAuthSchemes: { type: 'array', items: { @@ -139,7 +145,8 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens }, }, fetch: () => { - const { allowRbac, allowAccessAgreement, allowAuditLogging } = license.getFeatures(); + const { allowRbac, allowAccessAgreement, allowAuditLogging, allowFips } = + license.getFeatures(); if (!allowRbac) { return { auditLoggingEnabled: false, @@ -147,6 +154,7 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens accessAgreementEnabled: false, authProviderCount: 0, enabledAuthProviders: [], + allowFips: false, httpAuthSchemes: [], sessionIdleTimeoutInMinutes: 0, sessionLifespanInMinutes: 0, @@ -171,6 +179,8 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens WELL_KNOWN_AUTH_SCHEMES.includes(scheme.toLowerCase()) ); + const fipsModeEnabled = allowFips && config.fipsMode.enabled; + const sessionExpirations = config.session.getExpirationTimeouts(undefined); // use `undefined` to get global expiration values const sessionIdleTimeoutInMinutes = sessionExpirations.idleTimeout?.asMinutes() ?? 0; const sessionLifespanInMinutes = sessionExpirations.lifespan?.asMinutes() ?? 0; @@ -202,6 +212,7 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens accessAgreementEnabled, authProviderCount, enabledAuthProviders, + fipsModeEnabled, httpAuthSchemes, sessionIdleTimeoutInMinutes, sessionLifespanInMinutes,