Resurrect deprecated and removed authentication settings.

x-pack/plugins/security/server/authentication/authentication_service.test.ts

@@ -318,6 +318,52 @@ describe('AuthenticationService', () => {
       });
     });
 
+    describe('getServerBaseURL()', () => {
+      let getServerBaseURL: () => string;
+      beforeEach(() => {
+        mockStartAuthenticationParams.http.getServerInfo.mockReturnValue({
+          name: 'some-name',
+          protocol: 'socket',
+          hostname: 'test-hostname',
+          port: 1234,
+        });
+
+        service.setup(mockSetupAuthenticationParams);
+        service.start(mockStartAuthenticationParams);
+
+        getServerBaseURL = jest.requireMock('./authenticator').Authenticator.mock.calls[0][0]
+          .getServerBaseURL;
+      });
+
+      it('falls back to legacy server config if `public` config is not specified', async () => {
+        expect(getServerBaseURL()).toBe('socket://test-hostname:1234');
+      });
+
+      it('respects `public` config if it is specified', async () => {
+        mockStartAuthenticationParams.config.public = {
+          protocol: 'https',
+        } as ConfigType['public'];
+        expect(getServerBaseURL()).toBe('https://test-hostname:1234');
+
+        mockStartAuthenticationParams.config.public = {
+          hostname: 'elastic.co',
+        } as ConfigType['public'];
+        expect(getServerBaseURL()).toBe('socket://elastic.co:1234');
+
+        mockStartAuthenticationParams.config.public = {
+          port: 4321,
+        } as ConfigType['public'];
+        expect(getServerBaseURL()).toBe('socket://test-hostname:4321');
+
+        mockStartAuthenticationParams.config.public = {
+          protocol: 'https',
+          hostname: 'elastic.co',
+          port: 4321,
+        } as ConfigType['public'];
+        expect(getServerBaseURL()).toBe('https://elastic.co:4321');
+      });
+    });
+
     describe('getCurrentUser()', () => {
       let getCurrentUser: (r: KibanaRequest) => AuthenticatedUser | null;
       beforeEach(async () => {

x-pack/plugins/security/server/authentication/authentication_service.ts

@@ -41,7 +41,7 @@ interface AuthenticationServiceSetupParams {
 }
 
 interface AuthenticationServiceStartParams {
-  http: Pick<HttpServiceStart, 'auth' | 'basePath'>;
+  http: Pick<HttpServiceStart, 'auth' | 'basePath' | 'getServerInfo'>;
   config: ConfigType;
   clusterClient: IClusterClient;
   legacyAuditLogger: SecurityAuditLogger;
@@ -234,6 +234,17 @@ export class AuthenticationService {
       license: this.license,
     });
 
+    /**
+     * Retrieves server protocol name/host name/port and merges it with `xpack.security.public` config
+     * to construct a server base URL (deprecated, used by the SAML provider only).
+     */
+    const getServerBaseURL = () => {
+      const { protocol, hostname, port } = http.getServerInfo();
+      const serverConfig = { protocol, hostname, port, ...config.public };
+
+      return `${serverConfig.protocol}://${serverConfig.hostname}:${serverConfig.port}`;
+    };
+
     const getCurrentUser = (request: KibanaRequest) =>
       http.auth.get<AuthenticatedUser>(request).state ?? null;
 
@@ -247,6 +258,7 @@ export class AuthenticationService {
       config: { authc: config.authc },
       getCurrentUser,
       featureUsageService,
+      getServerBaseURL,
       license: this.license,
       session,
     });

x-pack/plugins/security/server/authentication/authenticator.test.ts

@@ -55,6 +55,7 @@ function getMockOptions({
     basePath: httpServiceMock.createSetupContract().basePath,
     license: licenseMock.create(),
     loggers: loggingSystemMock.create(),
+    getServerBaseURL: jest.fn(),
     config: createConfig(
       ConfigSchema.validate({ authc: { selector, providers, http } }),
       loggingSystemMock.create().get(),

x-pack/plugins/security/server/authentication/authenticator.ts

@@ -87,6 +87,7 @@ export interface AuthenticatorOptions {
   loggers: LoggerFactory;
   clusterClient: IClusterClient;
   session: PublicMethodsOf<Session>;
+  getServerBaseURL: () => string;
 }
 
 // Mapping between provider key defined in the config and authentication
@@ -216,6 +217,7 @@ export class Authenticator {
         client: this.options.clusterClient.asInternalUser,
         logger: this.options.loggers.get('tokens'),
       }),
+      getServerBaseURL: this.options.getServerBaseURL,
     };
 
     this.providers = new Map(

x-pack/plugins/security/server/authentication/providers/base.mock.ts

@@ -17,6 +17,7 @@ export type MockAuthenticationProviderOptions = ReturnType<
 
 export function mockAuthenticationProviderOptions(options?: { name: string }) {
   return {
+    getServerBaseURL: () => 'test-protocol://test-hostname:1234',
     client: elasticsearchServiceMock.createClusterClient(),
     logger: loggingSystemMock.create().get(),
     basePath: httpServiceMock.createBasePath(),

x-pack/plugins/security/server/authentication/providers/base.ts

@@ -26,6 +26,7 @@ import type { Tokens } from '../tokens';
  */
 export interface AuthenticationProviderOptions {
   name: string;
+  getServerBaseURL: () => string;
   basePath: HttpServiceSetup['basePath'];
   getRequestOriginalURL: (
     request: KibanaRequest,