[EBT] userId hash generation

[afharo]

We need to come up with a better logic to generate the hashed userId in the telemetry context.

Currently, we concatenate the Cloud Deployment ID and the Username and generate a hash out of it. The problem with this approach is that it does not allow us to match this data with Cloud UI users (they do a hash of the Username only). In FullStory, it also splits the session, making it harder to analyze the user funnel from Cloud UI to Kibana and back.

The problem with sending the hash of the username only is that users that log in with a different provider to Cloud' SAML might share the same user name (i.e.: elastic username from the elasticsearch basic authentication method). Using a hash of the username provides a unique count of users that is wrong for this reason.

The suggestion is to validate the authentication provider and:

1. If it's Cloud, generate it as a hash of the username to match Cloud UI generation method. It should be unique per unique Cloud user because of how Cloud authentication works.
2. For any other provider, use the current logic of concatenating the Cloud Deployment ID.

The relevant piece of logic is in the cloud plugin:

kibana/x-pack/plugins/cloud/public/plugin.tsx

Line 313 in 2f3f919

return { userId: sha256(cloudId ? `${cloudId}:${userId}` : `${userId}`) };

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[afharo]

Pinging the @elastic/kibana-security team to confirm how to validate the Cloud authentication provider.

[legrego]

Pinging the @elastic/kibana-security team to confirm how to validate the Cloud authentication provider.

We can consider a user to be a "cloud user" if both of the following are true (copied from #129236):

• Kibana is running on Cloud.
• The current user has authenticated via the saml realm named cloud-saml-kibana.

The former is known by the cloud plugin. The latter can be derived by inspecting the authentication_realm of the current user:

kibana/x-pack/plugins/security/common/model/authenticated_user.ts

Lines 22 to 25 in 6ecffcc

	/**
	* The name and type of the Realm that has authenticated the user.
	*/
	authentication_realm: UserRealm;