[beyondinsight_password_safe] Handle null password ion authentication by StacieClark-Elastic · Pull Request #17411 · elastic/integrations

StacieClark-Elastic · 2026-02-13T20:37:37Z

Proposed commit message

beyondinsight_password_safe: handle optional password in authentication

The BeyondInsight API does not always require a password for
authentication. The password will be null when it is not supplied.
Whether one is needed depends on the "User Password
Required" setting on the API registration in BeyondInsight. When no
password was configured, the integration failed because it assumed
the password field was always present in state.

ref: https://docs.beyondtrust.com/bips/docs/bi-cloud-configure-api

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
[x ] I have verified that all data streams collect metrics or logs.
[ x] I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

elasticmachine · 2026-02-13T20:37:47Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

…n when password is null

elastic-vault-github-plugin-prod · 2026-02-13T21:09:21Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6

Suggest the following commit message

beyondinsight_password_safe: handle optional password in authentication

The BeyondInsight API does not always require a password for
authentication. Whether one is needed depends on the "User Password
Required" setting on the API registration in BeyondInsight. When no
password was configured, the integration failed because it assumed
the password field was always present in state.

ref: https://docs.beyondtrust.com/bips/docs/bi-cloud-configure-api

efd6 · 2026-02-16T02:52:43Z

+  url: http://{{Hostname}}:{{Port}}/BeyondTrust/api/public/v3
+  apikey: test_api_key
+  username: testuser2
+  password: null


This has no default in the manifest, so it can be omitted here.

Suggested change

password: null

The test is specifically for when the password is null. Should we ever add a default in the manifest then this test will no longer test the condition for which it is written.

efd6 · 2026-02-16T02:54:22Z

In the state construction I think the password field should be conditionally included

{{#if password}} password: {{escape_string password}} {{/if}}

The password always exists. Sometimes it is null.

I discussed this with @andrewkroh before I did the fix as I was also confused about the password existing and being null. This fix will allow users to not have to update their policies when the integration is updated.

efd6 · 2026-02-16T02:55:23Z

            "Authorization": [
              sprintf("PS-Auth key=%s; runas=%s;", [state.apikey, state.username]) +
-              ((state.password != "") ? (sprintf(" pwd=[%s];", [state.password])) : ""),
+              ((state.?password.orValue("") != "") ? (sprintf(" pwd=[%s];", [state.password])) : ""),


With conditional rendering into the config, this becomes has(state.password) ? …

The password always exists. sometimes it is null.

Can you confirm that password: {{escape_string password}} gives {"password": ""} if the password var is null?

password: {{escape_string password}} gives null if the password is null. I added in the 'if' block and added some policy tests for null and empty string to verify that no password is set if the variable is null or empty and changed the system tests to test for a missing password.

Can you confirm that a password state update from "something" to falsey will remove the password from the profile's configuration state?

If I update a policy that had a password, then leave the password field blank when I update the policy, it generates a policy with no password:
original:

state: limit: 1000 apikey: ${SECRET_0} password: ${SECRET_1} username: amiauser

updated:

state: limit: 1000 apikey: ${SECRET_0} username: amiauser

…word

…ing using if statement in template.

…word

efd6

There are some whitespace changes that should be reverted and a query. After that LGTM.

efd6 · 2026-02-24T00:40:52Z

These deleted blank lines (also below) are stanza breaks for clarity. They should not be removed.

efd6 · 2026-02-24T00:43:12Z

            "Name": "Test User"
          }
          `}}
-


Same here and below.

elastic-package format made those changes. That needs to be fixed.

efd6 · 2026-02-24T00:43:51Z

            "Name": "Test User"
          }
          `}}
-


And here and below.

efd6 · 2026-02-24T00:44:17Z

            "Name": "Test User"
          }
          `}}
-


And here and below.

efd6 · 2026-02-24T00:44:34Z

            "Name": "Test User"
          }
          `}}
-


And here and below.

efd6 · 2026-02-24T00:46:51Z

            "Authorization": [
              sprintf("PS-Auth key=%s; runas=%s;", [state.apikey, state.username]) +
-              ((state.password != "") ? (sprintf(" pwd=[%s];", [state.password])) : ""),
+              ((state.?password.orValue("") != "") ? (sprintf(" pwd=[%s];", [state.password])) : ""),


Can you confirm that a password state update from "something" to falsey will remove the password from the profile's configuration state?

…k lines that had been removed by elastic-package format

…word

efd6 · 2026-02-24T22:38:28Z

/test

…word

elasticmachine · 2026-02-25T17:44:23Z

💚 Build Succeeded

Buildkite Build
Commit: deccf1c

History

💔 Build #38782 failed f240a8b
💔 Build #38777 failed f240a8b
💔 Build #38744 failed 9aa84d5
💚 Build #38692 succeeded 666cfa3
💚 Build #38424 succeeded 7116955

elastic-vault-github-plugin-prod · 2026-02-25T21:31:00Z

Package beyondinsight_password_safe - 0.12.2 containing this change is available at https://epr.elastic.co/package/beyondinsight_password_safe/0.12.2/

…elastic#17411) beyondinsight_password_safe: handle optional password in authentication The BeyondInsight API does not always require a password for authentication. The password will be null when it is not supplied. Whether one is needed depends on the "User Password Required" setting on the API registration in BeyondInsight. When no password was configured, the integration failed because it assumed the password field was always present in state. ref: https://docs.beyondtrust.com/bips/docs/bi-cloud-configure-api

StacieClark-Elastic requested a review from a team as a code owner February 13, 2026 20:37

StacieClark-Elastic added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:beyondinsight_password_safe BeyondInsight and Password Safe labels Feb 13, 2026

StacieClark-Elastic changed the title ~~Handle null password ion authentication~~ [beyondinsight_password_safe] Handle null password ion authentication Feb 13, 2026

beyondinsight_password_safe-handle-null-password handle authenticatio…

49b09d2

…n when password is null

StacieClark-Elastic force-pushed the beyondinsight_password_safe-handle-null-password branch from 751fd99 to 49b09d2 Compare February 13, 2026 20:39

efd6 reviewed Feb 16, 2026

View reviewed changes

StacieClark-Elastic requested a review from efd6 February 18, 2026 15:00

StacieClark-Elastic added 5 commits February 18, 2026 10:11

beyondinsight_password_safe-handle-null-password updated PR number

4f99aa1

Merge branch 'main' into beyondinsight_password_safe-handle-null-pass…

7116955

…word

beyondinsight_password_safe-handle-null-password handle password sett…

f3d6cf6

…ing using if statement in template.

Merge branch 'main' into beyondinsight_password_safe-handle-null-pass…

da3c3f7

…word

beyondinsight_password_safe-handle-null-password linting and formatting

666cfa3

efd6 reviewed Feb 24, 2026

View reviewed changes

beyondinsight_password_safe-handle-null-password added back some blan…

9aa84d5

…k lines that had been removed by elastic-package format

StacieClark-Elastic requested a review from efd6 February 24, 2026 15:05

Merge branch 'main' into beyondinsight_password_safe-handle-null-pass…

f240a8b

…word

StacieClark-Elastic enabled auto-merge (squash) February 24, 2026 18:11

StacieClark-Elastic added 2 commits February 25, 2026 11:33

beyondinsight_password_safe-handle-null-password formating

b6096a9

Merge branch 'main' into beyondinsight_password_safe-handle-null-pass…

deccf1c

…word

efd6 approved these changes Feb 25, 2026

View reviewed changes

StacieClark-Elastic merged commit 8743104 into elastic:main Feb 25, 2026
9 checks passed

Conversation

StacieClark-Elastic commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Uh oh!

elasticmachine commented Feb 13, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Feb 13, 2026

🚀 Benchmarks report

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 commented Feb 24, 2026

Uh oh!

elasticmachine commented Feb 25, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

StacieClark-Elastic commented Feb 13, 2026 •

edited

Loading