Support for viewing another user's avatar

[jportner]

In #127624, users can personalize their avatar (initials or image).
However, there is currently no API to fetch another user's profile, and as such there is no way for us to render another user's avatar with the new UserAvatar component.

Right now, the only place in Kibana where another user's avatar is visible is the Stack Management -> Users -> Edit User page.
If your avatar is customized, the Edit User page won't show the custom avatar. For example:

We should:

• Expose an API to retrieve another user's profile (and filter that based on an allow-list of values that should be public)
• Change the Edit User page to load the profile and use UserAvatar in lieu of EuiAvatar.

Related to: elastic/elasticsearch#89570

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[thomheymann]

It is currently not possible to retrieve a user profile for a reserved/native user by username.

The only way we can retrieve a user profile currently is via their user profile uid (GET /_security/profile/<uid>).

However, we don’t have this information available since Elasticsearch doesn’t return it in the get user response (GET /_security/user/<username>).

The only other option I can think of is to abuse the suggest endpoint but searching by username could return other users with a matching display name so it feels very hacky.

Get user response

Does not contain user profile uid:

GET /_security/user/elastic

{
  "elastic": {
    "username": "elastic",
    "roles": [
      "superuser"
    ],
    "full_name": null,
    "email": null
  }
}

Suggest user profile endpoint

Does not exact-match users by their username/realm name so could return other users.

The only way to get the correct user profile would be to scrape the response which is very hacky.

GET _security/profile/_suggest
{
  "name": "elastic",
  "size": 1
}

[
  {
    "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "user": {
      "username": "similar-name-to-elastic",
      "roles": [
        "superuser"
      ],
      "realm_name": "default_native"
    }
  }
]

[legrego]

@thomheymann I want to make sure I understand this issue correctly. I think we've had an API to retrieve a user profile for quite a while, so is the remaining task here to show the personalized user avatar within the User Management screens?

[thomheymann]

@legrego The issue wasn't the lack of API to retrieve a user profile. The issue was that you could only retrieve it by profile id and since that is stored in the session we were only able to get the profile id for the currently logged in user, but not for other users.

Good news is that Elasticsearch team have now added the ability to retrieve the profile id for a given user now elastic/elasticsearch#89570 so this should be unblocked.

[legrego]

@thomheymann ah great, thanks for explaining!

[legrego]

Closing in favor of #141258