Support "@"mentioning other users

[legrego]

Related to https://github.com/elastic/dev/issues/1660

Kibana is home to many solutions, which are increasingly becoming collaborative in nature. We can no longer expect that Kibana's primary function is to consume dashboards -- while this is certainly a critical feature, Kibana is so much more than that.

These collaborative features by definition are meant to be used by teams of people, and these people often need to be able to "tag" or "mention" other people into conversations within Kibana.

There are two pieces to this issue:

Enumerate available users

The first step to supporting "mentions" is the ability to actually enumerate the available users. We can easily enumerate the native realm, but we don't have the capacity to enumerate any of the other realms.

Expose search functionality

We should expose functionality to search for a user by any of their available properties, including:

• username
• full_name
• email
• authentication_realm / lookup_realm

Is possible, it would be ideal if we could also search for users who would satisfy a _has_privileges check. For example, if we wanted to show a list of users within the SIEM app, it might make sense to only display users who are authorized to interact with the SIEM app.

Uniquely identify users

Administrators can setup Kibana/ES to authenticate against multiple providers/realms. When configured this way, it's possible to have username collisions. For example, there might be an account with username larry in both the native and saml realms. These accounts may or may not belong to the same individual.

We should account for this when returning search results, so that we don't accidentally conflate these user accounts.

Blocks #39259

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[alexfrancoeur]

Linking to issues where there is more of an immediate need for this type of functionality: https://github.com/elastic/security-team/issues/237, https://github.com/elastic/security-team/issues/45

[kobelb]

/cc @XavierM

[joshdover]

@azasypkin is there a specific issue this is blocked on right now?

[tvernum]

Mostly this is blocked on work on the Elasticsearch side.
The Enumerate available users and Uniquely identify users problems needs to be solved in ES, and we are working on a design for that, but it's having to be juggled around other work.