I realize now that there is a further problem with this higher up the stack. Even though my plugin successfully authenticates against a third party user-store, no kibana cookie is created so the browser can detect that I'm authenticated. Is it my responsibility to create the kibana cookie? I read some where that the structure of the cookie is not advertised as you guys reserve the right to change the structure in the future and to I don't want my plugin to then break. This is a duplicate of a question already asked but not answered