Align security docs with canonical Kibana FIPS and session lifespan defaults

[Copilot]

Closes #7017

This updates two pages under /deploy-manage/security to remove contradictions with the canonical Kibana docs. The FIPS overview now reflects Kibana’s 140-2/140-3 support, and the session management page now distinguishes lifespan defaults by deployment type.

• FIPS overview

  • Updated deploy-manage/security/fips.md to state that Kibana supports FIPS 140-2 and FIPS 140-3 compliant modes.
  • Matched the overview wording to the Kibana-specific source of truth in fips-kib.md, including the OpenSSL3 provider requirement.

• Session lifespan defaults

  • Updated deploy-manage/security/kibana-session-management.md so the default xpack.security.session.lifespan is explicit by deployment type:
    • 30 days for self-managed, ECE, and ECK
    • 24 hours for Elastic Cloud Hosted

• Updated wording

  - [{{kib}}](/deploy-manage/security/fips-kib.md) offers FIPS 140-2 and FIPS 140-3 compliant modes and can run in a Node.js environment configured with a FIPS 140-2 or FIPS 140-3 compliant OpenSSL3 provider.

  By default, a maximum session lifespan is 30 days for self-managed, ECE, and ECK deployments, and 24 hours for Elastic Cloud Hosted deployments.

[eedugon]

Thanks @theletterf ! The suggested fix looks good to me. I'll allow another person on the admin-docs team to review.

[eedugon]

LGTM!

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[shainaraskas]

generally looks ok with one nit

would prefer to get these confirmed with a 3p source somewhere (not our docs) to ensure that we're fixing the correct way. usually would start with a codebase/slack search

[shainaraskas]

the as such was probably meaningful here, meaning that you need to be using the mode to have it work in this environment

[shainaraskas]

Followed this up against the Kibana and Cloud source. The global xpack.security.session.lifespan default is 30 days everywhere (self-managed, ECH, ECE, and ECK). The 24h value only applies to a single per-provider setting, xpack.security.authc.providers.saml.cloud-saml-kibana.session.lifespan, which the Cloud allocator injects on any deployment where Cloud SSO is enabled. That covers ECH and any ECE deployment configured for Cloud SSO, and it only affects sessions established through the Cloud SSO SAML realm, not other auth providers or the global default. So the ECH row in the merged change is incorrect: the global lifespan is still 30d there, and the 24h belongs in a separate note scoped to the Cloud SSO realm.

probably could use a better confirmation