[
https://issues.apache.org/jira/browse/KNOX-3480?focusedWorklogId=1043539&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1043539
]
ASF GitHub Bot logged work on KNOX-3480:
----------------------------------------
Author: ASF GitHub Bot
Created on: 23/Sep/26 11:48
Start Date: 23/Sep/26 11:48
Worklog Time Spent: 10m
Work Description: hanicz commented on PR #1422:
URL: https://github.com/apache/knox/pull/1422#issuecomment-5794260298
Follow-up JIRA to properly fix concurrency issues during token creation
https://issues.apache.org/jira/browse/KNOX-3481
Issue Time Tracking
-------------------
Worklog Id: (was: 1043539)
Time Spent: 1h 10m (was: 1h)
> Support user-supplied clientId in the Client Credentials endpoint
> -----------------------------------------------------------------
>
> Key: KNOX-3480
> URL: https://issues.apache.org/jira/browse/KNOX-3480
> Project: Apache Knox
> Issue Type: Task
> Components: JWT, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Today {{{}clientid/api/v1/oauth/credentials }} always returns a
> server-generated UUID as {{client_id{}}}, which is stored as
> {{{}KNOX_TOKENS.token_id{}}}. Well-known IdPs (Auth0, Okta, Keycloak) let the
> caller choose the client identifier at registration. Add the same capability
> to Knox.
> When the caller supplies a {{clientId}} query param, use that value as the
> token's {{knox.id/token_id}} instead of a generated UUID. When omitted,
> behavior is unchanged (random UUID). Uniqueness is backed by the
> {{KNOX_TOKENS.token_id}} primary key.
> Scope / implementation:
> - Read optional clientId param in {{{}ClientCredentialsResource{}}}; thread
> it down through TokenResource.getJWT() → JWTokenAttributes(Builder) →
> JWTToken so the {{knox.id}} claim uses the supplied value (fall back to
> UUID.randomUUID()).
> - Reject collisions explicitly (pre-check via TokenStateService) — do not
> depend on the DB PK, since the in-memory store overwrites silently.
> - Validate the supplied value: non-blank, length ≤128, restricted charset.
> Acceptance criteria:
> - clientId supplied → response client_id equals it, and it is the token_id
> row / passcode-auth works.
> - clientId omitted → unchanged UUID behavior.
> - Duplicate clientId → clear client error (not 500, not silent overwrite).
> - Invalid clientId (too long / bad chars) → clear client error.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
