[
https://issues.apache.org/jira/browse/KNOX-3480?focusedWorklogId=1043526&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1043526
]
ASF GitHub Bot logged work on KNOX-3480:
----------------------------------------
Author: ASF GitHub Bot
Created on: 23/Sep/26 09:58
Start Date: 23/Sep/26 09:58
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1422:
URL: https://github.com/apache/knox/pull/1422#issuecomment-5792773225
## Test Results
5 files 5 suites 43s ⏱️
119 tests 119 ✅ 0 💤 0 ❌
137 runs 137 ✅ 0 💤 0 ❌
Results for commit d5eccd8f.
[test-results]:data:application/gzip;base64,H4sIAL2is2oC/13MSw7CIBSF4a00jB1Q6gV0M4bySG5si+Exaty7SCqiw+8/ydmJw8VGch3gNJCYMTWYHFRCvxWep+KypPc2jpePbjFr/Z/u+CiJtuAULj/BhuDDUULe6uckDrTLrnwfq7vD6v5P+3XFVEAMWK2NdA4Y47OdQArOKWdaUuUEB2ZmYM4w8nwBt2s+bwQBAAA=
Issue Time Tracking
-------------------
Worklog Id: (was: 1043526)
Time Spent: 40m (was: 0.5h)
> Support user-supplied clientId in the Client Credentials endpoint
> -----------------------------------------------------------------
>
> Key: KNOX-3480
> URL: https://issues.apache.org/jira/browse/KNOX-3480
> Project: Apache Knox
> Issue Type: Task
> Components: JWT, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Today {{{}clientid/api/v1/oauth/credentials }} always returns a
> server-generated UUID as {{client_id{}}}, which is stored as
> {{{}KNOX_TOKENS.token_id{}}}. Well-known IdPs (Auth0, Okta, Keycloak) let the
> caller choose the client identifier at registration. Add the same capability
> to Knox.
> When the caller supplies a {{clientId}} query param, use that value as the
> token's {{knox.id/token_id}} instead of a generated UUID. When omitted,
> behavior is unchanged (random UUID). Uniqueness is backed by the
> {{KNOX_TOKENS.token_id}} primary key.
> Scope / implementation:
> - Read optional clientId param in {{{}ClientCredentialsResource{}}}; thread
> it down through TokenResource.getJWT() → JWTokenAttributes(Builder) →
> JWTToken so the {{knox.id}} claim uses the supplied value (fall back to
> UUID.randomUUID()).
> - Reject collisions explicitly (pre-check via TokenStateService) — do not
> depend on the DB PK, since the in-memory store overwrites silently.
> - Validate the supplied value: non-blank, length ≤128, restricted charset.
> Acceptance criteria:
> - clientId supplied → response client_id equals it, and it is the token_id
> row / passcode-auth works.
> - clientId omitted → unchanged UUID behavior.
> - Duplicate clientId → clear client error (not 500, not silent overwrite).
> - Invalid clientId (too long / bad chars) → clear client error.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
