[
https://issues.apache.org/jira/browse/KNOX-3480?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118426#comment-18118426
]
ASF subversion and git services commented on KNOX-3480:
-------------------------------------------------------
Commit 189d1f73b1b46b17e99dbb76d54ccdad9f490be8 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=189d1f73b ]
KNOX-3480: Support user-supplied clientId in the Client Credentials endpoint
(#1422)
> Support user-supplied clientId in the Client Credentials endpoint
> -----------------------------------------------------------------
>
> Key: KNOX-3480
> URL: https://issues.apache.org/jira/browse/KNOX-3480
> Project: Apache Knox
> Issue Type: Task
> Components: JWT, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> Today {{{}clientid/api/v1/oauth/credentials }} always returns a
> server-generated UUID as {{client_id{}}}, which is stored as
> {{{}KNOX_TOKENS.token_id{}}}. Well-known IdPs (Auth0, Okta, Keycloak) let the
> caller choose the client identifier at registration. Add the same capability
> to Knox.
> When the caller supplies a {{clientId}} query param, use that value as the
> token's {{knox.id/token_id}} instead of a generated UUID. When omitted,
> behavior is unchanged (random UUID). Uniqueness is backed by the
> {{KNOX_TOKENS.token_id}} primary key.
> Scope / implementation:
> - Read optional clientId param in {{{}ClientCredentialsResource{}}}; thread
> it down through TokenResource.getJWT() → JWTokenAttributes(Builder) →
> JWTToken so the {{knox.id}} claim uses the supplied value (fall back to
> UUID.randomUUID()).
> - Reject collisions explicitly (pre-check via TokenStateService) — do not
> depend on the DB PK, since the in-memory store overwrites silently.
> - Validate the supplied value: non-blank, length ≤128, restricted charset.
> Acceptance criteria:
> - clientId supplied → response client_id equals it, and it is the token_id
> row / passcode-auth works.
> - clientId omitted → unchanged UUID behavior.
> - Duplicate clientId → clear client error (not 500, not silent overwrite).
> - Invalid clientId (too long / bad chars) → clear client error.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
