[jira] [Created] (KNOX-3480) Support user-supplied clientId in the Client Credentials endpoint

["Sandor Molnar (Jira)" <ji...@apache.org>]

Sandor Molnar created KNOX-3480:
-----------------------------------

             Summary: Support user-supplied clientId in the Client Credentials endpoint
                 Key: KNOX-3480
                 URL: https://issues.apache.org/jira/browse/KNOX-3480
             Project: Apache Knox
          Issue Type: Task
          Components: JWT, Server
    Affects Versions: 3.0.0
            Reporter: Sandor Molnar
            Assignee: Sandor Molnar
             Fix For: 3.1.0


Today {{{}clientid/api/v1/oauth/credentials }} always returns a server-generated UUID as {{client_id{}}}, which is stored as {{{}KNOX_TOKENS.token_id{}}}. Well-known IdPs (Auth0, Okta, Keycloak) let the caller choose the client identifier at registration. Add the same capability to Knox.

When the caller supplies a {{clientId}} query param, use that value as the token's {{knox.id/token_id}} instead of a generated UUID. When omitted, behavior is unchanged (random UUID). Uniqueness is backed by the {{KNOX_TOKENS.token_id}} primary key.

Scope / implementation:
 - Read optional clientId param in {{{}ClientCredentialsResource{}}}; thread it down through TokenResource.getJWT() → JWTokenAttributes(Builder) → JWTToken so the {{knox.id}} claim uses the supplied value (fall back to UUID.randomUUID()).
 - Reject collisions explicitly (pre-check via TokenStateService) — do not depend on the DB PK, since the in-memory store overwrites silently.
 - Validate the supplied value: non-blank, length ≤128, restricted charset.

Acceptance criteria:
 - clientId supplied → response client_id equals it, and it is the token_id row / passcode-auth works.
 - clientId omitted → unchanged UUID behavior.
 - Duplicate clientId → clear client error (not 500, not silent overwrite).
 - Invalid clientId (too long / bad chars) → clear client error.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)