fix: rename owner_sub to owner_user_id in OBO credentials API #1736

[DmytroZaichenkoDev]

Renames the credential-owner field of POST /v1/ops/external-service/obo-credentials from owner_sub to owner_user_id. The expected value is the user id as DIAL resolves it from the identity provider configuration (userIdPath), which is not necessarily the JWT sub claim — with some identity providers (e.g. Azure AD, where sub differs per client application) passing the literal sub fails with 404 even though the owner is signed in.

Applicable issues

• fixes Rename owner_sub to owner_user_id in on-behalf-of credentials API #1736

Description of changes

• OboCredentialsRequest: field renamed to ownerUserId, accepted JSON names are owner_user_id / ownerUserId (the old owner_sub name is no longer accepted), validation message updated.
• Renamed the corresponding Java identifiers along the OBO path (ExternalServiceCredentialsController, CredentialsLocatorFactory, CredentialsDescriptorFactory, ResourceCredentialsService, UserExternalServiceService) and updated javadoc wording from "owner sub" to "owner user id".
• Audit log key renamed: owner_sub= → owner_user_id= in the obo_credential_retrieval event.
• Regenerated docs/open_api_core.yaml (OboCredentialsRequest.ownerSub → ownerUserId).
• Updated ExternalServiceOboCredentialsApiTest accordingly.

Related: #1735 (expose the resolved user id via GET /v1/user/info — separate PR).

Checklist

• Title of the pull request follows Conventional Commits specification

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

🤖 Generated with Claude Code

[ai-dial-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None