The ClientContextId is 0 when an OpenEdge REST web application is configured with the appSecurity-basic-oerealm.xml security template.
The ClientContextId is 0 when an OpenEdge REST web application is using the HTTP Basic Authentication.

The ClientContextId is retrieved from the JSESSIONID cookie which is generated by the Spring Security Framework and which is then sent by the REST client within each request. 

Session IDs exist for the case where a REST client performs a form login (the appSecurity-form-oerealm.xml security template) who's lifetime spans multiple HTTP client requests and have a defined logout action. The session ID is what binds the individual HTTP requests into a single login session.

The HTTP BASIC model of user login (the appSecurity-basic-oerealm.xml security template) spans only the lifetime of a single HTTP request and has no defined logout action, therefore no session ID is needed or created.

In cases where the usage of the appSecurity-basic-oerealm.xml security template is required, then starting with OpenEdge 11.6 it is possible to configure the usage of the JSESSIONID cookies with the appSecurity-basic-oerealm.xml security template by commenting out the OEClientPrincipalFilter bean, for example:

    <b:bean id="OEClientPrincipalFilter"
             class="com.progress.rest.security.OEClientPrincipalFilter" >
             <!--
             <b:property name="enablecp" value="false" />
             <b:property name="key" value="oech1::00333c34252a2137" /> 
             <b:property name="registryFile" value="" />
             <b:property name="domain" value="RESTDomain" />
             <b:property name="roles" value="sample" />
             <b:property name="authz" value="true" />
             <b:property name="accntinfo" value="true" />
             <b:property name="ccid" value="true" />
             <b:property name="properties" >
                <b:map>
                     <b:entry key="prop-1" value="string1"/>
                     <b:entry key="prop-2" value="string2"/>
                </b:map>
             </b:property>
             <b:property name="expires" value="600" />
             <b:property name="anonymous" value="false" />
             <b:property name="sealAnonymous" value="false" />
             -->
    </b:bean>

Then make sure that the sealClientPrincipal attribute in the OERealmAuthProvider bean is set to true, for example:

   <b:bean id="OERealmAuthProvider"
            class="com.progress.rest.security.OERealmAuthProvider" >
            <b:property name="userDetailsService">
                        <b:ref bean="OERealmUserDetails"/>
            </b:property>
            <!-- 
            When createCPAuthn property is true:
                will create an OE ClientPrincipal with its additional attributes
                that the Spring token does not. This is qualified by the "sealClientPrincipal"
                property, which when true will use this bean's domain and registry configuration
                to "seal" the ClientPrincipal; and when false will leave the ClientPrincipal
                unsealed until the OEClientPrincipalFilter performs the seal operation.
             When createCPAuthn property is false
                a basic Spring token is generated and passed to the OEClientPrincpial
                filter, which will use its configuration to create a ClientPrincipal, 
                copy the Spring token's information into it, and then seal it using its 
                domain and access-code configuration.  All other properties relating to 
                ClientPrincpal generation and sealing are ignored 
             -->
            <b:property name="createCPAuthn" value="true" />
            <b:property name="multiTenant" value="false" />
            <b:property name="sealClientPrincipal" value="true" />
            <b:property name="key" value="oech1::00333c34252a2137" /> <!-- Domain access password: Encoded value of 'Password' -->
            <b:property name="registryFile" value="" />
            <b:property name="userDomain" value="RESTDomain" />
            <b:property name="authz" value="true" />
            <!--            
            <b:property name="properties" >
                <b:map>
                     <b:entry key="prop-1" value="string1"/>
                     <b:entry key="prop-2" value="string2"/>
                </b:map>
            </b:property>
            <b:property name="expires" value="600" />
            -->
    </b:bean>

  The AppServer procedure basically returns the ClientContextId value back to the REST client. Now the first time that a request is sent to the REST web application a JSESSIONID cookie is returned by the Spring Security Framework, for example:
Notice the "0Test" output value. This illustrates that the ClientContextId is always 0 with the first request to the REST web application when using the appSecurity-basic-oerealm.xml security template. The reason being that the JSESSIONID is only returned by the Spring Security Framework to the REST client after the REST client has been authenticated. With the appSecurity-basic-oerealm.xml security template the REST client is authenticated via the HTTP Basic Authentication method, so each request needs to contain the HTTP Basic Authentication header. On the other hand when using the appSecurity-form-oerealm.xml security template the REST client first needs to authenticate via http://<host>:<port>/<webapp>/static/auth/j_spring_security_check which returns a JSESSIONID to the client, so by the time the REST client calls the business logic it already received a JSESSIONID, which is why the ClientContextId gets populated. That is also the reason why ClientContextId is not 0 with the first request to the REST web application when using the appSecurity-form-oerealm.xml security template.

Now you can use the JSESSIONID received from the first request in subsequent requests, for example:

Progress Article(s):
"What are the basic steps to authenticate REST clients against the OpenEdge database _User table ?"
"The ClientContextId is 0 when an OpenEdge REST web application is configured with the appSecurity-form-oerealm.xml security template"