Request for enhancement to local JWT generation functionality in Liberty under z/OS Connect

Request for enhancement to local JWT generation functionality in Liberty under z/OS Connect:

Background:

As part of a firm migration project for one of our bank’s cards, we were required to migrate our z/OS requester API’s to a new external vendor in order to be able to continue servicing our cards.  In contrast to the exiting vendor, the new vendor requires JWTs for authentication and optionally JWE’s.

 Problem:

As we worked on the implementation with IBM case support and enabled token signing and encryption in liberty’s server.xml we found a couple of issues:

1. The keyID (kid) is autogenerated based on the pubkey hash of the certificate, whereas the vendor requires the kid to be the cert’s serial number.
2. The vendor requires the kid and another claim for the merchant id to be placed in the JWT Header, whereas the current implementation places any claims that we specify in the JWT payload instead.
3. When creating a JWE – there is no option to add a digest of the json body in a specified digest algo like sha256.

Proposed Enhancements:

1. Allow the caller to specify whether claims should be included in the JWT Payload or in the JWT Header, preferably in the same server.xml tag for claims under zosconnect_authTokenLocal / claims.
2. Allow the kid to be generated based on a cert serial number or to be defined in the claims and then not be overwritten by the system.
3. Allow and x5c claim to be included based on the cert chain for the requested cert.
4. For Encryption or also for signing if needed – allow a json body digest to be created.

Examples:

Currently possible in local JWT on z/OS Connect Liberty: Refer picture 1
After proposed enhancement: Refer picture 2