WebSphere OpenID Connect Relying Party - Could you please add client_assertion as an authentication method?

Current Situation:

We are using the IBM supplied replying party plugin with Microsoft Entra:

Component name: OpenID Connect Relying Party TAI
TAI class name: com.ibm.ws.security.oidc.client.RelyingParty
Version: 9.0 f5192405.01 

This combination allows the used of "client_secret" to authenticate.

The secret is stored in WebSphere as an unencrypted name/value property.

Future:

We'd like to use the "client_assertion" method of authentication with a client certification stored in a WebSphere keystore.

The improvements are:

* Security - only exchange data encrypted by secret key; rather than secret itself.

* Security - certificate valid for a time window and can already be monitored by WebSphere.

* Security - certificate is encrypted at rest

Implementation background:

See this section on Client Authentication from the OpenID specification:

private_key_jwt (Chapter 9 of OpenID Connect Core 1.0 incorporating errata set 1)

https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

I have found an Open Source implementation in Hitachi FAPI Implementation for Java 1.0.0 https://github.com/Hitachi/hitachi-fapi-java/tree/master

Where the private_key_jwt and client_assertion functionality is added in:

https://github.com/Hitachi/hitachi-fapi-java/blob/master/client/src/main/java/fapi/client/oauth/TokenExchange.java

These lines of code add the extra request values:

if ("private_key_jwt".equals(fapiConfig.getClientAuthMethod())) {

// @formatter:off

String requestJwt = new RequestObjectBuilder()

.issuer(fapiConfig.getClientID())

.subject(fapiConfig.getClientID())

.audience(metadata.getTokenEndpoint())

.jti(CryptoUtil.generateRandomUUID())

.issuedAt(new Date())

.expirationAfter(Calendar.MINUTE, 5)

.buildAndSign(jwkProvider.getJwk());

// @formatter:on

request.add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");

request.add("client_assertion", requestJwt);

}