JWT Token Authentication Support for IMS Connect, TM RA and ICAL

We would like to use JWT (JSON Web Token) as the only method to authenticate against IMS Connect. Similar to what Network Security credential propagation support offers today, but more advanced and specific to JWT. IMS TM RA for inbound should provide a field to allow to set the JWT Token (at least 512 byte, but possibly up to 1024 byte). IMS Connect with HWSJAVAx Exits should be able to extract the JWT Token and place it into an IDTA and do the RACROUTE Call without the users need to write their own IMS Connect security exit or define their own IMS Connect message structures. TM RA and IMS Connect full support is requested. RACF extracts either the RACF Userid from the subject or does identity mapping based on X.500 Distinguished Name and returns an error or an ACEE. IMS Connect then extracts the userid or mapped userid from the ACEE and passes it on to OTMA together with the complete JWT Token in the transaction message prefix. The INQY MSGINFO call should allow to retrieve the complete JWT Token (not only the Common Name). ICAL should transparently support to send out the complete unchanged JWT Token to the external application and TM RA for outbound needs to support the retrieval of the JWT Token.
So the requirement is about JWT authentication and propagation support for IMS (IMS TM RA, IMS Connect, IMS and IMS Callout).