Add caching capability for non-JWT style token

We are starting to utilise IMS and CICS as API requesters and we are considering the future performance of our infrastructure.

We have a concern about our authentication pattern which we think will add overhead to our API requestor flow.

The pattern:

Background:

1. IMS is calling an API which is hosted on API Mesh. The API is secure by clientid/client secret.

2. The IMS application cannot store the client secret due to our security compliance requirements.

3. Z/OS Connect cannot store the client secret due to our security compliance requirements.

4. The client secret must be stored in a secured vault and retrieved for every API requester.

5. The secured vault is Hashicorp Vault.

6. Hashicorp Vault requires a login token to be provided to access the client secret.

7. To obtain the Hashicorp Vault token, a POST call is issued to the Hashicorp Vault login endpoint. A token is returned in a header, which can then be used on subsequent call to Hashicorp vault. This token has TTL of 15 minutes. After which a new login token must be retrieved for use in subsequent client secret retrieval calls.

8. Once the client secret is returned to the application, the can use that to call the business API on API Mesh.

We have configured z/OS Connect to retrieve the login token via an oAuth flow for authorising the client secret call.

Using this flow we expect a very high volume of calls to Hashicorp.

For every API Requestor:

• Application - API to get client secret

1. z/OS Connect - login endpoint to get login token

2. z/OS Connect - API to Hashicorp to retrieve client secret

• Application - Actual business API using the client secret.

The problem:

The step "1. z/OS Connect - login endpoint to get login token" returns a token but the token is an undocumented token format (is IS NOT a JWT). z/OS Connect cannot cache this token as it would for a standard JWT.

At very high transaction rates we feel we will be hitting the Hashicorp endpoint to frequently.

We were considering if it would be possible for z/OS Connect to cache this non-JWT.

This would reduce the traffic to Hashicorp considerably.