z/OS Connect OAuth 2.0 access token caching and life time JWT token management

We propose to be able to modify the behavior of z/OS Connect (OpenAPI 2) when tokens are close to expiration. In particular, we would need to be able to parametrize the residual time for which z/OS Connect requests a new token from the JWT Server authentication, currently fixed to one second. The parameter should be set at the endpoint level.

Extract from the documentation: Calling an OAuth 2.0 authorization server - IBM Documentation:

“

OAuth 2.0 access token caching

The IBM z/OS Connect server stores access tokens in the system cache. An access token is reused when the OAuth 2.0-related information for a request matches exactly that of the original request for which the token was obtained. Expired access tokens are cleared from the system cache periodically. When an access token is retrieved from the cache, if the access token is expired or has less than a one-second lifetime left, a new token is obtained.

“

Goal:

The implementation would allow you to call a service which in turn orchestrates calling other services, by allowing to tailor token’s residual lifetime before refresh, it could be possible to handle long service call-chains (when a first service orchestrates the calls to several other services) reducing the occurrences of token expirations halfway through the chain.  This will prevent an increase of response times due to the retry of the entire call-chain after the new token is obtained