Documentation, JWT Builder Workload Identity and JWK Rotation

Feature epic details

• Link to development epic: https://github.com/OpenLiberty/open-liberty/issues/35645
• Target GA release: 26.0.0.11 or 26.0.0.12

Operating systems

Does the documentation apply to all operating systems?

• Yes
• No; specify operating systems: ______

** details below are a work in progress **

Summary

Provide a concise summary of your feature. What is the update, why does it matter, and to whom? What do 80% of target users need to know to be most easily productive using your runtime update?

Enhance the JWT Builder to be able to set a workload identity claim, generated by the server, in the JWTs that it issues. This claim cannot be modified via the JwtBuilder API to provide attestation.

Also, add the ability to define the rotation interval of the JWKs used for signing and verifying the JWTs issued by the JWT Builder as well as define the maximum number of JWKs retained by the JWK endpoint for verifying JWTs.

Configuration

List any new or changed properties, parameters, elements, attributes, etc. Include default values and configuration examples where relevant:

Example configuration:

<jwtBuilder
    workloadIdentityClaim="workload-identity"
    jwkRotationTime="60m"
    jwkMaxKeys="3"
/>

Updates to existing topics

To update existing topics, specify a link to the topics that are affected. Include a copy of the current text and the exact text to which it will change. For example: Change ABC to XYZ

• https://openliberty.io/docs/latest/reference/feature/jwt-1.0.html
• https://openliberty.io/docs/latest/json-web-token.html
• https://www.ibm.com/docs/en/was-liberty/nd?topic=liberty-building-json-web-tokens-in

Create a new topic

To create a topic, specify a first draft of the topic that you want added and the section in the navigation where the topic should go.

Start by reading development epic 35645 and the linked jwt-1.0, JSON Web Token, and IBM WebSphere Liberty documentation topics to understand the feature and existing coverage. Done means updating the affected topics with the workload identity and JWK rotation configuration and behavior, and defining any required new topic and navigation placement.