Expiration of passtickets

Passticket has a new value each second. It means it is unreasonable to generate it more often than in one second. The source code contains this expiration data that basically remove caching.

https://github.com/zowe/api-layer/blob/52ec39bd5476c73a66fc72203be110b479f1594f/gateway-service/src/main/java/org/zowe/apiml/gateway/security/service/schema/HttpBasicPassTicketScheme.java#L115-L116

It is necessary to mention that pass tickets could be valid for up to 10mins.

The correct implementation should be something like:

long expiration = (System.currentTimeMillis() + 1000) % 1000;
//If the custom config value is there, then add the configured time
// generate passticket
return new PassTicketCommand(value, cookieName, patCookieName, expiration, customUserHeader, customPassTicketHeader, userId, passTicket);

It at least reduces the amount of parallel action to generate the same value, but the configurable value could significantly improve the treatment of a huge amount of requests.

Start in gateway-service/src/main/java/org/zowe/apiml/gateway/security/service/schema/HttpBasicPassTicketScheme.java at the expiration data around lines 115-116, and trace how the PassTicketCommand is generated. Check the existing pass-ticket generation and configuration paths before implementing expiration that avoids regenerating the same value more than once per second while supporting a configurable validity period up to 10 minutes; verify the behavior with relevant tests.