ZSS needs to handle change of JWK from z/OSMF (through APIML)

[1000TurquoisePogs]

zss/c/zss.c

Line 1014 in 126535c

settings->path = "/gateway/api/v1/auth/keys/public/current";

This line is the URL used to get the JWK from APIML that validates its JWTs that come in on requests to ZSS.

I just found out that /current lists the currently used JWK, but /all can show others, and /current can change over time.
In the case of z/OSMF, I'm told the JWK is derived from z/OSMFs keyring, such that if there's multiple z/OSMFs with different keyrings, or if the keyring changes without restarting Zowe, it's possible for ZSS to not recognize a JWT as valid due to it not knowing the right JWK to do validation with.

It seems that we need to change JWK retrieval. 2 thoughts:

1. get /all, and stash the result
2. upon a JWT failing verification, this could be a signal that we're using the wrong JWK, and should query APIML again to get a new one. I think this turns a currently synchronous verification process into an async one, so I don't know how to go about this.

[JoeNemo]

Need to know if APIML is always reflective of the underlying z/OSMF, or is it frozen upon startup. Also the validation "machine" needs to go back into try all JWK's mode everytime it fails using one of them.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs, but can be reopened if needed. Thank you for your contributions.