Configure the mqweb server to accept JWT.

See my blog post JWT to learn what JSON Web Token are, and how they work.

In Liberty the JWT is processed by OpenID Connect Client.

In my mqwebuser.xml I had

<featureManager> 
    <feature>transportSecurity-1.0</feature> 
    <feature>openidConnectClient-1.0</feature> 
</featureManager> 
<openidConnectClient 
  id="RS2" 
  clientId="COLINSOC" 
  jwkEndpointUrl="https://10.1.1.2:10443/jwt/ibm/api/zOSMFBuilder/jwk" 
  inboundPropagation="supported" 
  issuerIdentifier="zOSMF" 
  mapIdentityToRegistryUser="true" 
  signatureAlgorithm="RS384" 
  trustAliasName="CONN2.IZUDFLT" 
  trustStoreRef="defaultKeyStore" 
  userIdentifier="sub"
/> 

Where

• id=”RS2″ is any label
• clientId=”COLINSOC” is another label
• jwkEndpointUrl=”https://10.1.1.2:10443/jwt/ibm/api/zOSMFBuilder/jwk”
• inboundPropagation=”required”
• issuerIdentifier=”zOSMF” this matches the iss-uer in the JWT token
• mapIdentityToRegistryUser=”false” this is to use the Liberty userid mapping so specify false to use the RACF mapping.
• signatureAlgorithm=”RS384″ – this has to match what is in the task that creates the JWT. If I had RS256 – it came out as Elliptic Curve. I configued z/OSMF and MQWEB both to use RS384 and it worked.
• trustAliasName=”CONN2.IZUDFLT” the certificate to use in the validation
• trustStoreRef=”defaultKeyStore” this point to the definition of the trust keystore to use
• userIdentifier=”sub” the user name is taken from this field in the JWT

The JWT had

header

{
  "kid": "aaPdG7y6fDNNTMCT6wb9-Oe21M63dPS3MtCeF7kYKn8",
  "typ": "JWT",
  "alg": "RS384"
}

The payload had

token_type:Bearer
sub: IBMUSER  The subject of the JWT (the user). 
upn: IBMUSER
groups["DBBADMNS","IZUADMIN","IZUUSER","PKIGRP","SYS1","ZWEADMIN"]
realm:SAFRealm
iss:zOSMF The issuer of the JWT.
exp: 1754240783 (Sun Aug 03 2025 18:06:23 GMT+0100 (British Summer Time)).  The expiration time on or after which the JWT MUST NOT be accepted for processing. Learn more
iat:1754237783 (Sun Aug 03 2025 17:16:23 GMT+0100 (British Summer Time)) The time at which the JWT was issued.

Getting it to work

I used Setting mqweb trace on z/OS and other useful hints on tracing extensively.

Using JWT and when it goes wrong has some debugging hints.

Processing lines in ASCII files in ISPF edit macros made looking at log files so much easier, by displaying lines from a trace file on one screen – rather than having to scroll sideways many times.