Update and clarify JWT docs

[dmuelle]

for security defect OpenLiberty/open-liberty#26453

Clarify the expiresInSeconds attribute in jwtBuilder defaults to the value of the expiry attribute if expiresInSeconds is set to a negative value.
Using the configured keystore/key alias to generate a consistent JWK
If customers want keys to be consistent across Liberty servers and/or across server reboots, they can configure the keyStoreRef and keyAlias attributes to point to a specific keypair. The default JWK endpoint provided by Liberty (https://<host_name>:<ssl_port>/jwt/ibm/api/<jwtBuilder_configuration_id>/jwk) will still produce a JWK document but will use the public key pointed to by those configuration attributes to create a JWK representation of the key to send back.
JWK creation and rotation
The keys get recalculated/rotated every 12 hours by default in the case jwkEnabled="true".
The keys get generated when creating the token, or when the JWK endpoint is invoked (whichever happens first).
The same keys are used for all tokens created by the same JWT builder.
Clarify kid usage

[dmuelle]

Hi @ayoho - the updated draft is ready for review when you have a chance

https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/json-web-token.html

Let me know what edits are needed. One question I have is whether dynamically produced JWKs produce JWKS doc. The way the topic is structured now its unclear.

[ramkumar-k-9286]

Peer Review

Therefore, when you set jwkEnabled to true, any keyStoreRef and keyAlias attributes that are specified in the jwtBuilder element are ignored, as shown in the following example:
->
Therefore, when you set jwkEnabled attribute to true, any keyStoreRef and keyAlias attributes that are specified in the jwtBuilder element are ignored, as shown in the following example:

Q: from what I understood keyStoreRef and keyAlias are both attributes and that's why its mentioned once afterkeyAlias

---

In this example, the keyStoreRef and keyAlias values are ignored and the dynamically generated JWKs are used instead.
->
In this example, the keyStoreRef and keyAlias attribute values are ignored and the dynamically generated JWKs are used instead.

---

JWT consumers can retrieve JSON Web Key Set (JWKS) documents to reconstruct public keys to verify token signatures.
->
JWT consumers can retrieve JSON Web Key Set (JWKS) documents to reconstruct public keys and verify token signatures.

---

To configure Open Liberty to verify token signatures with JWKs, set the jwkEnabled attribute in the jwtConsumer element to true. Also, you must set the jwkEndpointUrl attribute to a URI that provides the JWKS document that contains the public keys to verify the signatures of the tokens that received by this JWT consumer.
->
To configure Open Liberty to verify token signatures with JWKs, set the jwkEnabled attribute in the jwtConsumer element to true. Also, you must set the jwkEndpointUrl attribute to a URI that provides the JWKS document containing the public keys to verify the signatures of the tokens received by this JWT consumer.

---

[dmuelle]

Thanks @ramkumar-k-9286, all suggestions implemented

[ramkumar-k-9286]

@dmuelle

One thing I just noticed. Under See also

JSON Web Token feature
->
JSON Web Token feature

[dmuelle]

thanks, fixed