Support Direct Entra ID token for IBM ELM APIs

Current Architecture & Limitations

IBM ELM REST APIs currently require all client requests to present a token issued directly by the Jazz Authentication Server (JAS). While JAS integrates with Microsoft Entra ID via OpenID Connect (OIDC) for interactive browser-based user logins (Authorization Code Flow), machine-to-machine (M2M) and headless service integrations cannot leverage Entra ID tokens directly.

Challenges with JAS Tokens

As we scale automated pipelines, external tools, and non-ELM services connecting to ELM REST APIs, we've encountered a couple of practical hurdles with the current requirement to use JAS-issued tokens:

1. JWT Header Bloat (>20 KB): Because JAS generates tokens incorporating AD group memberships via LDAP, service identities or users with extensive group memberships end up with oversized tokens (>20 KB). This regularly triggers HTTP header size limit violations across our enterprise reverse proxies and API gateways (413 Request Entity Too Large / 400 Bad Request).
2. Fragmented Identity & Credential Governance: While our human users and security groups are centrally governed in Microsoft Entra ID, our non-ELM service applications must be managed locally within JAS as OAuth clients. Managing service credentials and client lifecycles in an isolated silo inside JAS complicates enterprise access governance, secret rotation policies, and auditing across non-ELM integrations.
3. Retiring LDAPs: The JAS token generation workflow remains tied to on-premises LDAPs. As part of our infrastructure modernization, our organization is systematically deprecating on-prem LDAPs in favor of pure cloud identity standards (OIDC / OAuth 2.0).
   What We're Looking For,

For machine-to-machine (M2M) and backend integrations, we would like ELM / Liberty to support the standard OAuth 2.0 Client Credentials Flow directly with Microsoft Entra ID.

Specifically:

• Non-ELM systems authenticate directly against Entra ID using their client credentials to receive an access token with an ELM audience (aud: api://ibm-elm).
• ELM/JAS validates the inbound Bearer token directly against Entra ID's OIDC discovery and JWKS endpoint without requiring a local client definition or token issuance step inside JAS.
• This allows us to strictly control token claims/sizes in Entra ID and standardizes all enterprise identity governance under a single control plane.