is it possible to make work your solution with a JWT policy generation?
I'm sorry if I was not clear earlier. Let me try to clarify. There is no way to use specifically the GenerateJWT policy to generate a TOKEN (= JWT) with a exp claim that is a milliseconds quantity. This would violate the JWT specification. As APIEvangelist pointed out in a different reply here, the spec requires that exp and iat be in SECONDS. The GenerateJWT policy conforms to that requirement. That specific policy always produces a compliant JWT, and cannot and will not produce an output that expresses those quantities in milliseconds. You cannot do what you describe with the GenerateJWT policy. I hope this is now clear.
There is a similar policy - it is called GenerateJWS. The GenerateJWS policy generates a signed document according to the JWS spec.
It's a little confusing, all the JWS, JWT, JWE stuff. But, briefly: "JWT" refers JSON Web TOKEN", while JWS refers to JSON Web SIGNATURE. Tokens may be signed or encrypted. When most people say "JWT" they mean "signed JWT". All signed JWT are, by definition, JWS. But not all JWS are JWT. It is possible to use the GenerateJWS policy to generate a JWT, if you format the payload to be JSON, and use claims that comply with the RFC7519 specification. Is this helping?
The "solution" I showed above uses GenerateJWS, but it does not generate a JWT. The output will NOT be a JWT, not a compliant one anyway, because of the issue I described above: the JWT specification says that exp and iat must be in SECONDS, not MILLISECONDS. But the output of my example forces the exp and iat claims to be in MILLISECONDS. Therefore, the output from the specific GenerateJWS example I offered will look like a JWT, but will not be a JWT, by definition. Your upstream system seems to accept that kind of thing - something that looks like a JWT, but is not. So maybe the approach I showed is just what you need.
LinkedIn
Twitter
