In z/OS the client needs a possibility to create keytab files with the option for custom salts to be used with WAS or other Components

Traditionally the keytab utility was shipped with the IBM Java SDK until Java 8 but misses the functionality to use a custom SALT. 
From Java 11 on, it was not further shipped. IBM z/OS offers a keytab utility but with very limited support to use a custom SALT.
The customer would need an equivalent solution in z/OS, as it is currently implemented as a workaround in zCX.
Please either extend the existing commands or provide the msktutil command on z/OS.

Current zCX solution in Pre-Life PLEX:

Name: ZCX0 (name of the started task)
Docker Image: msktutil
Docker container: msktutilcont

When ZCX0 is restarted, the IBM container "ibm_zcx_zos_ssh_cli" is started automatically.
The other required containers "msktutilcont", "nfs_zCX0", "nfs_share" and "haproxycont" are starting automatically because the options "--restart=unless-stopped" and "--restart=always" are used during the start.
The Docker images "msktutil", "alpine", "haproxy" and "fedora" (required to start the containers) are retained, even during an IPL.

Background:
The use of RC4 must be switched to AES encryption. For the client, this affects technical users, who are used for Kerberos/zWAS SingleSignOn Application. A conversion requires the exchange of technical users with far-reaching rights and is critical anyway. Now a keytab must be generated for zOS technical users, which was previously possible with a utility. But this cannot generate the "SALT".
Some alternative solution approaches with Microsoft AD, IBM Open Enterprise SDK for Python and Containerized Ubuntu running in zCX using the command line ktutil program have been discussed and the zCX solution was successfully implemented and tested. However, the client does treat this as a workaround and is requesting to have this functionality embedded in z/OS in the future.