Experimenting with ZCS 8.0.3 OS Preauth solution, found out, that, as indicated here: Preauth - Zimbra :: Wiki, entering other than 0 value for &expires parameter brings to an error 400, authentication failed. ZCS server and requesting server date and timezones are in sync.
If putting in 0 (understanding, that it falls back to ZCS configured expiration time), preauth is successful.
May be somebody may point me to right direction. Which of expires values in ZCS configuration this relates to? In account, domain, global config? Where can I check default expiration value, and still allow to custom indication of preauth expiration?