This documentation is for WSO2 Open Banking version 1.5.0. View documentation for the latest release.
Skip to end of metadata
Go to start of metadata

Manual Client Registration is deprecated in Open Banking 1.5.0. This feature and its functionalities will be unavailable from the next release (Open Banking 2.0.0).

In manual client registration, Primary Technical Contact (PTC) uses a portal that is managed by the Account Servicing Payment Service Provider (ASPSP). When using the web single sign-on, the PTC must use the credentials that were issued when registering with the Open Banking Directory. This page describes how to configure and use the manual registration flow as indicated by the Open Banking Implementation Entity (OBIE).

Configure manual registration

Upload certificate to client trust store

There are two types of certificates that can be used for TPP Onboarding:

  1. OB root and issuer certificates
  2. eIDAS QSealC and QWAC
Using OB root and issuer certificates

The ASPSP can upload the OB root and issuer certificates found in the following locations to the <WSO2_OB_KM_HOME>/ repository/resources/security/client-truststore.jks and <WSO2_OB_APIM_HOME>/repository/resources/security/client-truststore.jks.

Use the commands to add the certificate to the client trust store as follows:

Add root certificate
keytool -import -alias tpproot -file <OB root cert> -keystore client-truststore.jks -storepass wso2carbon
Add issuer certificate
keytool -import -alias tppissuer -file <OB issuing cert> -keystore client-truststore.jks -storepass wso2carbon
Using eIDAS QSealC and QWAC

The TPP user needs to obtain an eIDAS certificate from a Qualified Trust Service Provider (QTSP) that validates whether the TPP is registered in a governing entity. It is verified in the TPP Onboarding process. For more information on how WSO2 Open Banking supports the eIDAS implementation, see eIDAS Implementation for PSD2 Compliance.

For testing purposes, WSO2 Open Banking provides a sample eIDAS certificate. To download the sample eIDAS certificate, click here

Upload the downloaded sample eIDAS certificate to the client trust stores of WSO2 OB APIM and WSO2 OB KM.

  • Locate the client trust stores in WSO2 OB APIM and WSO2 OB KM in the following directory paths:
      • <WSO2_OB_APIM>/repository/resources/security/client-truststore.jks
      • <WSO2_OB_KM>/repository/resources/security/client-truststore.jks
  • Use the following command to upload the certificate:

    keytool -import -trustcacerts -alias <<alias>> -file <<path_to_sample_eIDAS_cert>> -keystore <<path_to_truststore>> -storepass wso2carbon -noprompt

Do the following configurations in order to support the manual registration flow.

Make sure the SupportedResponseTypes contain code as a SupportedResponseType.

  1. Open the <WSO2_OB_KM_HOME>/repository/conf/identity/identity.xml file.
  2. Under the <SupportedResponseTypes> tag, make sure the given configurations are available.


  1. Add an identity provider with OAuth2-OpenID Connect to the Key Manager (KM).

    Fill the relevant values based on the values you received from the Open Banking (OB) directory when registering for their identity provider service.

    Callback URLhttps://<keymanager_host>:<keymanager_port>/commonauthThis URL should be provided as the redirect URI when creating the SSA (Software Statement Assertion)
    OpenID Connect User ID Location
    User ID found among claims
    Additional Query Parametersscope=openid email profile&prompt=loginThese parameters are used to retrieve user information from WSO2 Open Banking.
    Client Id
    The client id issued by the OB directory to ASPSP
    Client Secret
    The client secret issued by the OB directory to ASPSP

    Make sure you select the Enable HTTP Basic auth for client authentication checkbox as it is expected that the client ID and client secret are sent in the header.

  2. Expand the Claim Configuration section of the identity provider and add the following claim configurations.

    Identity Provider Claim URI tpp_associated
    Local Claim URI
    Identity Provider Claim URIemail
    Local Claim URI
    User ID Claim URI email
  3. Expand the Just-in-Time Provisioning section, select the Always provision to User Store Domain option and then the Provision Silently option.
  4. Add a service provider for the Key Manager. In the inbound authentication section, configure OAuth/OpenID Connect when configuring OAuth/OpenID Connect. For the Callback URL, provide https://{WSO2_OB_APIM_HOST}:{ob_apim_port}/store/jagg/jaggery_oidc_acs_ob.jag as the URL.

  5. Make a note of the client ID and client secret.
  6. For the Local & Outbound Authentication Configuration of the service provider, select Federated Authentication and select the identity provider that you just added.
  7. For the claim configurations, add email and tpp_associated as the requested claims as specified below.
  8. In the claims tab, select click on Add and select External Claim URI. Add tpp_associated to the Open ID Connect (OIDC) claim dialect and map it to the local claim
  9. In the OIDC scopes tab, click on Add and select Add claims for the openid scope. Update the openid scope with the tpp_associated claim that you just added.
  10. In the <WSO2_OB_APIM_HOME>/repository/deployment/server/jaggeryapps/store/site/conf/site.json file and modify the OIDC configuration section as follows:

    "oidcConfiguration" : {
     "enabled" : "true",
     "issuer" : "API_STORE",
     "identityProviderURI" : "https://<WSO2_OB_APIM_HOST>:<WSO2_OB_APIM_NIO_PORT>/token",
     "authorizationEndpointURI" : "https://<WSO2_OB_KM_HOST>:<WSO2_OB_KM_PORT>/oauth2/authorize",
     "tokenEndpointURI" : "https://<WSO2_OB_KM_HOST>:<WSO2_OB_KM_PORT>/oauth2/token",
     "userInfoURI" : "https://<WSO2_OB_KM_HOST>:<WSO2_OB_KM_PORT>/oauth2/userinfo",
     "jwksURI" : "https://<WSO2_OB_KM_HOST>:<WSO2_OB_KM_PORT>/oauth2/jwks",
     "logoutEndpointURI" : "https://<WSO2_OB_KM_HOST>:<WSO2_OB_KM_PORT>/oidc/logout",
     "authHttpMethod": "POST",
     "role" :"Internal/subscriber",
     "clientConfiguration" : {
       "clientId" : "<Client_ID of the Service Provider created above>",
       "clientSecret" : "<Client_Secret of the Service Provider created above>",
       "responseType" : "code",
       "authorizationType" : "authorization_code",
       "scope" : "phone email address openid profile api_store",
       "redirectURI" : "https://<WSO2_OB_APIM_HOST>:<OB_APIM_PORT>/store/jagg/jaggery_oidc_acs_ob.jag",
       "postLogoutRedirectURI" : "https://<WSO2_OB_APIM_HOST>:<OB_APIM_PORT>/store/",
       "clientAlgorithm" : "PS256"

    Make sure you use the same algorithm in the following configurations:

    1. The allowed signature algorithm for the TPP requests, configured in <WSO2_OB_APIM_HOME>/repository/conf/finance/open-banking.xml

    2. The clientAlgorithm property in the site.json file.

    Make sure you add the following parameters.

     "role" :"Internal/subscriber",

    Add the following if you want to add a parameter for a scope.

    "scope" : "phone email address openid profile api_store",
  11. In the <WSO2_OB_APIM_HOME>/repository/deployment/server/jaggeryapps/store/site/conf/site.json file, add OBDirectoryIntegrated configuration as true.
  12. In the <WSO2_OB_APIM_HOME>/repository/deployment/server/jaggeryapps/store/site/conf/site.json file, add UseSoftwareIdAsApplicationName configuration as true.

  13. To store any of the properties retrieved from the SSA, make sure you add the Server level configuration to the <WSO2_OB_APIM_HOME>/repository/conf/api-manager.xml file, as explained here.

    For example, if you want to store the software_client_id that is retrieved from the SSA created in the sandbox environment, the property name should look like software_client_id_sandbox.

    Similarly, to store the software_client_id retrieved from the SSA created in a production environment, the property name should be software_client_id_production. Make sure you add these properties as false, as required. In the API Store, you can display both name and ID of the application if you have enabled  UseSoftwareIdAsApplicationName  feature and configured the  software_client_name  attribute.

            <Attribute required="false">
                <Description>Software ID of the sandbox</Description>
            <Attribute required="false">
                <Description>Software ID of the production</Description>
            <Attribute required="false">
                <Description>Software roles of the sandbox</Description>
            <Attribute required="false">
                <Description>Software roles of the production</Description>
            <Attribute required="false">
                <Description>JWKS endpoint of sandbox</Description>
            <Attribute required="false">
                <Description>JWKS endpoint of production</Description>
            <Attribute required="false">
                <Description>Organization ID of the sandbox</Description>
            <Attribute required="false">
                <Description>Organization ID of the production</Description>
            <Attribute required="false">
                <Description>Allowed scopes for sandbox</Description>
            <Attribute required="false">
                <Description>Allowed scopes for production</Description>
            <Attribute required="false">
                <Description>Software Client Name of the sandbox</Description>
            <Attribute required="false">
                <Description>Software Client Name of the production</Description>

    Software JWKS endpoints are needed to verify whether mutually verified client certificates match with the SSA’s certificate. Therefore, make sure you add two optional application attributes; software_jwks_endpoint_sandbox and software_jwks_endpoint_production.

    To make sure that only this application can be subscribed to the APIs with roles specified in the software_role, make sure you add the following attributes: software_roles_production and software_roles_sandbox.

    To add a particular role to the API, when creating the API add software_role and add the relevant value (i.e. AISP or PISP) to that under the API properties section as explained here.

    Creating an application

  14. Navigate to the API Store using the following URL: https://<WSO2_OB_APIM_HOST>:9443/store.

  15. Click Sign In. You are re-directed to the OB login page.

  16. Log in using the OB directory credentials and provide the second-factor authentication.

  17. After a successful login, you are redirected back to the API Store. Click the Applications tab and click Add Application.
  18. Provide a valid SSA. The application name is picked up from the software_client_name of the SSA.
  19. Click Add to add the application. If application creation is successful, the relevant application page is shown.

  • No labels