This documentation is for WSO2 Open Banking version 1.5.0. View documentation for the latest release.
Skip to end of metadata
Go to start of metadata

WSO2 Open Banking 1.5.0 supports Functional conformance suite  v1.6.7. 

The  Open Banking Implementation Entity ( OBIE) Functional Conformance Certificate allows WSO2 Open Banking to demonstrate that the solution has successfully implemented all required functional elements of the OBIE Read/Write API specifications, passing all tests performed by the Functional Conformance Tool.

This document contains the following topics:

Before you begin:

  1. Download and unzip the following:
    • wso2-obam-1.5.0.zip (WSO2 Open Banking API Management)
    • wso2-obiam-1.5.0.zip (WSO2 Open Banking Identity and Access Management)

     Click here to see how to download the packs from WUM

    Set up the WSO2 Update Manager (WUM). 

    • WUM is a simple command-line tool that connects to the WSO2 update service, determines which updates are new and relevant, and downloads them. You can get the latest version of the WSO2 Open Banking product packs through WUM.

      License

      WSO2 Open Banking is not distributed under the Apache Community License and is only available under the WSO2 Software License. You need a WSO2 subscription to install and update the WSO2 Open Banking solution via WUM. Contact us to find out how you can access a free evaluation copy...

    • Follow the guidelines provided in the Download WUM page to download, and install WUM in your environment. For more information on how to use WUM, see the WUM documentation.

        1. Add the necessary product packs using the commands given below:

          wum add wso2-obam-1.5.0              		 	                	     
          wum add wso2-obkm-1.5.0 
        2. Update the product packs using the commands given below:

          wum update wso2-obam-1.5.0	                	     
          wum update wso2-obkm-1.5.0               	     
        3. Additionally, download and update the other instances of WSO2 Open Banking product.

          wum add wso2ei-6.4.0
          wum update wso2ei-6.4.0
          
          wum add wso2am-analytics-2.6.0    
          wum update wso2am-analytics-2.6.0 
             
          wum add wso2-obbi-1.5.0
          wum update wso2-obbi-1.5.0

          WSO2 OB APIM Analytics(wso2am-analytics-2.6.0) provides the API analytics feature.

          WSO2 OB BI(wso2-obbi-1.5.0) provides the following features:

          • API Analytics

          • Transaction Risk Analysis

          • Fraud Detection

          • Data Reporting

    • The product packs reside in the <WUM_HOME>/products/<Product_Name>/<version>/full directory as <Product_name-<version>+<timestamp>.full.zip. Copy the product packs to a preferred location in each node, and extract them.


      WSO2 Updates Manager (WUM) is deprecated and will be unavailable from July 2021 onwards. WSO2 Updates is the new tool to include the solution and security improvements that are released by WSO2 Open Banking, on top of a released version. For more information, see WSO2 Updates.

       Click here to see how to update the solution via WSO2 Update tool...

      The WSO2 Update tool delivers hotfixes and updates seamlessly on top of products as WSO2 Updates. They include improvements that are released by WSO2. You need to update all the products using the relevant script.

      • Go to <PRODUCT_HOME>/bin and run the WSO2 Update tool: 

        ./wso2update_linux 
        ./wso2update_darwin
        ./wso2update_windows.exe
      • Repeat this step for all the products in the solution:
        • wso2-obkm-1.5.0 
        • wso2-obam-1.5.0 
        • wso2-obbi-1.5.0
        • wso2am-analytics-2.6.0

    This document refers to the file paths of the product packs for the Key Manager, API Manager, API Manager Analytics, and Enterprise Integrator as <WSO2_OB_KM_HOME>, <WSO2_OB_APIM_HOME>, <WSO2_AM_ANALYTICS_HOME>,<WSO2_OB_BI_HOME> and <WSO2_EI_HOME> respectively.



  2. Configure the databases and set up the solution.

Configuring the solution 

  1. Set the RenewTokenPerRequest property to false in <WSO2_OB_IAM_HOME>/repository/conf/identity/identity.xml as follows:

    <RenewTokenPerRequest>false</RenewTokenPerRequest>
  2. In <WSO2_OB_IAM_HOME>/repository/conf/identity/identity.xml, update the <WSO2_OB_APIM_HOST> placeholder with the hostname of the API Manager server for IDTokenIsuuerID:

    <IDTokenIssuerID>https://<WSO2_OB_APIM_HOST>:8243/token</IDTokenIssuerID>
  3. Change the MaximumFuturePaymentDays value to 365 in <WSO2_OB_IAM_HOME>/repository/conf/finance/open-banking.xml as follows:

    <PaymentRestrictions>
    	<MaximumFuturePaymentDays>365</MaximumFuturePaymentDays>
    </PaymentRestrictions>
  4. Open the <WSO2_OB_APIM_HOME>/repository/conf/finance/open-banking.xml and <WSO2_OB_IAM_HOME>/repository/conf/finance/open-banking.xml files and set the following configuration to false:

    <ValidateAccountIdOnRetrieval>true</ValidateAccountIdOnRetrieval>
  5. The Functional conformance suite invokes the endpoints exposed by the host machine. Therefore, you need to add a hostname to the  Docker-bridge interface.  Thereby, both WSO2 Open Banking Identity and Access Management (WSO2_OB_IAM_HOST) and WSO2 Open Banking API Management (WSO2_OB_APIM_HOST) servers can be accessed via the server hostnames and Docker-bridge hostname (DOCKER_SEVER_HOST).

    1. Create a new server key and a certificate including the following parameters:
      1. server hostname as Common Name (CN).

      2. DOCKER-BRIDGE_SEVER_HOST as Subject Alternative Name (SAN).  See the sample given below:

        [req]
        distinguished_name = req_distinguished_name
        x509_extensions = v3_req
        prompt = no
        [req_distinguished_name]
        C = US
        ST = VA
        L = SomeCity
        O = MyCompany
        OU = MyDivision
        CN = <WSO2_OB_APIM_HOST>
        [v3_req]
        keyUsage = keyEncipherment, dataEncipherment, digitalSignature
        extendedKeyUsage = serverAuth, clientAuth
        subjectAltName = @alt_names
        [alt_names]
        DNS.1 = <DOCKER-BRIDGE_SEVER_HOST>
        openssl req -x509 -nodes -days 3560 -newkey rsa:4096 -keyout wso2carbon.key -out wso2carbon.crt -config req.conf -extensions 'v3_req'
    2. Create a new keystore with the generated certificate. Please use the same keystore password (KEYSTORE_PASSWORD) that you have already configured for the existing keystore:

      openssl pkcs12 -export -in wso2carbon.crt -inkey wso2carbon.key -name <KEYSTORE_PASSWORD> -out <WSO2_OB_APIM_HOST>.p12
    3. Import the generated server certificate (step a) to client truststore of both WSO2_OB_IAM_HOST and WSO2_OB_APIM_HOST servers:

       keytool -importcert -file wso2carbon.crt -keystore client-truststore.jks -alias "<WSO2_OB_APIM_HOST>"
  6. Start WSO2 Open Banking API Manager and WSO2 Identity Access Management servers.
  7. Deploy Account and Transaction API v3.1.2, Payment Initiation API v3.1.2, and Confirmation of Funds API v3.1.1.

    1. If you do not send the x-jws-signature header with the request (“-e DISABLE_JWS=FALSE”), remove the following handlers.
      Open the <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api/<USERNAME>--PaymentInitiationAPI_vv3.1.xml file in a text editor.

      1. Comment out the and remove the following handler:

        com.wso2.finance.open.banking.gateway.jws.UKJwsSignatureHandler
      2. Comment the following handler from the XML files of all the APIs in  <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api:

        com.wso2.finance.open.banking.gateway.api.schema.validation.RequestSchemaValidationHandler
  8. Sign in to the API Developer Portal as a TPP at https://<WSO2_OB_APIM_HOST>:9443/store.

  9. Change the redirect url of the application to “https://< DOCKER-BRIDGE_SEVER_HOST>:8443/conformancesuite/callback”.

Setting up the test suite

If you encounter a test failure during the execution, restart the docker container and rerun the test suite from step 1.

  • To restart the docker container, use the below command:

    docker start -a fsuite
  1. Run the following command in a terminal to pull and run the image:

    docker run --add-host=<DOCKER-BRIDGE_SEVER_HOST>:<docker0 ip> -it --name=fsuite -p 8443:8443 -e LOG_LEVEL=debug -e LOG_TRACER=true -e LOG_HTTP_TRACE=true -e DISABLE_JWS=TRUE "openbanking/conformance-suite:[TEST_SUITE_VERSION]"
  2. To add the certificates to the container, g o to < WSO2_OB_APIM_HOME>/repository/resources/security and execute the below command to generate the pem file for <WSO2_OB_APIM_HOST>.crt:

    openssl x509 -inform DER -in wso2carbon.crt -out <WSO2_OB_APIM_HOST>.pem -outform PEM
  3. Log in to the container:

    docker exec -it fsuite /bin/bash
  4. Add the <WSO2_OB_APIM_HOST>.pem certificate to the following locations using the below command:
    1. /usr/local/share/ca-certificates/<WSO2_OB_APIM_HOST>.pem

      docker cp <WSO2_OB_APIM_HOST>.pem fsuite:/usr/local/share/ca-certificates/<WSO2_OB_APIM_HOST>.pem
    2. etc/ssl/certs/<WSO2_OB_APIM_HOST>.pem

      docker cp <WSO2_OB_APIM_HOST>.pem fsuite:/etc/ssl/certs/<WSO2_OB_APIM_HOST>.pem
  5. Copy  wso2carbon.jks to the same locations as in step 4.
  6. Run the following command:

    update-ca-certificates
  7. Stop the container using the following command:

    docker stop fsuite
  8. Restart the container:

    docker start -a fsuite
  9. Access the test suite at https://localhost:8443 .

  10. Select Open Banking test suite and start the test.

  11. In the Discovery step, update the following values in the JSON file separately for each time the conformance suite runs for Account and Transaction API, Payment Initiation API, and Confirmation of Funds API.

    1. Account and Transaction API:

      A sample endpoint configuration for the Account and Transaction API is available here.

      discoveryItems
      apiSpecification nameAccount and Transaction API Specification

      openidConfigurationUri

      The OpenID Connect discovery endpoint. For example:

      https://<DOCKER_SEVER_HOST>:8243/.well-known/openid-configuration
      resourceBaseUri

      Production/Sandbox URL for the API. For example:

      https://<DOCKER_SEVER_HOST>:8243/open-banking/v3.1/aisp
    2. Payment Initiation API:

      A sample endpoint configuration for the Payment Initiation API is available here.

      discoveryItems
      apiSpecification namePayment Initiation API

      openidConfigurationUri

      The OpenID Connect discovery endpoint. For example:

      https://<DOCKER_SEVER_HOST>:8243/.well-known/openid-configuration
      resourceBaseUri

      Production/Sandbox URL for the API. For example:

      https://<DOCKER_SEVER_HOST>:8243/open-banking/v3.1/pisp
    3. Confirmation of Funds API:

      A sample endpoint configuration for the Confirmation of Funds API is available here.

      discoveryItems
      apiSpecification nameConfirmation of Funds API

      openidConfigurationUri

      The OpenID Connect discovery endpoint. For example:

      https://<DOCKER_SEVER_HOST>:8243/.well-known/openid-configuration
      resourceBaseUri

      Production/Sandbox URL for the API. For example:

      https://<DOCKER_SEVER_HOST>:8243/open-banking/v3.1/cbpii
  12. Click Next and proceed to the Configuration stage.

  13. Add the following mandatory configurations in the form/JSON file.

    A sample TestData_Configure.json is available here.

    Client

    Private Signing Key (.key):

    The Private Signing Key certificate of the client/application created in the section above .

    Public Signing Certificate (.pem):

    The Public Signing Certificate of the client/application created in the section above.

    Private Transport Key (.key):

    The Private Transport Key certificate of the client/application created in the section above.

    Public Transport Certificate (.pem):

    The Public Transport Certificate of the client/application created in the section above.

    Account IDs

    The Account IDs of the account resources that the customer (PSU) has consented to provide to the client/application.

    Statement IDs

    The Statement IDs of the statement resources that the customer (PSU) has consented to provide to the client/application.

    Client ID

    Consumer key of the client/application created in the section above.

    Client Secret

    Consumer secret of the client/application created in the section above.


    Well-Known

    OAuth 2.0 response_type

    A JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values

    Request object signing algorithm

    The algorithm used to sign requests objects

    Resource Base URL

    The base URL of the WSO2 OB APIM server. For example: https://<WSO2_OB_APIM_HOST>:8243

    Payments

    Identification

    Beneficiary account identification

    Name

    Name of the account, as assigned by the account servicing institution.

    Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.

    International Identification

    The international beneficiary account identification

    International Name

    International name of the account, as assigned by the account servicing institution.

    Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.

    Confirmation of Funds

    Schema Name

    Name of the identification scheme.

    Identification

    Account identification, which is known by the account owner.

    Name

    The name of the account, as assigned by the account servicing institution.

    Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.

  14. Click Next and run the suite.
  • No labels