Page History

...

Shareable accounts - accounts that are accessible online.

<SharableAccountsRetreiveEndpoint>: Configures the endpoint to retrieve sharable <UK200SupportedSpecsToRequest>UK200|UK300</UK200SupportedSpecsToRequest>

Configuration

1

Define the specification that you plan to deploy.

Possible values: UK, BERLIN, AU, STET

Code Block

language	xml

<DeployedSpecification>UK</DeployedSpecification>

2

If you want to enable the event notification feature, set the <isEnabled> to true, and define the following configurations:

Multiexcerpt

MultiExcerptName	EventNotificationConfigs

<TokenIssuer>: The URL from where the token is issued.
<NotificationExpiryTime>: The expiry time of the notification, in seconds.
<NotificationAPIUrl>: The URL of the event-notification endpoint which is exposed from

WSO2 API Manager

API Manager.
<NumberOfSetsToReturn>: The maxEvents parameter in the polling request informs the ASPSP how many notifications the TPP wants to retrieve at a moment. When the maxEvents parameter is absent in the polling request, NumberOfSetsToReturn defines this value.
<SigningAlias>: The alias of the certificate that signs the notifications sent from ASPSP to TPP.

Code Block

language	xml

<EventNotifications>

<IsEnabled>false<

	<IsEnabled>true</IsEnabled>

	<TokenIssuer>www.openbank.com</TokenIssuer>

	<NotificationExpiryTime>180</NotificationExpiryTime>

<NotificationAPIUrl>https

	<NotificationAPIUrl>https://<WSO2_OB_APIM_HOST>:8243/open-banking/v3.1/event-notification</NotificationAPIUrl>
	<NumberOfSetsToReturn>5</NumberOfSetsToReturn>
	<SigningAlias>wso2carbon</SigningAlias>
</EventNotifications>

3

To save the log entries of the consent modules to a JSON file:the Consent Management API calls in JSON format:

Multiexcerpt

MultiExcerptName	ConsentMgtLog

Set the LogConsentInformation configuration to true

in the Open Banking Key Manager server.

Code Block

language	xml

<LogConsentInformation>true</LogConsentInformation>

Add the following properties to the

in <WSO2_OB_KM_HOME>/repository/conf/finance/

log4j.properties file. This is to save the log entries in JSON format in the <WSO2_OB_KM_HOME>/repository/logs/transaction.log file

open-banking.xml.

Code Block

language	xml

<LogConsentInformation>true</LogConsentInformation>

4

5

<DaysToExpireRequest>: In Multiple Authorisation, this parameter defines the number of days after which the system considers the consent as expired if the required authorisation is not given.

Code Block

language	xml

log4j.logger.TRANSACTION_LOGGER=INFO, TRANSACTION_LOGGER
log4j.appender.TRANSACTION_LOGGER=org.apache.log4j.FileAppender
log4j.appender.TRANSACTION_LOGGER.File=${carbon.home}/repository/logs/transaction.log
log4j.appender.TRANSACTION_LOGGER.Append=true
log4j.appender.TRANSACTION_LOGGER.layout=org.apache.log4j.PatternLayout
log4j.appender.TRANSACTION_LOGGER.layout.ConversionPattern=[%d] - %m %n
log4j.appender.TRANSACTION_LOGGER.threshold=INFO
log4j.additivity.TRANSACTION_LOGGER=false

4

<DaysToExpireRequest>: Defines the number of days after which the system considers the consent as expired if the required authorisation is not given.

Code Block

language	xml

<MultiAuthorization>
  <DaysToExpireRequest>3</DaysToExpireRequest>
</MultiAuthorization>

<MultiAuthorization>
  <DaysToExpireRequest>3</DaysToExpireRequest>
</MultiAuthorization>

5

Shareable accounts - accounts that are accessible online.

<SharableAccountsRetrieveEndpoint>: Configures the endpoint to retrieve sharable accounts that required to list on the consent page.

Code Block

language	xml

<SharableAccountsRetrieveEndpoint>http://<WSO2_OB_APIM_HOST>:9763/open-banking/services/bankaccounts/bankaccountservice/sharable-accounts</SharableAccountsRetrieveEndpoint>

Payable accounts - accounts from which a PSU can make a payment.

<PayableAccountsRetrieveEndpoint>: Configures the endpoint to retrieve payable accounts that required to list on the consent page.

Code Block

language	xml

<SharableAccountsRetrieveEndpoint>http<PayableAccountsRetrieveEndpoint>http://<WSO2_OB_APIM_HOST>:9763/open-banking/services/bankaccounts/bankaccountservice/sharablepayable-accounts</SharableAccountsRetreiveEndpoint>

Payable accounts - accounts from which a PSU can make a payment.

<PayableAccountsRetrieveEndpoint>: Configures the endpoint to retrieve payable accounts that required to list on the consent page.  Code Block
language xml
<PayableAccountsRetrieveEndpoint>http://<WSO2_OB_APIM_HOST>:9763/open-banking/services/bankaccounts/bankaccountservice/payable-accounts</PayableAccountsRetrieveEndpoint>
In some banks, some PSUs may have a certain number of accounts, but not all accounts have the ability to PayableAccountsRetrieveEndpoint>
In some banks, some PSUs may have a certain number of accounts, but not all accounts have the ability to be shared externally or to make a payment online. In a bank, the shareable account list and the payable account list can either be the same or different.
In the default WSO2 Open Banking solution, at least two APIs are expected to return shareable and payable accounts when passing the user_id, and the given JSON response must be returned. Then it automatically loads the accounts list in the consent page.
 Code Block
{
 "data": [
  {
   "account_id": "1234-2345-3456-4567",
   "display_name": "1234-2345-3456-4567"
  },
  {
   "account_id": "9999-4345-8456-4567",
   "display_name": "9999-4345-8456-4567"
  }
 ]
}
By default, mock backend deployed in WSO2_OB_APIM is configured. Required parameters can be passed as query parameters to those endpoints. An example of configuring the endpoint to retrieve payable accounts:
 Code Block
language xml
http://<WSO2_OB_APIM_HOST>:9443/as400/payable-accounts/{userId}
If you plan to implement the multi-authorization feature for the PISP flow, the payable account retrieval endpoint should return the following JSON response.
 Code Block
{
 "data": [{
   "account_id": "30080098971337",
   "display_name": "30080098971337",
   "authorizationMethod": "multiple",
   "authorizationUsers": [{
     "customer_id": "123",
     "user_id": "[email protected]@carbon.super"
    },
    {
     "customer_id": "456",
     "user_id": "[email protected]@carbon.super"
    }
   ]
  }
 ]
}

An example of configuring the endpoint to retrieve sharable accounts:
 Code Block
http://<WSO2_OB_APIM_HOST>:9443/as400/sharable-accounts/{userId}

6

Enable Request-URI validation:

Info
This is available only as a WUM update and is effective from December 02, 2019 (12-02-2019). For more information on updating WSO2 Open Banking, see Updating WSO2 Products.

During account retrieval to validate AccountID against the AccountID in consent, add the following configurations under the <UK> element:

Code Block

language	xml

<!-- Validate AccountID with consented accountID in account retrieval -->
<ValidateAccountIdOnRetrieval>true</ValidateAccountIdOnRetrieval>

7

Configure the role to identify the customer care officers, who are able to access the customer care portal, and revoke the consents on behalf of customers.

Code Block

language	xml

<UK>          
  <CustomerCareOfficerRole>Internal/CustomerCareOfficer</CustomerCareOfficerRole>
</UK>

8

The unique ID of the ASPSP to which the request is issued. The unique ID is issued by OBIE and corresponds to the Organization ID of the ASPSP in the Open Banking Directory. If the value does not match the expected value (based on the Client ID or network certificate of the caller), the ASPSP must reject the request with a 403 (Not AuthorizedForbidden) status code.

Code Block

language	xml

<UK>
  <XFAPIFinancialId>open-bank</XFAPIFinancialId>
</UK>

9

According to the openbanking.org.uk specification, the links to access the created resource must be returned, as follows.

Code Block

language	xml

"Links": {
   "Self": "https://api.alphabank.com/open-banking/v2v3.0/accounts/222891/pisp/domestic-payment-consents/58923"
 },

In order to generate the self URL shown in the above JSON, configure the URLs of the exposed APIs, as shown in the below configuration.

Code Block

language	xml

<UK>
   <PaymentAPIURL>https://<WSO2_OB_APIM_HOST>:8243/open-banking/{version}/pisp/</PaymentAPIURL>
   <AccountAPIURL>https://<WSO2_OB_APIM_HOST>:8243/open-banking/{version}/aisp/</AccountAPIURL>
   <FundsConfirmationAPIURL>https://APIM_HOSTNAME:8243/open-banking/{version}/cbpii/</FundsConfirmationAPIURL>
   
   <!--configure the url to get details about the error-->
   <ErrorURL></ErrorURL>
</UK>

10

In order to improve the performance of the API Gateway, the consent validation responses for account information retrieval calls are cached.

<EnableConsentValidationCache>: Determines whether or not the consent validation cache is enabled at the API Gateway.
<ConsentValidationCacheExpiry>: The expiry time for the consent validation info cache, in seconds.
<DefaultCacheTimeout>: The time in which the cache times out, in seconds.

Code Block

language	xml

<UK>
  <Cache>
    <EnableConsentValidationCache>true</EnableConsentValidationCache>
    <ConsentValidationCacheExpiry>900</ConsentValidationCacheExpiry>
    <DefaultCacheTimeout>120000</DefaultCacheTimeout>
  </Cache>
</UK>

11

In the AISP flow, when the TPP invokes the account retrieval APIs, they can either use the /accounts/{consentId} or /accounts/{accountId}.

If they want to use consentId, the UseConsentIdInPath must be changed to true. By default, it works with the accountId.

Code Block

language	xml

<UK>
  <UseConsentIdInPath>false</UseConsentIdInPath>
</UK>

12

The following configuration is used to handle release management of the deployed API specifications.

E.g., If the resource is created using the API specification version v2.0, that resource can only be accessible accessed using API specifications v2.0 and above.

Code Block

language	xml

<UK>
  <UK110SupportedSpecsToRequest>UK110<UK200SupportedSpecsToRequest>UK200|UK200|UK300</UK110SupportedSpecsToRequest>
  <UK200SupportedSpecsToRequest>UK200|UK300</UK200SupportedSpecsToRequest>
  <UK300SupportedSpecsToRequest>UK300</UK300SupportedSpecsToRequest>
</UK200SupportedSpecsToRequest>
</UK>

13

Account permissions not supported by the ASPSP can be restricted for the TPP by specifying one or more permissions separated by a pipe (|). By default, no permissions are restricted.

E.g. ReadOffers|ReadPAN|ReadParty|ReadPartyPSU

Code Block

language	xml

<UK>
  <RestrictedPermissions><<RestrictedPermissions>ReadOffers</RestrictedPermissions>
</UK>

14

<TokenAuthentication>: The supported authentication methods for the token endpoint.
<ConnectionTimeout> and <ReadTimeout>: The time out values when connecting to the JWKS endpoint of the Open Banking directory to retrieve the JSON web keys related to the TPP.
<EndPointURL>: The endpoint URLs to access the REST APIs of the API Manager in order to create the application and service provider, and generate keys for the application.
<EnableURIValidation>: If true, validate the policy, client, terms of service, and logo URIs.
<EnableHostNameValidation>: True or false can be set as values to check the hostname of policy, client, terms of service, and logo uris against the hostname of redirect uri.
<APISubscriptions>: Specify the context of the APIs that need to subscribe when the TPP registers through DCR.

Code Block

language	xml

WSO2 Open Banking supports Dynamic Client Registration (DCR) v1.0.0 and v3.2. According to the DCR version you run, configure the following under the <Server> element:

Localtab Group

Localtab

title	v1.0.0

Multiexcerpt

MultiExcerptName	DCRv1.0.0

Code Block

language	xml

<DCR>
	<TokenAuthentication>
		<Method>private_key_jwt</Method>

<Method>client

<Method>tls_

secret

client_

basic<

auth</Method>

	</TokenAuthentication>

<!--the connection and read time out values for retrieving the remote jwks to validate the ssa and request jwt signatures during tpp

registration-->

<ConnectionTimeout>0</ConnectionTimeout>

<ReadTimeout>0</ReadTimeout>
	<EndPointURL>

<EndPointURL> <ServiceProviderCreation>/client-registration/v0.14/register</ServiceProviderCreation> <Application>/

<ServiceProviderCreation>/client-registration/v0.14/register</ServiceProviderCreation>
		<Application>/api/am/store/v0.14/applications</Application>

<Token>/token</Token>

<KeyGeneration>/api/am/store/v0.14/applications/generate-keys</KeyGeneration>

		<ApiSearch>/api/am/store/v0.14/apis</ApiSearch>

		<ApiSubscribe>/api/am/store/v0.14/subscriptions/multiple</ApiSubscribe>

</EndPointURL>

<EnableURIValidation>false</EnableURIValidation>
	<EnableHostNameValidation>false</EnableHostNameValidation>
	<APISubscriptions>

<PISP>

			<APIContext>/open-banking/v3.1/pisp</APIContext>

			<APIContext>/open-banking/v3.0/pisp</APIContext>

<APIContext>/open-banking/v2.0/pisp</APIContext>

		</PISP>

		<AISP>

<APIContext>/open-banking/v3.1/aisp</APIContext>

<APIContext>/open-banking/v3.0/aisp</APIContext>

<APIContext>/open-banking/v2.0/aisp</APIContext>

</AISP>

</APISubscriptions>

<EnableHostNameValidation>false</EnableHostNameValidation> </DCR> </UK>

15

<MaximumInstructedAmount>: The maximum instructed amount allowed.
<PermittedFrequencyPattern>: Frequency patterns that are supported by the ASPSP can be configured as a regex pattern separated by a pipe (|). By default, the ^(EvryDay)$|^(EvryWorkgDay)$|^(IntrvlWkDay:0[1-9]:0[1-7])$|^(WkInMnthDay:0[1-5]:0[1-7])$|^(IntrvlMnthDay:(0[1-6]|12|24):(-0[1-5]|0[1-9]|[12][0-9]|3[01]))$|^(QtrDay:(ENGLISH|SCOTTISH|RECEIVED))$ regex is supported. If you want to change the default pattern, configure the regex pattern.
<AllowedAmountPattern>: The allowed pattern for payment amount in domestic stading orders. Default pattern is ^\d{1,13}\.\d{1,5}$
<AllowedCurrencyPattern>: The allowed currency pattern for domestic standing orders. Default pattern is ^[A-Z]{3,3}$
<MaximumFuturePaymentDays>: The maximum future date of a scheduled-payment.

Code Block

language	xml

<UK> <PaymentRestrictions> <MaximumInstructedAmount>1000.00</MaximumInstructedAmount> <!--Frequency patterns that are supported by the ASPSP can be configured as a regex pattern separated by a pipe (|). By default,

<UseSoftwareIdAsApplicationName>true</UseSoftwareIdAsApplicationName>
	<JwksUrlSandbox>https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks</JwksUrlSandbox>
	<JwksUrlProduction>https://keystore.openbanking.org.uk/keystore/openbanking.jwks</JwksUrlProduction>
</DCR>

Localtab

title	v3.2

Multiexcerpt

MultiExcerptName	DCRV3.2

Code Block

language	xml

<DCR>
	<TokenAuthentication>
		<Method>private_key_jwt</Method>
		<Method>tls_client_auth</Method>
	</TokenAuthentication>
	<ConnectionTimeout>0</ConnectionTimeout>
	<ReadTimeout>0</ReadTimeout>
	<EnableURIValidation>false</EnableURIValidation>
	<EnableHostNameValidation>false</EnableHostNameValidation>
	<UseSoftwareIdAsApplicationName>true</UseSoftwareIdAsApplicationName>
	<JwksUrlSandbox>https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks</JwksUrlSandbox>
	<JwksUrlProduction>https://keystore.openbanking.org.uk/keystore/openbanking.jwks</JwksUrlProduction>
</DCR>

Multiexcerpt

MultiExcerptName	DCRparameterDescriptions

Expand

title	Click here to see the parameter descriptions for the above-mentioned parameters...

<TokenAuthentication>: The supported authentication methods for the token endpoint. Possible values are private_key_jwt and tls_client_auth .
<ConnectionTimeout> and <ReadTimeout>: The time out values when connecting to the JWKS endpoint of the Open Banking directory to retrieve the JSON web keys related to the TPP.
<EndPointURL>: The endpoint URLs to access the REST APIs of the API Manager in order to create the application and service provider, and generate keys for the application.
<EnableURIValidation>: If true, validate the policy, client, terms of service, and logo URIs.
<EnableHostNameValidation>: True or false can be set as values to check the hostname of policy, client, terms of service, and logo URIs against the hostname of redirect URI.
<APISubscriptions>: Specify the context of the APIs that need to subscribe when the TPP registers through DCR.
<UseSoftwareIdAsApplicationName>: Set the <UseSoftwareIdAsApplicationName> to true to use SoftwareID in SSA as the name of the application.

15

<MaximumInstructedAmount>: The maximum instructed amount allowed.
<PermittedFrequencyPattern>: Frequency patterns that are supported by the ASPSP can be configured as a regex pattern separated by a pipe (|). By default, the ^(EvryDay)$|^(EvryWorkgDay)$|^(IntrvlWkDay:0[1-9]:0[1-7])$|^(WkInMnthDay:0[1-5]:0[1-7])$|^(IntrvlMnthDay:(0[1-6]|12|24):(-0[1-5]|0[1-9]|[12][0-9]|3[01]))$|^(QtrDay:(ENGLISH|SCOTTISH|RECEIVED))$

regex is

regex is supported.

If

you

want

to

change

the

default

pattern uncomment the following configuration and configure the regex pattern <PermittedFrequencyPattern></PermittedFrequencyPattern> before v1.3.0, there was a configuration to configure restricted frequency pattern. But it is now deprecated <RestrictedFrequencyPattern></RestrictedFrequencyPattern> -->

pattern, configure the regex pattern.
<AllowedAmountPattern>: The allowed pattern for payment amount in domestic stading orders. Default pattern is ^\d{1,13}\.\d{1,5}$
<AllowedCurrencyPattern>: The allowed currency pattern for domestic standing orders. Default pattern is ^[A-Z]{3,3}$
<MaximumFuturePaymentDays>: The maximum future date of a scheduled-payment.

Code Block

language	xml

<UK>
<PaymentRestrictions>
    <MaximumInstructedAmount>1000.00</MaximumInstructedAmount>

    <!--TheFrequency allowedpatterns patternthat forare configuringsupported by the amountASPSP forcan domesticbe standing orders-->
   <!-- <AllowedAmountPattern></AllowedAmountPattern>-->configured as a regex pattern separated by
    a <!--The allowed pattern for configuring the currency for domestic scheduled payments-->
    <!--<AllowedCurrencyPattern></AllowedCurrencyPattern>-->

    <MaximumFuturePaymentDays>90</MaximumFuturePaymentDays>
    ...
</PaymentRestrictions>
</UK>

16

<CutOffDateTime>.<Enabled>: Set to true if the bank wants to enforce the CutOffDateTime behaviour for the payments.

<CutOffDateTime>.<CutOffDateTimePolicy>: Specify the preferred approach to handle the CutOffDateTime behaviour

<CutOffDateTime>.<DailyCutOffTime>: The daily request cut off time.

<CutOffDateTime>.<ExpectedExecutionTime>: If the SelectedPolicy is set to ACCEPT, the expected execution time for the next day.

<CutOffDateTime>.<ExpectedSettlementTime>: If the SelectedPolicy is set to ACCEPT, the expected settlement time for the next day.

Code Block

language	xml

<UK>
<PaymentRestrictions>pipe (|). By default, ^(EvryDay)$|^(EvryWorkgDay)$|^(IntrvlWkDay:0[1-9]:0[1-7])$|^(WkInMnthDay:0[1-5]:0[1-7])$|^(IntrvlMnthDay:(0[1-6]|12|24):(-0[1-5]|0[1-9]|[12][0-9]|3[01]))$|^(QtrDay:(ENGLISH|SCOTTISH|RECEIVED))$
    regex is supported. If you want to change the default pattern uncomment the following configuration
    and configure the regex pattern
    <PermittedFrequencyPattern></PermittedFrequencyPattern>
    before v1.3.0, there was a configuration to configure restricted frequency pattern.
    But it is now deprecated <RestrictedFrequencyPattern></RestrictedFrequencyPattern> -->

    <!--The allowed pattern for configuring the amount for domestic standing orders-->
   <!-- <AllowedAmountPattern></AllowedAmountPattern>-->

    <!--The allowed pattern for configuring Configurationsthe regardingcurrency thefor handlingdomestic of Payment requests after a cut off DateTime
    scheduled payments-->
    <CutOffDateTime>
   
    <!--IsEnabled denotes whether a CutOffDateTime is to be enforced by the ASPSP <AllowedCurrencyPattern></AllowedCurrencyPattern>-->

       <Enabled>false</Enabled><MaximumFuturePaymentDays>90</MaximumFuturePaymentDays>
    ...
</PaymentRestrictions>
  <!--SelectedPolicy denotes the preferred Approach to handling requests past the CutOffDateTime.
         Allowed values are:
         1. REJECT - Reject all requests arriving past the DateTime value
         2. ACCEPT - Accept all requests arriving past the DateTime value and return ExpectedExecutionDateTime
         and ExpectedSettlementDateTime.
        </UK>

16

<CutOffDateTime>.<Enabled>: Set to true if the bank wants to enforce the CutOffDateTime behaviour for the payments.

<CutOffDateTime>.<CutOffDateTimePolicy>: Specify the preferred approach to handle the CutOffDateTime behaviour

<CutOffDateTime>.<DailyCutOffTime>: The daily request cut off time.

<CutOffDateTime>.<ExpectedExecutionTime>: If the SelectedPolicy is set to ACCEPT, the expected execution time for the next day.

<CutOffDateTime>.<ExpectedSettlementTime>: If the SelectedPolicy is set to ACCEPT, the expected settlement time for the next day.

Code Block

language	xml

<UK>
<PaymentRestrictions>
    <!--
    Configurations regarding the handling of Payment requests after a cut off DateTime
    -->
    <CutOffDateTime>
        <!--IsEnabled denotes whether a CutOffDateTime is to be enforced by the ASPSP -->
        <CutOffDateTimePolicy>REJECT<<Enabled>true</CutOffDateTimePolicy>Enabled>
        <!--ExpectedSelectedPolicy formatdenotes forthe allpreferred datesApproach - hh:mm:ss.ffffff+|-hh:mm -->
  to handling requests past the CutOffDateTime.
     <!--The Daily time requests areAllowed tovalues beare:
cut off at -->      1. REJECT  <DailyCutOffTime>17:30:00+00:00</DailyCutOffTime>- Reject all requests arriving past the DateTime value
         2. ACCEPT <!--Need Accept toall berequests setarriving ifpast the SelectedPolicyDateTime isvalue setand toreturn ACCEPT.ExpectedExecutionDateTime
         and ExpectedSettlementDateTime.
 The ExpectedExecutionTime and the ExpectedSettlementTime for the next day -->
        <ExpectedExecutionTime>10:00:00+00:00</ExpectedExecutionTime><CutOffDateTimePolicy>REJECT</CutOffDateTimePolicy>
        <ExpectedSettlementTime>11:00:00+00:00</ExpectedSettlementTime><!--Expected format for all dates - hh:mm:ss.ffffff+|-hh:mm -->
        </CutOffDateTime>
</PaymentRestrictions>
<UK>

17

The expiry time for the issuer certificate and the subjectDN of the sent transport certificate stored in cache.

Code Block

language	xml

<UK>
  <CertificateValidationCacheExpiry>3600</CertificateValidationCacheExpiry>
</UK>

18

In consent re-authentication of the accounts flow, during authorisation, the PSU is allowed to change the selected account. If the <EnableAccountUpdateByPSU> property is set to true, the account bound to the consent is updated during re-authentication. If set to false, the account is not updated.

Code Block

language	xml

<UK>
  <ConsentReAuthentication>
    <EnableAccountUpdateByPSU>false</EnableAccountUpdateByPSU>
  </ConsentReAuthentication>
</UK>

19

If Mutual Transport Layer Security (MTLS) is terminated before the request reaches the Gateway, retrieve the TPP's certificate from the MTLS session and include as a transport certificate header. By default, the gateway expects ssl.client.auth.cert.X509 as the transport header. Include the value for the transport certificate header in TransportCertificateHeader under CertificateManagementelement. See the sample configuration below. <CertificateManagement>

!--The Daily time requests are to be cut off at -->
        <DailyCutOffTime>17:30:00+00:00</DailyCutOffTime>
        <!--Need to be set if the SelectedPolicy is set to ACCEPT.
            The ExpectedExecutionTime and the ExpectedSettlementTime for the next day -->

<!-- In order to enable the client certificate validation feature (Certificate Expiry, Signature and Revocation validation during MTLS), the following module needs to be engaged under the "Global Engaged Modules" section in the axis2.xml file. <module ref="mtlscertvalidator"/>

<ExpectedExecutionTime>10:00:00+00:00</ExpectedExecutionTime>
        <ExpectedSettlementTime>11:00:00+00:00</ExpectedSettlementTime>
    </CutOffDateTime>
</PaymentRestrictions>
<UK>

Multiexcerpt

MultiExcerptName	EnablingMTLSIntro

Multiexcerpt

MultiExcerptName	EnablingMTLSconfigs

Code Block

language	xml

17

The expiry time for the issuer certificate and the subjectDN of the sent transport certificate stored in cache.

Code Block

language	xml

<UK>
  <CertificateValidationCacheExpiry>3600</CertificateValidationCacheExpiry>
</UK>

18

In consent re-authentication of the accounts flow, during authorisation, the PSU is allowed to change the selected account. If the <EnableAccountUpdateByPSU> property is set to true, the account bound to the consent is updated during re-authentication. If set to false, the account is not updated.

Code Block

language	xml

<UK>
  <ConsentReAuthentication>
    <EnableAccountUpdateByPSU>false</EnableAccountUpdateByPSU>
  </ConsentReAuthentication>
</UK>

19

Multiexcerpt

MultiExcerptName	EnablingMTLSIntro

If Mutual Transport Layer Security (MTLS) is terminated before the request reaches the Gateway, retrieve the TPP's certificate from the MTLS session and include as a transport certificate header. By default, the gateway expects ssl.client.auth.cert.X509 as the transport header. Include the value for the transport certificate header in TransportCertificateHeader under CertificateManagement element. See the sample configuration below.

Multiexcerpt

MultiExcerptName	EnablingMTLSconfigs

Code Block

language	xml

 <CertificateManagement>
        <!--> In order to enable the client certificate validation  <!--Set the value of the transport certificate header sent in the request if MTLS is terminated before the
        gateway default value is ssl.client.auth.cert.X509feature (Certificate Expiry, Signature and
        Revocation validation during MTLS), the following module needs to be engaged under the "Global Engaged
        Modules" section in the axis2.xml file.

        <module ref="mtlscertvalidator"/>
        -->

       <TransportCertificateHeader>ssl.client.auth.cert.X509</TransportCertificateHeader>
</CertificateManagement>

Warning

The load

 <!--Set the value of the transport certificate header sent in the request if MTLS is terminated before the
        gateway default value is ssl.client.auth.cert.X509-->
        <TransportCertificateHeader>ssl.client.auth.cert.X509</TransportCertificateHeader>
</CertificateManagement>

Warning

The load balancer should not allow the TPP to send its certificate as a transport certificate header that is configured in the open-banking.xml under <TransportCertificateHeader> element.

If such header was found in the TPP’s request, it is mandatory to remove that header from the TPP’s request. This is applicable even when the MTLS session is not terminated at the load balancer.

When TLS is terminated before reaching the Gateway, to send the client certificate as a transport header, use the following configuration, which is placed just above the <TransportCertificateHeader> tag:

Code Block

language	xml

<ClientTransportCertAsHeaderEnabled>true</ClientTransportCertAsHeaderEnabled>

20

In order to enable certificate revocation validation for API security, make sure that the following configurations are added under the server root element.

Code Block

language	xml

<CertificateManagement>
	<!-- Expiry time for the cache (in seconds) for storing the validation result of the certificates-->
	<ClientCertificateCacheExpiry>3600</ClientCertificateCacheExpiry>
	<!-- Enable/Disable certificate OCSP and CRL validation. Default value has been set to true -->
	<CertificateRevocationValidationEnabled>true</CertificateRevocationValidationEnabled>
</CertificateManagement>

21

<SigningConfiguration>: This configuration applies to request signing for x-jws-signature.
<Enable>: Determines whether or not to enable signing.
<TrustedAnchors>: The trusted anchor configuration. OBIE-specific trust anchor definitions.
<TrustedAnchors>.<Signing>: The trust anchor used in signing JOSE.
<TrustedAnchors>.<Validation>: Multiple values supported with the | delimiter. For example, trustanchor.org|trustanchor.org.uk
<OrganizationId>: The OBIE organization ID.
<Algorithm>: The default signing algorithm is RS256. To support other algorithms, uncomment this property and specify the value.
<MandatedAPIs> : Define the API contexts that require x-jws-signature verification

Code Block

language	xml

<UK>
<SigningConfiguration>
    <!-- Enable Signing -->
    <Enable>true</Enable>
    <OBIE> -->
	<CertificateRevocationValidationEnabled>true</CertificateRevocationValidationEnabled>

        <!-- Proxy server configuration to do TPP certificate revocation checks -->
        <CertificateRevocationProxy>
            <Enabled>false</Enabled>
            <ProxyHost>PROXY_HOSTNAME</ProxyHost>
            <ProxyPort>8080</ProxyPort>
        </CertificateRevocationProxy>

	<!--Manager class implementation responsible for verifying certificate revocation status-->
    Trusted Anchor Configuration  <RevocationValidationManagerImplClass>com.wso2.finance.open.banking.gateway.common.mtls.cert.validation.service.CertRevocationValidationManagerImpl</RevocationValidationManagerImplClass>

         openbanking.org.uk specific Trust Anchor definitions
        -->
<!-- Retry count for validating certificate OCSP and CRL revocation status -->
	<CertificateRevocationValidationRetryCount>3</CertificateRevocationValidationRetryCount>

      <TrustedAnchors>  <!-- List of issuer DNs whose issued certificates needs to be skipped <!-- Trust Anchor used in signing JOSE -->from certificate revocation
        validation.
        <Signing>openbankinge.org.uk</Signing>
   g. <IssuerDN>CN=Test Pre-Production Issuing CA, O=Test, C=GB</IssuerDN>
        <!-->
        <RevocationValidationExcludedIssuers>
			<IssuerDN></IssuerDN>
      Multiple values supported with `|` delimiter
                IE - trustanchor.org|trustanchor.org.uk
            -->
            <Validation>openbanking.org.uk</Validation>
        </TrustedAnchors>
        <!-- OBIE Organization Id</RevocationValidationExcludedIssuers>
</CertificateManagement>

21

<SigningConfiguration>: This configuration applies to request signing for x-jws-signature.
<Enable>: Determines whether or not to enable signing.
<TrustedAnchors>: The trusted anchor configuration. OBIE-specific trust anchor definitions.
<TrustedAnchors>.<Signing>: The trust anchor used in signing JOSE.
<TrustedAnchors>.<Validation>: Multiple values supported with the | delimiter. For example, trustanchor.org|trustanchor.org.uk
<OrganizationId>: The OBIE organization ID.
<Algorithm>: The default signing algorithm is RS256. To support other algorithms, uncomment this property and specify the value.
<MandatedAPIs> : Define the API contexts that require x-jws-signature verification

Code Block

language	xml

<UK>
<SigningConfiguration>
    <!-- Enable Signing -->
    <Enable>false</Enable>
   <OrganizationId>ABC1234</OrganizationId> <OBIE>
   </OBIE>     <!--
Default Singing Algorithm is PS256, to support others uncomment line below --> Trusted Anchor Configuration
   <!--<Algorithm>RS256</Algorithm>-->         openbanking.org.uk specific <!-- The following specified APIs will be mandated for message signing.Trust Anchor definitions
        -->

   <MandatedAPIs>     <TrustedAnchors>
   <APIContext>/open-banking/v3.0/event-notification/</APIContext>         <APIContext>/open-banking/v3.0/pisp/</APIContext>
        <APIContext>/open-banking/v3.1/event-notification/</APIContext><!-- Trust Anchor used in signing JOSE -->
            <Signing>openbanking.org.uk</Signing>
            <!--
         <APIContext>/open-banking/v3.1/pisp/</APIContext>     </MandatedAPIs> </SigningConfiguration>
<UK>

AnchorsigningCertificateConfigssigningCertificateConfigs

22

Add the following configurations that specify the allowed signature algorithms in TPP requests. With this configuration, WSO2 Open Banking rejects the JWTs signed in algorithms that are not in the following list. If the configuration is not added, no validation occurs and any algorithm is passed through. Allowed values are;

PS256

Code Block

language	xml

<UK>
	<AllowedInboundSignatureAlgorithms>
		<Algorithm>PS256</Algorithm>
	</AllowedInboundSignatureAlgorithms>
</UK>

23

By default, two factors (basic, and smsotp) are configured to engage when a TPP creates an application and generates keys. If you want to configure a different authentication factor as the second authentication factor, configure that authenticator as a federated authentication in WSO2_OB_KM and configure the name here.

Code Block

language	xml

<SCA>
  <IdpName>SMSAuthentication</IdpName>
</SCA>

24

Determines whether or not ACR is enabled.

Code Block

language	xml

<ACREnabled>false</ACREnabled>

25

<Server>: The server key configuration used for message signing purposes.
<Server>.<SigningCertificateAlias>: The certificate is under this alias.
<Server>.<SigningCertificateKid>: The KID value for signing the certificate.
<JWKS-Retriever>.<SizeLimit>: Maximum size limit for remote JWKSet retrieval.
<JWKS-Retriever>.<ConnectionTimeout>: Connection timeout for remote JWKSet retrieval.
<JWKS-Retriever>.<ReadTimeout>: Content read timeout for remote JWKSet retrieval.
<Cache>.<ModifiedExpiryMinutes>: JWKSet/Certificate cache after modification expiry time, in minutes.
<Cache>.<AccessedExpiryMinutes>: JWKSet/Certificate cache after accessed expiry time, in minutes.

AnchorOBIdentityRetrieverOBIdentityRetriever

Code Block

language	xml

<OBIdentityRetriever>
    <!--
        Server Key configuration
        used for singing purposes IE - message signing
     Multiple values supported with `|` delimiter
                IE - trustanchor.org|trustanchor.org.uk
            -->
            <Validation>openbanking.org.uk</Validation>
        </TrustedAnchors>
        <!-- OBIE Organization Id -->
        <OrganizationId>ABC1234</OrganizationId>
    </OBIE>
    <!-- Default Singing Algorithm is PS256, to support others uncomment line below -->
    <!--<Algorithm>RS256</Algorithm>-->

    <!-- The following specified APIs will be mandated for message signing. -->
    <Server><MandatedAPIs>
        <!-- alias the certificate is under --><APIContext>/open-banking/v3.0/event-notification/</APIContext>
          <SigningCertificateAlias>wso2carbon</SigningCertificateAlias><APIContext>/open-banking/v3.0/pisp/</APIContext>
        <!-- KID value for signing certificate -->
 <APIContext>/open-banking/v3.1/event-notification/</APIContext>
        <APIContext>/open-banking/v3.1/pisp/</APIContext>
    </MandatedAPIs>
</SigningConfiguration>
<SigningCertificateKid>1234</SigningCertificateKid>
    </Server>
    <JWKS-Retriever>
        <SizeLimit>51200</SizeLimit>
        <ConnectionTimeout>2000</ConnectionTimeout>
        <ReadTimeout>2000</ReadTimeout>
    </JWKS-Retriever>
    <!-- Cache Configuration for Identity Retriever Cache -->
    <Cache>
        <ModifiedExpiryMinutes>15</ModifiedExpiryMinutes>
        <AccessedExpiryMinutes>15</AccessedExpiryMinutes>
    </Cache>
</OBIdentityRetriever>

26

Debitor account validation checks the debitor account for the PSU in the initiation request.

Parameter	Description
true	Disables the debtor account validation to check if the debtor account for the PSU that is sent in the initiation request is valid.
false	The bank back end checks if a valid account is sent as the debtor account when initiating the consent. Returns only valid account when calling payable accounts endpoint during authentication to retrieve the endpoints.

Code Block

language	xml

<!-- Configuration to disable debtor account validation in payments -->
<ValidateDebtorAccount>true</ValidateDebtorAccount>

27

ASPSP supports payment data permissions that give access to the TPP by specifying one or more permissions to access payment information, separated by a pipe(l).

By default, create permission is granted.

Code Block

language	xml

<DataPermission>Create</DataPermission>

28

This is for the Data Reporting feature, to enable data publishing set the <Enabled> property value to true. So, the WSO2 Open Banking Business Intelligence can capture and summarize data. Replace the <WSO2_OB_BI_HOSTNAME> placeholder with the hostname of Open Banking Business Intelligence server.

Code Block

language	xml

<DataPublishing>
	<!-- Include all configurations related to Data publishing -->
	<!-- Enable data publishing in WSO2 Open Banking-->
	<Enabled>true</Enabled>
	<!-- Server URL of the remote BI server used to collect statistics. Must
            be specified in protocol://hostname:port/ format. -->
	<ServerURL>{tcp<UK>

Anchor

	signingCertificateConfigs
	signingCertificateConfigs

Info

title	JWS validation support for Waiver 007

This is available only as a WUM update and is effective from July 06, 2020 (07-06-2020). For more information on updating WSO2 Open Banking, see Updating WSO2 Products.

Add the following configurations under the <SigningConfiguration> tag.

Code Block

language	xml

<!-- The following specified APIs will be associated with response signing. -->
<ResponseSignatureRequiredAPIs>
    <APIContext>/open-banking/v3.0/pisp/</APIContext>
    <APIContext>/open-banking/v3.1/pisp/</APIContext>
</ResponseSignatureRequiredAPIs>

Configure the following <OBIdentityRetriever> properties.

Code Block

language	xml

<OBIdentityRetriever>
    <!--
           Server Key configuration
           used for singing purposes IE - message signing
       -->
    <Server>
        <!-- alias the certificate used for signing (in repository/resources/security/wso2carbon.jks)-->
        <SigningCertificateAlias>wso2carbon</SigningCertificateAlias>
        <!-- KID value for primary signing certificate that is exposed by the JWKS endpoint under OIDC well-known endpoint (by default https://localhost:8243/.well-known/openid-configuration) -->
        <SigningCertificateKid></SigningCertificateKid>
    </Server>
</OBIdentityRetriever>

See JSON Web Signature (JWS) to configure JWS validation support for Waiver 007.

22

Add the following configurations that specify the allowed signature algorithms in TPP requests. With this configuration, WSO2 Open Banking rejects the JWTs signed in algorithms that are not in the following list. If the configuration is not added, no validation occurs and any algorithm is passed through. Allowed values are;

PS256

Code Block

language	xml

<UK>
	<AllowedInboundSignatureAlgorithms>
		<Algorithm>PS256</Algorithm>
	</AllowedInboundSignatureAlgorithms>
</UK>

23

To use a custom value for the LocalInstrument attribute in Payment API:

By default, the following configurations are disabled. To enable, uncomment the following and add relevant custom values. These custom values represent a local instrument or a local clearing option.

The <CustomValue> tag supports default local instrument values as well as defined custom values.

Code Block

language	xml

<CustomLocalInstrumentValues>
	<Enabled>true</Enabled>
	<CustomValues>
		<CustomValue>CustomLocalInstrument1</CustomValue>
		<CustomValue>CustomLocalInstrument2</CustomValue>
	</CustomValues>
</CustomLocalInstrumentValues>

24

By default, two factors (basic, and smsotp) are configured to engage when a TPP creates an application and generates keys. If you want to configure a different authentication factor as the second authentication factor, configure that authenticator as a federated authentication in WSO2_OB_KM and configure the name here.

Code Block

language	xml

<SCA>
  <IdpName>SMSAuthentication</IdpName>
</SCA>

25

Determines whether or not ACR is enabled.

Code Block

language	xml

<ACREnabled>false</ACREnabled>

26

<Server>: The server key configuration used for message signing purposes.
<Server>.<SigningCertificateAlias>: The certificate is under this alias.
<Server>.<SigningCertificateKid>: The KID value for signing the certificate.
<JWKS-Retriever>.<SizeLimit>: Maximum size limit for remote JWKSet retrieval.
<JWKS-Retriever>.<ConnectionTimeout>: Connection timeout for remote JWKSet retrieval.
<JWKS-Retriever>.<ReadTimeout>: Content read timeout for remote JWKSet retrieval.
<Cache>.<ModifiedExpiryMinutes>: JWKSet/Certificate cache after modification expiry time, in minutes.
<Cache>.<AccessedExpiryMinutes>: JWKSet/Certificate cache after accessed expiry time, in minutes.

Anchor

	OBIdentityRetriever
	OBIdentityRetriever

Code Block

language	xml

<OBIdentityRetriever>
    <!--
        Server Key configuration
        used for singing purposes IE - message signing
    -->
    <Server>
        <!-- alias the certificate is under -->
        <SigningCertificateAlias>wso2carbon</SigningCertificateAlias>
        <!-- KID value for signing certificate -->
        <SigningCertificateKid>1234</SigningCertificateKid>
    </Server>
    <JWKS-Retriever>
        <SizeLimit>51200</SizeLimit>
        <ConnectionTimeout>2000</ConnectionTimeout>
        <ReadTimeout>2000</ReadTimeout>
    </JWKS-Retriever>
    <!-- Cache Configuration for Identity Retriever Cache -->
    <Cache>
        <ModifiedExpiryMinutes>15</ModifiedExpiryMinutes>
        <AccessedExpiryMinutes>15</AccessedExpiryMinutes>
    </Cache>
</OBIdentityRetriever>

27

Debitor account validation checks the debitor account for the PSU in the initiation request.

Parameter	Description
true	Disables the debtor account validation to check if the debtor account for the PSU that is sent in the initiation request is valid.
false	The bank back end checks if a valid account is sent as the debtor account when initiating the consent. Returns only valid account when calling payable accounts endpoint during authentication to retrieve the endpoints.

Code Block

language	xml

<!-- Configuration to disable debtor account validation in payments -->
<ValidateDebtorAccount>true</ValidateDebtorAccount>

28

ASPSP supports payment data permissions that give access to the TPP by specifying one or more permissions to access payment information, separated by a pipe(l).

By default, create permission is granted.

Code Block

language	xml

<DataPermission>Create</DataPermission>

29

This is for the Data Reporting feature, to enable data publishing set the <Enabled> property value to true. So, the WSO2 Open Banking Business Intelligence can capture and summarize data. Replace the <WSO2_OB_BI_HOSTNAME> placeholder with the hostname of Open Banking Business Intelligence server.

Code Block

language	xml

<DataPublishing>
	<!-- Include all configurations related to Data publishing -->
	<!-- Enable data publishing in WSO2 Open Banking-->
	<Enabled>true</Enabled>
	<!-- Server URL of the remote BI server used to collect statistics. Must
            be specified in protocol://hostname:port/ format. -->
	<ServerURL>{tcp://<WSO2_OB_BI_HOST>:7612}</ServerURL>
	<!-- Administrator username to login to the BI server for data publishing. -->
	<Username>[email protected]@carbon.super</Username>
	<!-- Administrator password to login to the BI server for data publishing. -->
	<Password>wso2123</Password>
</DataPublishing>

30

To enable Transaction Risk Analysis, set the <IsEnabled> property under <TRA> to true. Replace the <WSO2_OB_BI_HOST> place holder with the hostname of Open Banking Business Intelligence server. Use the <AccountValidationEnabled> and <PaymentValidationEnabled> properties to enable TRA for Accounts and Payments respectively.

Code Block

language	xml

<TRA>
	<!-- Include all configurations related to Transaction Risk Analysis -->
	<!-- Enable TRA in WSO2 Open Banking-->
	<IsEnabled>true</IsEnabled>
	<!-- following configurations are used to enable TRA for specific flows only-->
	<!-- Enable TRA for Payments-->
	<PaymentValidationEnabled>true</PaymentValidationEnabled>
	<!-- Enable TRA for Accounts-->
	<AccountValidationEnabled>true</AccountValidationEnabled>
	<!-- Configurations related to TRA Receivers-->
	<Receivers>
		<!-- Administrator username to login to the remote BI server. -->
		<Username>[email protected]@carbon.super</Username>
		<!-- Administrator password to login to the remote BI server. -->
		<Password>wso2123</Password>
		<!-- Receiver URLs of the Siddhi Apps used to validate for TRA.-->
		<TRAAccountValidationURL>http://<WSO2_OB_BI_HOST>:8007/TRAAccountValidationApp/TRAValidationStream</TRAAccountValidationURL>
		<TRAPaymentValidationURL>http://<WSO2_OB_BI_HOST>:7612}</ServerURL>
	<!-- Administrator username to login to the BI server for data publishing. -->
	<Username>[email protected]@carbon.super</Username>
	<!-- Administrator password to login to the BI server for data publishing. -->
	<Password>wso2123</Password>
</DataPublishing>

29

To enable Transaction Risk Analysis, set the <IsEnabled> property under <TRA>

8007/TRAPaymentValidationApp/TRAValidationStream</TRAPaymentValidationURL>
	</Receivers>
	<TimePeriodOfRecurringPayment>90</TimePeriodOfRecurringPayment>
	<MaxFrequencyOfTransactionsWithoutSCA>5</MaxFrequencyOfTransactionsWithoutSCA>
	<TotalAmountLimitOfTransactionsWithoutSCA>100</TotalAmountLimitOfTransactionsWithoutSCA>
	<LastSCATimeLimit>90</LastSCATimeLimit>
	<TransactionAmountLimit>30</TransactionAmountLimit>
    <!-- Number of maximum days of transaction history that can be accessed with the first-time consent use for Berlin.-->
    <FirstAccessHistoryLimit>90</FirstAccessHistoryLimit>
</TRA>

31

You can enable the Fraud Detection feature by setting the <IsEnabled> value to true. Replace the <WSO2_OB_BI_HOST> place holder placeholder with the hostname of WSO2 Open Banking Business Intelligence server. Use the <AccountValidationEnabled> and <PaymentValidationEnabled> properties to enable TRA for Accounts and Payments respectivelyserver.

Code Block

language	xml

<TRA><FraudDetection>
	<!-- Include all configurations related to TransactionFraud Risk AnalysisDetection -->
	<!-- Enable TRA in WSO2 Open Banking-->
	<IsEnabled>true</IsEnabled>
	<!-- following configurations are used to enable TRA for specific flows only-->
	<!-- Enable TRA for Payments-->
	<PaymentValidationEnabled>true</PaymentValidationEnabled>
	<!-- Enable TRA for AccountsFD in WSO2 Open Banking-->
	<AccountValidationEnabled>true<<IsEnabled>true</AccountValidationEnabled>IsEnabled>
	<!-- Configurations related to TRAFD Receivers-->
	<Receivers>
		<!-- Administrator username to login to the remote BI server. -->
		<Username>[email protected]@carbon.super</Username>
		<!-- Administrator password to login to the remote BI server. -->
		<Password>wso2123</Password>
		<!-- Receiver URLs of the Siddhi Apps used to validate for TRAFD.-->
		<TRAAccountValidationURL>http<FraudDetectionURL>http://<WSO2_OB_BI_HOST>:8007/TRAAccountValidationApp/TRAValidationStream</TRAAccountValidationURL>
		<TRAPaymentValidationURL>http:///FraudDetectionApp/FraudDetectionStream</FraudDetectionURL>
		<InvalidSubmissionURL>http://<WSO2_OB_BI_HOST>:8006/InvalidSubmissionsApp/InvalidSubmissionsStream</InvalidSubmissionURL>
	</Receivers>
</FraudDetection>

32

By default, the Consent Management APIs are secured with basic authentication. To access the Consent Management APIs, use the default user or create a new user using the Key Manager Management Console.

Open the <WSO2_OB_

BI_HOST>:8007/TRAPaymentValidationApp/TRAValidationStream</TRAPaymentValidationURL> </Receivers> <TimePeriodOfRecurringPayment>90</TimePeriodOfRecurringPayment> <MaxFrequencyOfTransactionsWithoutSCA>5</MaxFrequencyOfTransactionsWithoutSCA> <TotalAmountLimitOfTransactionsWithoutSCA>100</TotalAmountLimitOfTransactionsWithoutSCA> <LastSCATimeLimit>90</LastSCATimeLimit> <TransactionAmountLimit>30</TransactionAmountLimit> </TRA>

30

You can enable the Fraud Detection feature by setting the <IsEnabled> value to true. Replace the <WSO2_OB_BI_HOST> placeholder with the hostname of WSO2 Open Banking Business Intelligence server.

APIM_HOME>/repository/conf/finance/open-banking.xml file.
Update the credentials under <APISecurity><Global> with the created user details.
By default, this is set to the username and password of the super admin.
Code Block
language xml
<APISecurity> <Global> <Username>[email protected]</Username> <Password>wso2123</Password> </Global> </APISecurity>

For more information, see configuring basic authentication for Consent Management APIs .

33

Anchor

	EnableMTLSaccesstoken
	EnableMTLSaccesstoken

By default, MTLS token binding is disabled in WSO2 Open Banking. To enable, locate <WSO2_OB_KM_HOME>/repository/conf/finance/open-banking.xml and change the <EnableMTLSTokenBinding> parameter value to true as follows:

By default, the Consent Management APIs are secured with basic authentication. To access the Consent Management APIs, use the default user or create a new user using the Key Manager Management Console.

Open the <WSO2_OB_APIM_HOME>/repository/conf/finance/open-banking.xml file.
Update the credentials under <APISecurity><Global> with the created user details.
By default, this is set to the username and password of the super admin.
Code Block
language xml
<APISecurity> <Global> <Username>[email protected]</Username> <Password>wso2123</Password> </Global> </APISecurity>

For more information, see configuring basic authentication for Consent Management APIs.

Code Block

language	xml

<FraudDetection>
	<!-- Include all configurations related to Fraud Detection -->
	<!-- Enable FD in WSO2 Open Banking-->
	<IsEnabled>true</IsEnabled>
	<!-- Configurations related to FD Receivers-->
	<Receivers>
		<!-- Administrator username to login to the remote BI server. -->
		<Username>[email protected]@carbon.super</Username>
		<!-- Administrator password to login to the remote BI server. -->
		<Password>wso2123</Password>
		<!-- Receiver URLs of the Siddhi Apps used to validate for FD.-->
		<FraudDetectionURL>http://<WSO2_OB_BI_HOST>:8007/FraudDetectionApp/FraudDetectionStream</FraudDetectionURL>
		<InvalidSubmissionURL>http://<WSO2_OB_BI_HOST>:8006/InvalidSubmissionsApp/InvalidSubmissionsStream</InvalidSubmissionURL>
	</Receivers>
</FraudDetection>

31

<APISecurity>
     <EnableMTLSTokenBinding>true</EnableMTLSTokenBinding>
</APISecurity>

Upon enabling the feature, you need to configure the client certificate header name in the <ClientAuthenticationHeader> parameter under <CertificateManagement>:

Code Block

language	xml

<CertificateManagement>
         <!--Mutual TLS Authenticator Certificate header-->
      <ClientAuthenticationHeader>x-wso2-mutual-auth-cert</ClientAuthenticationHeader>
 </CertificateManagement>

In addition to the above steps, follow the instructions described under MTLS bound access token .

34

To enforce regulatory certificates for API invocations, add the following configuration under the <CertificateManagement> tag:

Info
This is available only as a WUM update and is effective from February 11, 2021 (02-11-2021). For more information on updating WSO2 Open Banking, see Updating WSO2 Products.

Code Block

language	xml

<EnforceRegulatoryCertificates>true</EnforceRegulatoryCertificates>

Once you add the configuration, you can add the eIDAS certificates to the client trust stores as described in eIDAS Implementation for PSD2 Compliance .

35

For Open Banking Standard v3.1.10:

Previously the Open Banking Standard required the re-authentication of refresh tokens issued for Account and Transaction API when the token issue date has passed 90 days. With v3.1.10 this mandate has been removed.

Info
This is only available as a WSO2 Update from WSO2 Open Banking API Manager Level 1.5.0.100 and WSO2 Open Banking Key Manager Level 1.5.0.83 onwards. For more information on updating WSO2 Open Banking, see Updating WSO2 Products .

Open the <OB_KM_HOME>/repository/conf/identity/identity.xml file.

Add the UKAccountRefreshTokenValidityPeriod and UKAccountRefreshTokenLastAuthorizedDateLimit tags to configure the validity and authorisation date limit for refresh tokens:

Code Block

language	xml

<UK>
	...
    <UKAccountRefreshTokenValidityPeriod>15552000</UKAccountRefreshTokenValidityPeriod>
    <UKAccountRefreshTokenLastAuthorizedDateLimit>90</UKAccountRefreshTokenLastAuthorizedDateLimit>
    ...
<UK>

Versions Compared

Old Version 2

New Version Current

Key