Page Comparison

...

According to the OBIE, the Account Servicing Payment Service Providers (ASPSPs) need to make sure that the TPPs can be registered in a seamless and ideally, a fully automated process. In order to avoid any obstacles that may occur, the OBIE requires the ASPSPs to provide the TPP responses real-time once the registration is processed. The Dynamic Client Registration (DCR) endpoint is capable of dynamically registering the clients with the ASPSP when the client sends a registration request with its metadata. This results in a registration response that includes a client identifier and the client metadata values registered for the client.

...

<DCR>
	<UseSoftwareIdAsApplicationName>true</UseSoftwareIdAsApplicationName>
</DCR>

<ApplicationConfiguration>
	<ApplicationAttributes>
		<Attribute required="false">
			<Name>software_id_sandbox</Name>
			<Description>Software ID of the sandbox</Description>
		</Attribute>
		<Attribute required="false">
			<Name>software_id_production</Name>
			<Description>Software ID of the production</Description>
		</Attribute>
		<Attribute required="false">
			<Name>software_roles_production</Name>
			<Description>Software roles of the production</Description>
		</Attribute>
		<Attribute required="false">
			<Name>software_roles_sandbox</Name>
			<Description>Software roles of the sandbox</Description>
		</Attribute>
		<Attribute required="false">
			<Name>software_jwks_endpoint_sandbox</Name>
			<Description>JWKS endpoint of sandbox</Description>
		</Attribute>
		<Attribute required="false">
			<Name>software_jwks_endpoint_production</Name>
			<Description>JWKS endpoint of production</Description>
		</Attribute>
	</ApplicationAttributes>
</ApplicationConfiguration>

1. The TPP sends a registration request,

   1. This is a POST request including an SSA (Software Statement Assertion) as a claim in the payload.

   2. The SSA is sent as a signed JWT, which is obtained from the Open Banking Directory. This contains the client metadata.

      Note
      The software statement (SSA) should be obtained from the Open Banking Directory by the TPP. The SSA is a signed JWT issued by the Open Banking directory.

   The automated DCR process is carried out by calling a synapse API in the gateway. The registration request relies on Mutual TLS authentication for TPP authentication. 
   An example request sent to the DCR registration endpoint is shown below: 

   Code Block

   curl -X POST \ https://localhost:8243/open-banking/v3.2/register \ -H 'Content-Type: application/jwt' \ -d eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImhjZ2V4dWd1VmI1cllTWVZCc2wtYzloQlB2WSJ9.eyJpc3MiOiJXU08yIFRQUCIsImlhdCI6MTU1NDE4NDc2NiwiZXhwIjoxNzQzNTczNTY1LCJqdGkiOiI5MjcxMzg5Mi01NTE0LTExZTktODY0Ny1kNjYzYmQ4NzNkOTMiLCJhdWQiOiJodHRwczovL2xvY2FsYmFuay5jb20iLCJzY29wZSI6ImFjY291bnRzIHBheW1lbnRzIiwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2QiOiJwcml2YXRlX2tleV9qd3QiLCJncmFudF90eXBlcyI6WyJhdXRob3JpemF0aW9uX2NvZGUiLCJyZWZyZXNoX3Rva2VuIl0sInJlc3BvbnNlX3R5cGVzIjpbImNvZGUiLCJjb2RlIGlkX3Rva2VuIl0sImlkX3Rva2VuX3NpZ25lZF9yZXNwb25zZV9hbGciOiJFUzI1NiIsInJlcXVlc3Rfb2JqZWN0X3NpZ25pbmdfYWxnIjoiRVMyNTYiLCJzb2Z0d2FyZV9pZCI6IlZnUU9JQk1laFBubExVUXcwQkZNNVMiLCJhcHBsaWNhdGlvbl90eXBlIjoid2ViIiwicmVkaXJlY3RfdXJpcyI6WyJodHRwczovL3dzbzIuY29tL3JlZGlyZWN0Il0sInNvZnR3YXJlX3N0YXRlbWVudCI6ImV5SjBlWEFpT2lKS1YxUWlMQ0poYkdjaU9pSklVekkxTmlKOS5leUpwYzNNaU9pSlBjR1Z1UW1GdWEybHVaeUlzSW1saGRDSTZNVFE1T1Rnd05UZzBPQ3dpWlhod0lqb3hOVE14TXpReE9EUTRMQ0poZFdRaU9pSkZlR0Z0Y0d4bElGUlFVQ0lzSW5OMVlpSTZJa1Y0WVcxd2JHVWdWRkJRSWl3aVQySlVVRkJKWkNJNklrbEVRVzFoZW05dUlpd2lUMkpVVUZCU2IyeGxJam9pVUVsVFVDSjkuUnJydEpYbmZmSzVjOHJJeEczUm93QXNRZWNlSDNvWlFXTWJwZ0hENzhPOCJ9.s6btE-mH138nbVW4CGm5ER_aGN4SYqN2aq-FA2C3vlZhCiiNNULPIyC_HvxW1Mhi6UBZdokt9ofQnMyjLw1vSOPKgW3DZSYQtn0EWRj0KUhSWS0SJjMlVSE-hOIFxnjN0UjqNCsqAfvWj_HxXaRmbdFL4NdxPPOi2Qc4Dg6cMdOH7JGM374QeGM0rmu8n3u2od6zXlJPFjeVC1SCVdXbEL7mSWoblR30-RIij_QZyUrE2AB2cvE_m5sg5sINkigYmH19MzkfkYiku-lrndflmZOiw9dev0UBuLOQX5X4OjFrXfgwWzLFvXCSO0rabGbLgruu5ZFWjmt9iEVq0a8oEw

   Given below is the format of the payload JWT. To sign it, use the signing certificate issued by the Open Banking Directory. The kid parameter of the header should match the values in the kid of the signing certificate provided by the Open Banking Directory.

   Code Block
   language xml
   { "scope": "accounts payments", "client_secret_expires_at": 0, "software_statement": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPcGVuQmFua2luZyIsImlhdCI6MTQ5OTgwNTg0OCwiZXhwIjoxNTMxMzQxODQ4LCJhdWQiOiJFeGFtcGxlIFRQUCIsInN1YiI6IkV4YW1wbGUgVFBQIiwiT2JUUFBJZCI6IklEQW1hem9uIiwiT2JUUFBSb2xlIjoiUElTUCJ9.RrrtJXnffK5c8rIxG3RowAsQeceH3oZQWMbpgHD78O8", "grant_types": [ "authorization_code", "refresh_token" ], "request_object_signing_alg": "ES256", "software_id": "VgQOIBMehPnlLUQw0BFM5S", "id_token_signed_response_alg": "ES256", "redirect_uris": [ "https://wso2.com/redirect" ], "token_endpoint_auth_method": "private_key_jwt", "response_types": [ "code", "code id_token" ], "application_type": "web", "client_id": "OBPK4uphJ5eTPfEteASUfs8plzsa", "client_secret": "P832Qflz1sI5DJNSgNa83aFwydsa", "client_id_issued_at": 1563466935 }

   Include the following claims in the body of the request payload;

   Claim	Description	Source Specification	Optional	Comments
   iss	Request issuer (the TPP)	[RFC7519]	NO
   iat	Time of issuance of the request	[RFC7519]	NO
   exp	Request expiration time	[RFC7519]	NO
   aud	Request audience (the ASPSP)	[RFC7519]	NO
   jti	The JWT ID	[RFC7519]	NO
   redirect_uris	Registered URIs the TPP uses to interact with the ASPSP AS	[OIDC-R]	NO	Must match or be a subset of the software_redirect_uris claim in the SSA.
   token_endpoint_auth_method	Specifies which token endpoint authentication method the TPP wants to use	[RFC7591]	NO	private_key_jwt: If requested, the OP should extract the TPPs JWKS location from the included software statement assertion.
   grant_types	A JSON array specifying what the TPP can request to be supplied to the token endpoint as an exchange for an access token	[RFC7591]	NO
   response_types	A JSON array specifying what the TPP can request to be returned from the ASPSP authorization endpoint	[RFC7591]	YES	ASPSPs may reject anything other than code.
   software_id	The application name that is mentioned as software_client_id in the SSA.	[RFC7591]	YES	If specified, the software_id in the request must match the software_id specified in the SSA. ASPSPs can choose to allow multiple registrations for a given software client name and may take the software_id from either the SSA or the TPP as a hint.
   scope	The scopes requested by the client (if not specified, default scopes are assigned by the AS)	[RFC7591]	YES	The minimum scope should be openid + whatever scopes are appropriate for the PSD2 role of the software. Tip The scopes are space-delimited values.
   software_statement	The SSA issued by Open Banking identifier	[RFC7519]	NO
   application_type	Specifies whether the application type is web or mobile	[OIDC-R]	NO	Must be web, if specified.
   id_token_signed_response_alg	The algorithm with which the TPP expects to sign the id_token if an id_token is returned	[OIDC-R]	NO	Supported values must comply with [FAPI-RW] Section 8.6.
   request_object_signing_alg	The algorithm with which the TPP expects to sign the request object if a request object is part of the authorization request sent to the ASPSP.	[OIDC-R]	NO	Supported values must comply with [FAPI-RW] Section 8.6.

2. The ASPSP validates the SSA based on the specifications provided in the Open Banking OpenID Dynamic Client (OIDC) Registration specification.

3. The ASPSP registers the client application using the metadata sent in the SSA.

• If client creation is successful, the ASPSP responds with a JSON payload that describes the client that was created. The TPP can then use the client to access resources on the ASPSP's resource server. 

• If client creation is unsuccessful, the ASPSP responds with an error payload.

  A sample response is given below:

  Code Block
  title Response
  HTTP/1.1 200 Ok Content-Type: application/json { "grant_types": [ "authorization_code", "refresh_token" ], "software_client_name": "Open Banking test", "supportedGrantTypes": [ "refresh_token", "client_credentials" ], "redirect_uris": [ "https://www.amazon.com", "https://www.amazon.com/tt/webview/oobe/proposition" ], "software_jwks_endpoint": "https://keystore.openbankingtest.org.uk/0015800001HQQrZAAX/3c8F2a7zpWaxnO5kFOZpyE.jwks", "token_endpoint_auth_method": "private_key_jwt", "client_secret": "DMcSUBmgi4tjKktagizDuDaiCAAa", "software_id": "3c8F2a7zpWaxnO5kFOZpyE", "software_logo_uri": "https://www.amazon.com/logo", "scope": [ "openid", "payments" ], "request_object_signing_alg": "ES256", "software_roles": [ "AISP", "PISP" ], "client_id": "kKcxI71dFnCtIHoM9zTZiG6U1GUa", "id_token_signed_response_alg": "ES256" }

...

The API allows the TPP to retrieve the details for a client that has already been registered. The request relies on Mutual TLS authentication and application access token (Client Credentials grant type) for TPP authentication. 

curl -X POST \
  https://localhost:8243/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'ssl.client.auth.cert.X509: MIIFODCCBCCgAwIBAgIEWcVqyzANBgkqhkiG9w0BAQsFADBTMQswCQYDVQQGEwJH' -k \
  -d 'grant_type=client_credentials&scope=openid%20&client_assertion=eyJraWQiOiJoY2dleHVndVZiNXJZU1lWQnNsLWM5aEJQdlkiLCJhbGciOiJQUzI1NiJ9.eyJzdWIiOiJ1aHo5NWVTaUtrMmxUeld4YzRqckxUWHh3RThhIiwiYXVkIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6ODI0My90b2tlbiIsImlzcyI6InVoejk1ZVNpS2sybFR6V3hjNGpyTFRYeHdFOGEiLCJleHAiOjE1OTkxODcyMDEsImlhdCI6MTU3MDA3NjUyNiwianRpIjoiMTU1NDE5MjU0MTkifQ.sb-lwJhbtbaPrCvftyNcDLUt3uqtANXdJkbCNG6x7BL57b4cqkxo20BKHn4Cnvd8f00OIfuEQLBKo5BH9bpkt06MVsoZdEhq4YMT_FqUZb_38B-MEmWuaE2n6-ZCa_Jlp8TZ49PRY_q-Zz-y8WkDF2Hy51lulL5exxq0eGfNzGNMHk9_yQeEPte2-IY7NHPNpY0WpPKpYTUHPvDC3u_o5oL7WAcdE5bwqZQ4M5VcQf_QSqVLxrRpFv2FO9FBiU_iTG1S9CgNrYICzlgk9Gg2DhFu75iqcrjpGiEcXjSULKwRT89j--jJMWSCSuJ64OFllao3x56JecxxGdlA0HuaSw&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&redirect_uri=https%3A%2F%2Fwso2.com%2F'

...

• If the request is successful and the identifier (ClientId) matches the client to whom the Client Credentials grant access token was issued, the ASPSP returns details of the requested client
• If the ClientId is unknown, the ASPSP responds with an Unauthorized status code and immediately revokes the access token

Given below is a sample request sent to the retrieving endpoint:

...