eIDAS Implementation for Berlin

This document discusses how WSO2 Open Banking has implemented the Electronic Identification and Trust Services (eIDAS) Regulation for the NextGen PSD2 XS2A Framework.

TPP Validation Service

TPP validation service allows OBIE-registered Account Servicing Payment Service Providers (ASPSPs) to validate TPPs from the NCAs. This is done by validating QWAC or OBWAC. Follow the steps to enable this service:

1. Add the QSealC keypair corresponding to QWAC or OBSealC keypair corresponding to OBWAC  into a new JKS. For example, wso2carbon-signing.jks. 
2. Place the JKS file in the <WSO2_OB_APIM_HOME>/repository/resources/security directory.

3. Open the <WSO2_OB_APIM_HOME>/repository/conf/finance/open-banking.xml file:

   1. Add the following configs under the <CertificateManagement> section:

      • The SoftwareStatementId value needs to be configured according to the OBWAC/QWAC that has been configured in the <WSO2_OB_APIM_HOME>/repository/resources/security/wso2carbon.jks.

      • The OBIE service-related endpoints are for the OBIE sandbox environment.

        <TPPValidationService>
        	<CacheExpiry>3600</CacheExpiry>
        	<TPPValidationImplClass>com.wso2.finance.open.banking.gateway.service.obie.OBIECertValidationServiceImpl</TPPValidationImplClass>
        	<OBIE>
        		<SoftwareStatementId>ykNOgWd2RgnuoLRRyWBkaY</SoftwareStatementId>
        		<Scopes>
        			<Scope>ASPSPReadAccess</Scope>
        			<Scope>TPPReadAccess</Scope>
        			<Scope>AuthoritiesReadAccess</Scope>
        		</Scopes>
        		<TokenEndpoint>https://matls-sso.openbankingtest.org.uk/as/token.oauth2</TokenEndpoint>
        		<ValidationEndpoint>https://matls-dirapi.openbankingtest.org.uk/certificate/validate</ValidationEndpoint>
        		<RedirectEndpoint>https://matls-api.openbankingtest.org.uk/scim/v2/OBAccountPaymentServiceProviders</RedirectEndpoint>
        		<MemberState>GB</MemberState>
        	</OBIE>
        	<ScopeRegexPatterns>
        		<AISP>accounts+</AISP>
        		<PISP>payments+</PISP>
        		<CBPII>fundsconfirmations+</CBPII>
        	</ScopeRegexPatterns>
        </TPPValidationService>

   2. Configure the <SigningKeystore> tag with the file path of the JKS file that contains the OBSealC.

   3. Configure the <SigningCertificateAlias> and the <SigningCertificateKid> tags with the alias and KID value of the signing certificate (OBSealC):

      <Server>
      	<!-- alias the certificate is under -->
      	<SigningCertificateAlias>signing</SigningCertificateAlias>
      	<!-- KID value for primary signing certificate -->
      	<SigningCertificateKid>1pbTEt6v6_o0WpPFzmNXj6ediKw</SigningCertificateKid>
      	<SigningKeystore>
      		<Location>${carbon.home}/repository/resources/security/wso2carbon-signing.jks</Location>
      		<Password>wso2carbon</Password>
      		<KeyPassword>wso2carbon</KeyPassword>
      	</SigningKeystore>
      </Server>

4. Open the <WSO2_OB_APIM_HOME>/repository/resources/api_templates/velocity_template.xml file:

   1. Add the following handler as the first handler:

      <handler class="com.wso2.finance.open.banking.gateway.common.APIPropertiesHandler">
      	<property name="xWso2ApiSpec" value='$apiObj.additionalProperties.get("ob-spec")'/>
      	<property name="xWso2ApiVersion" value='$apiObj.additionalProperties.get("ob-api-version")'/>
      	<property name="xWso2ApiType" value='$apiObj.additionalProperties.get("ob-api-type")'/>
      </handler>

   2. Add the TPP validation handler after the #if($apiObj.additionalProperties.get("ob-spec") == "berlin") configuration as follows:

      #if($apiObj.additionalProperties.get("ob-spec") == "berlin")
          ## TPP validation service handler
         <handler class="com.wso2.finance.open.banking.gateway.common.TPPValidationHandler"/>

5. Republish your Accounts, Payments, and CoF APIs with the ob-spec, ob-api-version, and ob-api-type properties. For more information, see Deploying APIs for Berlin.
6. Open each API xml file(Accounts, Payments, and CoF APIs) in <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api and make sure that both APIPropertiesHandler and TPPValidationHandler are available.

Token generation

WSO2 Open Banking supports Private Key JSON Web Token (JWT) and MTLS as token authentication methods. 

The following diagram describes how the token generation is implemented in WSO2 Open Banking with accordance to eIDAS:

For more information about the token authentication methods used in WSO2 Open Banking, see API Security for Berlin.

API invocation

Account Information Service Provider, Payment Initiation Service Provider, and Card-Based Payment Instrument Issuer are roles for a TPP. This role is validated so that only a particular TPP is allowed to invoke an API. APIs are protected using MTLS, which uses the QWAC as the transport certificate in each of the requests. To see how MTLS affects in the API invocations, see API Security for Berlin.

Sources of Information

• eIDAS regulation