Running the Dynamic Client Registration Conformance Suite

WSO2 Open Banking 1.5.0 supports Dynamic Client Registration Conformance suite v1.3.0.

The Dynamic Client Registration (DCR) conformance certificate provided by Open Banking Implementation Entity (OBIE) verifies that all the DCR-specific functionalities allowed by an open banking solution are as per the guidelines defined by the OBIE specification.

Prerequisites:

Install Docker in your environment.
Download the following components of the WSO2 Open Banking solution:
1. wso2-obam-1.5.0.zip (WSO2 Open Banking API Manager)
2. wso2-obkm-1.5.0.zip (WSO2 Open Banking Key Manager)
  Click here to see how to download the packs from WUM
  Set up the WSO2 Update Manager (WUM).
  - WUM is a simple command-line tool that connects to the WSO2 update service, determines which updates are new and relevant, and downloads them. You can get the latest version of the WSO2 Open Banking product packs through WUM.
    License
    
    WSO2 Open Banking is not distributed under the Apache Community License and is only available under the WSO2 Software License. You need a WSO2 subscription to install and update the WSO2 Open Banking solution via WUM. Contact us to find out how you can access a free evaluation copy...
  - Follow the guidelines provided in the Download WUM page to download, and install WUM in your environment. For more information on how to use WUM, see the /wiki/spaces/updates/pages/16318500.
    Add the necessary product packs using the commands given below:
    
    wum add wso2-obam-1.5.0 wum add wso2-obkm-1.5.0
    
    Update the product packs using the commands given below:
    
    wum update wso2-obam-1.5.0 wum update wso2-obkm-1.5.0
    
    Additionally, download and update the other instances of WSO2 Open Banking product.
    
    wum add wso2ei-6.4.0 wum update wso2ei-6.4.0 wum add wso2am-analytics-2.6.0 wum update wso2am-analytics-2.6.0 wum add wso2-obbi-1.5.0 wum update wso2-obbi-1.5.0
    
    WSO2 OB APIM Analytics(wso2am-analytics-2.6.0) provides the API analytics feature.
    WSO2 OB BI(wso2-obbi-1.5.0) provides the following features:
    API Analytics
    Transaction Risk Analysis
    Fraud Detection
    Data Reporting
  - The product packs reside in the <WUM_HOME>/products/<Product_Name>/<version>/full directory as <Product_name-<version>+<timestamp>.full.zip. Copy the product packs to a preferred location in each node, and extract them.
    
    WSO2 Updates Manager (WUM) is deprecated and will be unavailable from July 2021 onwards. WSO2 Updates is the new tool to include the solution and security improvements that are released by WSO2 Open Banking, on top of a released version. For more information, see WSO2 Updates.
    Click here to see how to update the solution via WSO2 Update tool...
    The WSO2 Update tool delivers hotfixes and updates seamlessly on top of products as WSO2 Updates. They include improvements that are released by WSO2. You need to update all the products using the relevant script.
    Go to <PRODUCT_HOME>/bin and run the WSO2 Update tool:
    
    Repeat this step for all the products in the solution:
    wso2-obkm-1.5.0
    wso2-obam-1.5.0
    wso2-obbi-1.5.0
    wso2am-analytics-2.6.0
  This document refers to the file paths of the product packs for the Key Manager, API Manager, API Manager Analytics, and Enterprise Integrator as <WSO2_OB_KM_HOME>, <WSO2_OB_APIM_HOME>, <WSO2_AM_ANALYTICS_HOME>,<WSO2_OB_BI_HOME> and <WSO2_EI_HOME> respectively.
Setup the WSO2 Open Banking solution using the instructions given in the following documents:
Configure DCR in the WSO2 Open Banking solution. See Dynamic Client Registration v3.2 for instructions.

This document provides instructions on the following topics:

Configuring the solution to support the DCR Conformance Suite tool

Stop the WSO2 OB APIM and WSO2 OB KM servers before applying the below changes.

Open <WSO2_OB_APIM>/repository/deployment/server/synapse-configs/default/api/_DyanmicClientRegistrationAPI.xml and the following property after the <insequence> tag in both scenarios as follows:

<resource methods="POST" url-mapping="/register" faultSequence="fault">
<inSequence>
<property name="ContentType" value=" application/jwt" scope="axis2"/>

<resource methods="DELETE PUT GET" uri-template="/register/{ClientId}" faultSequence="fault">
<inSequence>
<property name="ContentType" value=" application/jwt" scope="axis2"/>

Open <WSO2_OB_APIM>/repository/conf/axis2/axis2.xml and add the following <messageFormatters> and <messageBuilders> respectively:

messageFormatters:

<messageFormatters>
<!-- Message formatter to support the application/jose content-type for DCR -->
<messageFormatter contentType="application/jose"
 class="org.apache.axis2.format.PlainTextFormatter"/>

messageBuilders:

<messageBuilders>
<!-- Message Builder to support the application/jose content-type for DCR -->
<messageBuilder contentType="application/jose"
 class="org.apache.axis2.format.PlainTextBuilder"/>

Restart the WSO2 OB KM and WSO2 OB APIM servers.

well-known endpoint configuration

Follow the instruction given below:

Stop the WSO2 OB KM server.
Download and extract the well-known-config-resources.zip.
Copy servlet-1.0-SNAPSHOT.jar in to the <WSO2_OB_KM_HOME>/repository/components/lib directory.
Copy openid-configuration.json file in to the <WSO2_OB_KM_HOME>/repository/conf/identity directory. Update the values in openid-configuration.json file according to your requirement.

A sample openid-configuration.json is available here.

Register the servlet in <WSO2_OB_KM_HOME>/repository/conf/tomcat/web.xml file by adding the following elements before the </webapp> tag.

<servlet>
  <servlet-name>Discovery</servlet-name>
  <servlet-class>myPackage.Discovery</servlet-class>
</servlet>

<servlet-mapping>
  <servlet-name>Discovery</servlet-name>
  <url-pattern>/oidcdiscovery/.well-known/openid-configuration</url-pattern>
</servlet-mapping>

Restart the WSO2 OB KM server. Go to the following link and see the changes.
```
https://<WSO2_OB_KM_HOST>:8243/.well-known/openid-configuration
```

Configuring the config.json file

Once you complete the well-known endpoint configuration, change the field values in the config.json file. A sample config.json is given below:

{
  "wellknown_endpoint": <well-known endpoint>,
  "ssa": <Software Statement Assertion>,
  "kid": <CERTIFICATE_FINGERPRINT>,
  "aud": <This is the audience that the ID token is intended for. For example, https://<<OB_HOST>>:8243/token>,
  "redirect_uris": ["redirecturi"],
  "issuer": <SOftwareID>,
  "private_key": <PrivateKey>,
  "transport_root_cas": ["cert 1", "cert 2"],
  "transport_cert": <TransportCertificate>,
  "transport_key": <TransportKey>,
  "get_implemented": true,
  "put_implemented": true,
  "delete_implemented": true,
  "spec_version": "3.2",
  "environment": "sandbox",
  "brand": "wso2"
}

A sample JSON configuration file is available here.

Running the DCR Conformance Suite

When running the commands, change <CONFIG_FILE> to the path where you place the config.json mentioned above.

Open a terminal and run the following command to run the complete test suite:

docker run --rm -it -v <CONFIG_FILE>:/config.json openbanking/conformance-dcr:[TAG] -config-path=/config.json

If you want to run the test suite in the debug mode, run the following command with the -debug flag:

docker run --rm -it -v <CONFIG_FILE>:/config.json openbanking/conformance-dcr:[TAG] -config-path=/config.json -debug

If you want to run a test case separately, run the following command with the -filter <test-id> flag:

docker run --rm -it -v <CONFIG_FILE>:/config.json openbanking/conformance-dcr:[TAG] -config-path=/config.json -filter <test-id>

You can generate a DCR Conformance test report using the following command:

docker run -p 8080:<PORT> — rm -it -v <CONFIG_FILE>:/config.json openbanking/conformance-dcr -config-path=/config.json -report

Once you run the above command, you can download the report from https://0.0.0.0:8080.

Click here to find a sample report in the json format...

{
 "name": "DCR32",
 "version": "1.0",
 "pass": true,
 "scenarios": [
  {
   "id": "DCR-001",
   "name": "Validate OIDC Config Registration URL",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-Discovery",
   "pass": true,
   "test_cases": [
    {
     "name": "Validate Registration URL",
     "pass": true,
     "steps": [
      {
       "name": "Registration Endpoint Validate",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-002",
   "name": "Dynamically create a new software client",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-POST/register",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 201",
       "pass": true
      },
      {
       "name": "Decode client register response",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve client credentials grant",
     "pass": true,
     "steps": [
      {
       "name": "Client credentials grant",
       "pass": true
      }
     ]
    },
    {
     "name": "Delete software client",
     "pass": true,
     "steps": [
      {
       "name": "Software client delete",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-003",
   "name": "Delete software statement is supported",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-DELETE/register/{ClientId}",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 201",
       "pass": true
      },
      {
       "name": "Decode client register response",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve client credentials grant",
     "pass": true,
     "steps": [
      {
       "name": "Client credentials grant",
       "pass": true
      }
     ]
    },
    {
     "name": "Delete software client",
     "pass": true,
     "steps": [
      {
       "name": "Software client delete",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve delete software client should fail",
     "pass": true,
     "steps": [
      {
       "name": "Software client retrieve",
       "pass": true
      },
      {
       "name": "Assert status code 401",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-004",
   "name": "Dynamically create a new software client will fail on invalid registration request",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-POST/register",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client fails on expired claims",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 400",
       "pass": true
      }
     ]
    },
    {
     "name": "Register software client fails on invalid issuer",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 400",
       "pass": true
      }
     ]
    },
    {
     "name": "Register software client fails on invalid issuer too short",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 400",
       "pass": true
      }
     ]
    },
    {
     "name": "Register software client fails on invalid issuer too long",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 400",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-005",
   "name": "Dynamically retrieve a new software client",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-GET/register/{ClientId}",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 201",
       "pass": true
      },
      {
       "name": "Decode client register response",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve client credentials grant",
     "pass": true,
     "steps": [
      {
       "name": "Client credentials grant",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve software client",
     "pass": true,
     "steps": [
      {
       "name": "Software client retrieve",
       "pass": true
      },
      {
       "name": "Assert status code 200",
       "pass": true
      },
      {
       "name": "Validate client response schema",
       "pass": true
      },
      {
       "name": "Decode client retrieve response",
       "pass": true
      }
     ]
    },
    {
     "name": "Delete software client",
     "pass": true,
     "steps": [
      {
       "name": "Software client delete",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-006",
   "name": "I should not be able to retrieve a registered software if I send invalid credentials",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-GET/register/{ClientId}",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 201",
       "pass": true
      },
      {
       "name": "Decode client register response",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve software client with invalid credentials should not succeed",
     "pass": true,
     "steps": [
      {
       "name": "Set invalid grant token",
       "pass": true
      },
      {
       "name": "Software client retrieve",
       "pass": true
      },
      {
       "name": "Assert status code 401",
       "pass": true
      }
     ]
    },
    {
     "name": "Retrieve client credentials grant",
     "pass": true,
     "steps": [
      {
       "name": "Client credentials grant",
       "pass": true
      }
     ]
    },
    {
     "name": "Delete software client",
     "pass": true,
     "steps": [
      {
       "name": "Software client delete",
       "pass": true
      }
     ]
    }
   ]
  },
  {
   "id": "DCR-007",
   "name": "I should not be able to retrieve a registered software if I send invalid credentials",
   "spec": "https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.2#DynamicClientRegistration-v3.2-GET/register/{ClientId}",
   "pass": true,
   "test_cases": [
    {
     "name": "Register software client will fail with token endpoint auth method RS256",
     "pass": true,
     "steps": [
      {
       "name": "Generate signed software client claims",
       "pass": true
      },
      {
       "name": "Software client register",
       "pass": true
      },
      {
       "name": "Assert status code 400",
       "pass": true
      }
     ]
    }
   ]
  }
 ]
}