API Security for Australia

Transport layer security

Mutual Transport Layer Security (MTLS)

WSO2 Open Banking uses MTLS to check if the message context contains the transport certificate using the following handlers. This is to make sure that the MTLS handshake is successful at the gateway.

[open_banking.cert_mgt.client_transport_cert_as_header]
enable = true

Enable MTLS for Userinfo, PAR and Introspection Endpoints

According to the Consumer Data Standards, the UserInfo endpoint, Introspection endpoint, and the Pushed Authorization endpoint following endpoints need to be secured with MTLS.  To enable MTLS for these endpoints follow the instructions given below:

1. To proxy these aforementioned endpoints through the gateway, copy the following synapse config files from the <WSO2_OB_APIM_HOME>/repository/resources/finance/synapse-configs/au directory to the <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api directory:

   • _IntrospectAPI_.xml

   • _PARAPI_.xml

   • _UserInfoAPI_.xml

2. To enable MTLS certificate validation, make sure the MTLS Certificate Validator is available in the <WSO2_OB_APIM_HOME>/repository/conf/deployment.toml file under the [server] tag as follows: 

   globally_engaged_modules = ["mtlscertvalidator"]

3. Add the MTLS Enforcement Filter to the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml file: 

   [[tomcat.filter]]
   name = "MTLSEnforcementFilter"
   class = "com.wso2.finance.open.banking.identity.extensions.filter.MTLSEnforcementFilter"
   

4. To enable MTLS for the UserInfo endpoint, add the following filter mapping to the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml file: 

   [[tomcat.filter_mapping]]
   name = "MTLSEnforcementFilter"
   url_pattern = "/userinfo/*"
   

5. To enable MTLS for the PAR endpoint, add the following filter mapping to the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml file:  

   [[tomcat.filter_mapping]]
   name = "MTLSEnforcementFilter"
   url_pattern = "/par/*"
   

6. To enable MTLS for the Introspect endpoint, add the following filter mapping to the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml file:  

   [[tomcat.filter_mapping]]
   name = "MTLSEnforcementFilter"
   url_pattern = "/introspect/*"
   

Token endpoint security

WSO2 Open Banking uses the Authorization Code grant type to ensure token endpoint security. When a Data Recipient attempts to access a CDS resource; WSO2 Open Banking requests the bank customer to authorise the Data Recipient by granting the consent for the Data Recipient to access that account information. Once the user grants the consent, the user is redirected to the redirect URL of the Data Recipient with the authorization code. Using the generated authorisation code, the Data Recipient can generate the user access token as follows:

Once you run the authorisation URL, you are directed to a login page.

1. Log in with the credentials of a user that has a Subscriber role.
2. If a secondary factor is required. For example, SMS OTP, provide the relevant values.
   
3. Upon successful authentication, the user is redirected to a page where the user needs to select the accounts that need to be authorised.
   
4. Then confirm or deny the access to displayed details in the selected account(s).
   

5. Upon agreement, the consumer is redirected to the callback URL of the ADR with the authorization code. For example:

   https://www.google.com/redirects/redirect1#code=2c8a03f7-af33-326f-839a-63a4eebfe3f5&id_token=eyJraWQiOiJEd01LZFdNbWo3UFdpbnZvcWZReVhWenlaNlEiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBMV81In0.KaRhQA63F2Sm72zSZrkoRucIiz4IC0pzqApjTzSOJSyV_J6fYBwHuIAjLn4MZA36ZfVCmm3-KzqJcGAv9W9sDWBi7aI80CVKLFVJ2rh9l_9bMnANjm5fCsZ-pE_F4eW5BnqiU7xOoel31W2WF2brEWf9l5dibILU5E7inYKkQ9qPCS3Ei7uo9LTYQMWR4RQSglAsb5TsnijOPtGBvQgyuwOeI9vWBIcm7Y64NXuWKiv1iManbTepggpKhCSj9qPPizVV4v7Vv1IgHbvViRCE0uIvomLsL9qTxkBVK2s_h3welM9-9CE0WvoGkbYgsDc3nBQEx7Vj4hBiYJ0nD2_dWw.zslxDgOETvBaMOTQ.XAPYdrt5HXhvF53llXp40YkRHWBSrosYDc0UVLnqwJkAcNs3CQo8vWKSNqfc8l6CezvFPinul4LEp-eRrOqrpnhzAMf-W4O-s0jjF0dPsa3NII_qdi5bmCQhwxTVzo31SBiKn1aCBu8lQXSLUAz7z3UF6JyH1OkCXU3Ld8puF45QTRoTRPru8oNy8W8ZbchDj11IhEzrT9RPmWznCDQ3rs8M16R636-TuULXdSqJUGtXB3wteXu8lcgGpIMno1T6Bq2rI8Ncg_rCe6RgepAlEjlC0J0hpgMOk-EiXFDXN5N0NfEo6VSv9-M1v5THSJBThZIlcZrL-njz4G2NiDa30PSrQFqLgusYpZNpL1bHGsUbz_Xqvwlpjq-A5TcrqjxwWHkK383pY-tE064FKQuk93HnOee1gp4iRc9GLiqOK4vawSKStaSWe1oWxeFkDDuY85H3rFL1U8JzAC-vbPpozju82q7mONQto0q1fnCa80jtl5rDVsxzXLkEDbfwrvE-_13MKTLGc9io-PbEy6UgD9bAz5qvoOtNLWh0rcAbT5yhnZnruecB9l3yBsnbo60HQC_83mMzPWjGQaTm-ujO-hockrUSkezEO2JhNKrMWI5V-2aBNin_0UcSShMQnFy4P9baFKcyvrt2r3LNOvqfl_mK9qh57AOQw4vjhJRRaPVVacB8h5WCoiq8ut8wnHq3L2MvF9HId9T0Ug9FaPP76ofLziM.u19pyEql02PpVrFrki3RWA&state=af0ifjsldkj&session_state=c57cc0825bf8838fd2b6f14597ed34b5d9404493b216092e9daa766749cdac40.-1D9AEiTjPN-3hzlRFN97Q

6. The authorization code from the above URL is in the code parameter (code=4489572f-83c9-3589-b403-c4ecf8fb77f4).

   
   

Mandate PAR

With the Decision Proposal 209 - Transition to FAPI 1.0 Advanced Profile, the Data Recipient software products must send authorisation requests only using PAR. To enable this mandate,

1. Add the following configurations to the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml file: 

   [open_banking.au.push_authorisation]
   is_mandatory = true

2. Furthermore, Data Recipients must use PKCE  in accordance with FAPI-1.0-Advanced. In order to mandate PKCE for already registered ADRs, run the relevant migration script in the following directory against the openbank_apimgtdb:

   <WSO2_OB_IAM_HOME>/dbscripts/finance/apimgt/cds_decision_209_phase02_migration 

curl -X POST \
 https://<WSO2_OB_APIM_HOST>:8243/token \
 -H 'Content-Type: application/x-www-form-urlencoded' \
 -H 'cache-control: no-cache' \
 -k --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
 -d 'grant_type=refresh_token&refresh_token=<REFRESH_TOKEN>&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=<CLIENT_ASSERTION>'

Authorisation endpoint security

WSO2 Open Banking enhances the security of the authorisation code grant type in authorisation endpoint security with request object and response type attributes.

Once decoded, the request object that is used to get the Data Recipient's information looks as follows:

{
  "kid": "<Certificate fingerprint>",
  "typ": "JWT",
  "alg": "<Supported algorithm>"
}
{
  "iss": "<Application ID>",
  "aud": "<Audience the ID Token is intended for. For example,https://<WSO2_OB_APIM_HOST>:8243/token>",
  "response_type": "<code:Retrieves authorize code, code id_token: Retrieves authorize token and ID token>",
  "exp": <A JSON number representing the number of seconds from 1970-01-01T00:00:00Z to the UTC expiry time>,
  "client_id": "<Application ID>",
  "redirect_uri": "<Redirect URL of the client application>",
  "scope": "<Available scopes are bank:accounts.basic:read, bank:accounts.detail:read, bank:transactions:read, bank:payees:read, bank:regular_payments:read, common:customer.basic:read, and common:customer.detail:read >",
  "state": "af0ifjsldkj",
  "nonce": "<Prevents replay attacks>",
  "claims": {
    "sharing_duration": "<Requested duration for sharing, in seconds>",
    "id_token": {
      "acr": {
        "values": ["urn:cds.au:cdr:3"]
      }
    }
  }
}
<signature>

The sample redirect URL for the bank customer to authorise the CDR Arrangement ID looks as follows:

https://<WSO2_OB_APIM_HOST>:8243/authorize?prompt=login&response_type=code id_token&client_id=<APPLICATION_ID>&redirect_uri=<APPLICATION_REDIRECT_URI>&scope=<AUTHORISATION_SCOPE_AS_PER_REQUEST_OBJECT>&nonce=n-0S6_WzA2Mj
&state=af0ifjsldkj HTTP/1.1&request=<REQUEST_OBJECT>