Configuring Consent Revocation Apps for UK

WSO2 Open Banking solution includes consent revocation apps that support bank customers (PSUs) and banks (ASPSPs) to revoke consents. The consent revocation app provided to PSU is known as Self-care portal and the consent revocation app provided to ASPSP is known as Customer Care portal. 

In order to manage the consents granted to a Third-Party Provider using the Self-care portal,  do the following configurations. 

1. Go to the Identity and Access Management Console at https://<WSO2_OB_IAM_HOST>:9446/carbon.
2. On the Main tab, click Home > Identity > Service Providers > Add.
3. By default, the mode is set to Manual Configuration. Leave it as it is.
4. Enter consentmgt as the Service Provider’s name. 
   
5. Click Register.
6. Click Inbound Authentication configuration > OAuth/OpenID Connect configuration > Configure.
   

7. Set the values for the following parameters and keep the default value for the other parameters.

   Parameter	Value
   OAuth Version	2.0
   Allowed Grant Type	code
   Callback URL	regexp=(https://<WSO2_OB_IAM_HOST>:9446/consentmgt|https://<WSO2_OB_IAM_HOST>:9446/consentmgt) The first and second URLs are respectively; redirect and logout URLs.

   Regex-based consumer URLs are supported when defining the callback URL. This enables you to configure multiple callback URLs for one application by entering a regex pattern as the value for the callback URL field.

   You must have the prefix regexp= before your regex pattern. To define a normal URL, you can specify the callback URL without this prefix.

   

8. Click Add.
   

   The OAuth client key/client ID and OAuth client secret are generated. Those are used in Configuring consent management jaggery application.

   

9. Open the <WSO2_OB_IAM_HOME /repository/deployment/server/jaggeryapps/consentmgt/configs/conf.json file and modify the following parameters:

   Parameter	Description
   apimHost	Hostname of the API Management server
   applicationId	OAuth Client Key generated in the above step
   authCredential	Base64 encoded CLIENT_ID:CLIENT_SECRET value (in the given format).  For example,
   redirectUrl	The URL you are redirected to when you log in to the application.
   logoutUrl	The URL you are redirected to when you log out from the application.
   DeployedSpecification	Possible values are UK, BERLIN, AU, and STET. By default, the value is set to UK.

   Given below is a sample file for the UK specification:

   {
   	"app" : "consentmgt",
   	"applicationType" : "oauth2",
   	"tenantDomain": "carbon.super",
   	"apimHost":"http://<WSO2_OB_APIM_HOST>",
   	"apimNioPort":"8280",
   	"apimHttpPort":"9763",
   	"kmHost" : "https://<WSO2_OB_IAM_HOST>",
   	"kmPort" : "9446",
   	"kmTokenAPI" : "oauth2/token",
   	"kmAuthorizeAPI" : "oauth2/authorize",
   	"applicationId":"<CLIENT_ID>",
   	"authCredential":"<BASE64ENCODED CLIENT CREDENTIALS>",
   	"redirectUrl":"https://<WSO2_OB_IAM_HOST>:9446/consentmgt",
   	"logoutUrl": "https://<WSO2_OB_IAM_HOST>:9446/consentmgt",
   	"tokenApiName" : "token",
   	"tokenApiVersion" : "",
   	"authorizeApiName" : "authorize",
   	"authorizeApiVersion" : "",
   	"pagination" : {
   		"limit" : 11,
   		"actualLimit" : 10,
   		"offset": 0
   	},
   	"DeployedSpecification" : "UK"
   }

   This is available only as a WUM update and is effective from Month Date, Year (MM-DD-YY). For more information on updating WSO2 Open Banking, see Updating WSO2 Products.

   To enable the accessing history of the Confirmation of Funds API, add the following attribute to the <WSO2_OB_IAM_HOME /repository/deployment/server/jaggeryapps/consentmgt/configs/conf.json file after the logoutUrl attribute :

   "cofAccessHistory": {
   	"enabled": true,
   	"url":"http://<WSO2_OB_BI_HOST>:8008/ConsentManagement/ConsentDataRetrievalStream"
   }

    Click here to see the file with updated configuration..

   {
   	"app" : "consentmgt",
   	"applicationType" : "oauth2",
   	"tenantDomain": "carbon.super",
   	"apimHost":"http://<WSO2_OB_APIM_HOST>",
   	"apimNioPort":"8280",
   	"apimHttpPort":"9763",
   	"kmHost" : "https://<WSO2_OB_IAM_HOST>",
   	"kmPort" : "9446",
   	"kmTokenAPI" : "oauth2/token",
   	"kmAuthorizeAPI" : "oauth2/authorize",
   	"applicationId":"<CLIENT_ID>",
   	"authCredential":"",
   	"redirectUrl":"https://<WSO2_OB_IAM_HOST>:9446/consentmgt",
   	"logoutUrl": "https://<WSO2_OB_IAM_HOST>:9446/consentmgt",
   	"cofAccessHistory": {
   		"enabled": true,
   		"url":"http://<WSO2_OB_BI_HOST>:8008/ConsentManagement/ConsentDataRetrievalStream"
   	},
   	"tokenApiName" : "token",
   	"tokenApiVersion" : "",
   	"authorizeApiName" : "authorize",
   	"authorizeApiVersion" : "",
   	"pagination" : {
   		"limit" : 11,
   		"actualLimit" : 10,
   		"offset": 0
   	},
   	"DeployedSpecification" : "UK"
   }

   
   

   
   

1. Sign in to the Identity and Access Management console (https://<WSO2_OB_IAM_HOST>:9446/carbon). Use the default super admin credentials:

   Username: admin@wso2.com

   Password: wso2123

   The above credentials are used for demo purposes only. It is recommended to change them in a production environment.

2. On the Main  tab, click  Identity > Users and Roles > Add > Add New Role and create the following user:

   Domain	Role	Permissions
   Internal	CustomerCareOfficer	No permissions required.

3. On the  Main  tab, click  Identity > Users and Roles > Add > Add New User and create the following user:

   User	Roles
   ann@gold.com	Internal/CustomerCareOfficer

4. Click Finish.