Payment Initiation Service Provider Flow v1.3.6

1. Navigate to the WSO2 Open Banking Developer portal at https://<WSO2_OB_APIM_HOST>:9443/devportal.

2. Select Applications in the menu. 
   
3. In the Sign-in form, click Create Account.
   
4. Provide a username and click Proceed Self Register.
   

5. Fill the Create New Account form to complete registration.

6. Read terms and conditions. Click the checkbox to agree to the terms and conditions.
   

7. Click Register.

1. Sign in to the Developer portal as the TPP at https://<WSO2_OB_APIM_HOST>:9443/devportal.

2. Enter the username and the password you entered when signing up as a TPP.  
   

3. Click Continue. 

The homepage of the Developer Portal is now displayed along with the published APIs.

1. Go to the Applications tab in the Developer Portal.  
   

2. Click ADD NEW APPLICATION.

   

3. Enter application details.

   • WSO2 Open Banking currently authenticates the TPP applications using the Reference (Opaque) method.
   • For the Application Certificate, you need to upload the QSealC certificate obtained from a Qualified Trust Service Provider (QTSP).
     

   You can validate the Organization Identifier field according to  a custom regex you provide:

   This is available only as a WSO2 Update and is effective from August 11, 2021 (08-11-2021). For more information on updating WSO2 Open Banking, see Updating WSO2 Products.

    Click here to see how it done...

   1. Open the <WSO2_OB_APIM_HOME>/repository/deployment/jaggeryapps/devportal/site/public/theme/settings.js file.

   2. Inside the openbanking element, add the orgIdRegex and maxAllowedInputLength tags as follows: 

      openbanking: {
              spec: 'BERLIN',
              grantTypes: {
                  authorization_code: 'Code',
                  implicit: 'Implicit',
                  refresh_token: 'Refresh Token',
                  client_credentials: 'Client Credentials',
              },
              orgIdRegex: '^OB:[A-Z]{2}-[A-Z]{3}-[a-zA-Z0-9]*$',
              maxAllowedInputLength: 20
      }
      

      1. orgIdRegex: Organization Identifier is validated against this regex value.
      2. maxAllowedInputLength: The maximum length allowed for an Organization Identifier.

   3. orgIdRegex and maxAllowedInputLength are optional configurations and if they are not configured, the default regex value will be used without input length validation. the default regex value is as follows:

      ^PSD[A-Z]{2}-[A-Z]{2,8}-[[a-zA-Z0-9]*$

   4. You can customize the error message that is displayed when the above validation fails. 
      1. Open the <WSO2_OB_APIM_HOME>/repository/deployment/jaggeryapps/devportal/site/public/locales/en.js file.
      2. Update the following fields as required:
         • Shared.AppsAndKeys.OBConfiguration.org.id.content.helper
         • Shared.AppsAndKeys.OBConfiguration.org.id.content.helper.error

4. Click SAVE. 

1. Go to the APIs tab in the Developer portal.
   

2. Select the NextGenPSD2XS2A Framework API. 
   

3. Go to Subscriptions at the bottom of the API and select SUBSCRIBE.
   
4. Select an Application from the drop-down list, set the Throttling Policy and click SUBSCRIBE.
   

5. Once you subscribe, you can find the list of subscriptions in the bottom.
   

Now that you have subscribed to the API, generate access tokens and invoke the API.

[open_banking.cert_mgt.cert_revocation_proxy]
enable = false

1. A keystore file is used to store the trusted certificates of the TPP in the WSO2 Open Banking solution. Use the commands given below in a command-line interface in order to create a keystore file as a TPP.

   Make sure to update the following placeholders:

   <alias>	A preferred alias for the keystore file.
   <filename>	A preferred name for the keystore file.

   keytool -genkey -alias <alias> -keyalg RSA -keystore <filename>.jks

   During the command execution, the TPP user requires to;

   1. Set a password for the keystore.
   2. Provide information, acquired when registering with a governing entity.
   3. Set a password for user-defined alias (<alias>).

2. Convert the keystore from the .jks format to .PKCS12.  Make sure to update the following placeholders:

   <keyStoreName>	This is the name of the <filename>, given above.
   <PKCS12FileName>	This is the name of the keystore in the .PKCS12 format.

   keytool -importkeystore -srckeystore <keystoreStoreName>.jks -destkeystore <PKCS12FileName>.p12 -deststoretype PKCS12

   During the command execution, the TPP user requires to;

   1. Set a password for the destination keystore.
   2. Enter the source keystore password, as defined in the above step .

3. Create the application certificate (.pem) file in the PKCS12 format using the keystore. e.g: tpp.p12.

   Make sure to update the following placeholders:

   <PKCS12FileName>	This is the name of the keystore in the PKCS12 format, as mentioned above for the <PKCS12FileName>.
   <PEMFileName>	This is the name of the application certificate that is created in the .pem format.

   openssl pkcs12 -in <PKCS12FileName>.p12 -nokeys -out <PEMFileName>.pem

   During the command execution, the TPP user requires to;

   1. Set a password to import the .pem file.

1. Sign in to WSO2 Open Banking Developer portal as a TPP user.

2. Go to the Applications tab and select the application you used to subscribe to the NextGen PSD2 Framework API.
   

3. Scroll down and select either of the following types of keys:

   1. Production Keys: Generates access tokens in the production environment.

   2. Sandbox Keys: Generates access tokens in the sandbox environment.

4. Click Manage at the bottom of the page.
   

5. Provide the requested information as defined below:  

   Field	Description
   Grant Types	These determine the credentials that are used to generate the access token. Code: This relates to the authorisation code grant type and is applicable when consuming the API as a user. Implicit: This is similar to the code grant type, but instead of generating code, this directly provides the access token. Refresh Token: This is to renew an expired access token. Client Credential: This relates to the client credentials grant type and is applicable when consuming the API as an application.
   Callback URL	This is the URL used by the TPP to receive the authorisation code sent from the Account Servicing Payment Service Provider (ASPSP), e.g: bank. The authorisation code can be used later to generate an OAuth2 access token.
   Application Certificate	This is the content between the BEGIN CERTIFICATE and END CERTIFICATE strings of the application certificate (.PEM).   For testing purposes, you may use the here to download a sample application certificate, if you have configured the OB certificates.
   Organization ID	The Organization Identifier as provided in the eIDAS certificate. For example. PSDUK-NCA-OrganizationID

   

6. Click GENERATE KEYS to generate production or sandbox keys. It generates consumer key and consumer secret.

1. Generate the client assertion by signing the following JSON payload using the supported algorithms. The supported algorithms are RS256 and PS256.

   The value of the aud claim should contain the same value as the Identity Provider Entity ID.

    Click here to view the Identity Provider Entity ID:

   1. Sign in to the Identity and Access Management console at  https://localhost:9446/carbon . 
   2. In the Main menu, go to Home > Identity > Identity Providers > Resident.
   3. View the value in Resident Identity Provider > Inbound Authentication Configuration > OAuth2/OpenID Connect Configuration > Identity Provider Entity ID. By default this value is set to  https://localhost:8243/token .

2. Run the following cURL command in a command prompt to generate the access token. Update the placeholders with the relevant values.

   curl -v POST \
    https://<WSO2_OB_APIM_HOST>:8243/token \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
    -H "Content-Type: application/x-www-form-urlencoded;charset=ISO-8859-1" \
    -d "client_id=<CLIENT_ID>&grant_type=client_credentials&scope=payments+openid&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=<CLIENT_ASSERTION_JWT>&redirect_uri=<APPLICATION_CALLBACK_URL>" 

   The access token is now generated.

   You can use the same cURL command to regenerate the access token.