{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This document discusses how WSO2 Open Banking has implemented the Electronic Identification and Trust Services (eIDAS) Regulation for the NextGen PSD2 XS2A Framework.","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"Before you begin:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In order to try out the flows with the eIDAS approach, Third-Party Providers(TPPs) have to be registered in a Qualified Trust Service Provider (QTSP). ","type":"text"}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"legacy-content","text":"","parameters":{"cxhtml":"

If you are testing the WSO2 Open Banking solution for UK compliance, you can use either of the following:

Original eIDAS certificates:
- Qualified Website Authentication Certificate (QWAC)
- Qualified e-Seal Certificate (QSealC)

","nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"If you are testing the WSO2 Open Banking solution for UK compliance, you can use either of the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Original eIDAS certificates:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qualified Website Authentication Certificate (QWAC)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qualified e-Seal Certificate (QSealC)","type":"text"}]}]}]}]}]}]}],"version":1},"reason":"A note macro in a list item can't be created or edited in the new editor."}}}]},{"type":"listItem","content":[{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"legacy-content","text":"","parameters":{"nestedContent":{"type":"doc","content":[{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"MultiExcerptName":{"value":"instructions_to_add_certs_to_the_client_trust_stores"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"2350ca13-5f4e-41f3-94a3-40c163d9e77c"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"paragraph","content":[{"text":"In order to support eIDAS certificates in WSO2 Open Banking, you need to update the client trust stores. ","type":"text"}]},{"type":"expand","attrs":{"title":"Click here to see how it is done..."},"content":[{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"MultiExcerptName":{"value":"ConfiguringCerts"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"f11890a6-3534-48ed-8e4b-94b187f7380f"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"bgcolor","parameters":{"macroParams":{"color":{"value":"#fdfdfd"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"b59426d5-9e79-4d8b-9b60-635f83356597"},"schemaVersion":{"value":"1"},"title":"Background Color"}}},"content":[{"type":"paragraph","content":[{"text":"In order to support QWAC and QSealC in WSO2 Open Banking, the client trust store must contain all the root certificates of the QTSPs in the EU region.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"National Competent Authorities (NCAs) of each region maintains a list of QTSPs and QTSP certificates in their regions. The QTSP list and links to their QTSP certificates are aggregated to a single list named as List of Trust Lists (LoTL). ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You need to download all the QTSP certificates from LoTL and update the client trust store of WSO2 OB APIM. WSO2 Open Banking provides LoTL integrator, which is a separate tool to achieve this task. To get the LoTL integrator, you can contact the WSO2 Open Banking Support team via your support account or through the ","type":"text"},{"text":"contact us form.","type":"text","marks":[{"type":"link","attrs":{"href":"https://wso2.com/contact/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once downloaded, follow the steps given below to run LoTL integrator:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"LoTL integrator requires a connection to each of the national trust lists hosted by NCAs in the EU region. Please make sure that the environment that you are running the tool has the required network-level access for each of the trust lists in the EU region.","type":"text"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a copy of the client trust store in ","type":"text"},{"text":"/repository/resources/security/client-truststore.jks","type":"text","marks":[{"type":"code"}]},{"text":". When the tool asks for the path of the client trust store, provide the location to the copied client trust store.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extract the LoTL integrator and run the below command inside the directory of the LoTL integrator:","type":"text"}]},{"type":"codeBlock","content":[{"text":"java -jar custom-lotl-integrator-jar-with-dependencies.jar","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Provide the correct information when the tool asks for the path and password to the client trust store.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once you set up the client trust store successfully, replace the copy with the original client trust store. We encourage you to backup the original client trust store before the replacement.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the ","type":"text"},{"text":"WSO2 OB APIM","type":"text","marks":[{"type":"code"}]},{"text":" server.","type":"text"}]}]}]}]}]}]}]}]}]}],"version":1},"cxhtml":"instructions_to_add_certs_to_the_client_trust_storesINLINE

In order to support eIDAS certificates in WSO2 Open Banking, you need to update the client trust stores.

Click here to see how it is done...

ConfiguringCertsINLINE

#fdfdfdINLINE

In order to support QWAC and QSealC in WSO2 Open Banking, the client trust store must contain all the root certificates of the QTSPs in the EU region.

National Competent Authorities (NCAs) of each region maintains a list of QTSPs and QTSP certificates in their regions. The QTSP list and links to their QTSP certificates are aggregated to a single list named as List of Trust Lists (LoTL).
You need to download all the QTSP certificates from LoTL and update the client trust store of WSO2 OB APIM. WSO2 Open Banking provides LoTL integrator, which is a separate tool to achieve this task. To get the LoTL integrator, you can contact the WSO2 Open Banking Support team via your support account or through the contact us form.
Once downloaded, follow the steps given below to run LoTL integrator:
LoTL integrator requires a connection to each of the national trust lists hosted by NCAs in the EU region. Please make sure that the environment that you are running the tool has the required network-level access for each of the trust lists in the EU region.
1. Create a copy of the client trust store in <WSO2_OB_APIM_HOME>/repository/resources/security/client-truststore.jks. When the tool asks for the path of the client trust store, provide the location to the copied client trust store.
2. Extract the LoTL integrator and run the below command inside the directory of the LoTL integrator:
3. Provide the correct information when the tool asks for the path and password to the client trust store.
4. Once you set up the client trust store successfully, replace the copy with the original client trust store. We encourage you to backup the original client trust store before the replacement.
5. Restart the WSO2 OB APIM server.

"}}}]}]}]},{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"MultiExcerptName":{"value":"TPP_Validation"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"096d1801-39e1-47ea-aee8-9bc27e4b2e5d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"heading","attrs":{"level":4},"content":[{"text":"TPP Validation Service","type":"text"}]},{"type":"paragraph","content":[{"text":"TPP validation service allows OBIE-registered Account Servicing Payment Service Providers (ASPSPs) to validate TPPs from the NCAs. This is done by validating QWAC or OBWAC. Follow the steps to enable this service:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This is available only as a WUM update effective from January 03, 2021 (01-03-2021). For more information on updating WSO2 Open Banking, see ","type":"text"},{"text":"Updating WSO2 Products","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.wso2.com/display/updates/Using+WSO2+Update+Manager"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"legacy-content","text":"","parameters":{"nestedContent":{"type":"doc","content":[{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"MultiExcerptName":{"value":"TPP_Validation_Support"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"4f956de4-cfdb-415f-b742-beb5b29bc865"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"Prerequisites:","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure you have uploaded QWAC or OBWAC as the transport certificate in ","type":"text"},{"text":"/repository/resources/security/wso2carbon.jks. ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update ","type":"text"},{"text":"/repository/resources/security/client-truststore.jks","type":"text","marks":[{"type":"code"}]},{"text":" with the OBIE root, issuer certificates as mentioned ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://wso2docs.atlassian.net/wiki/spaces/OB140/pages/29395093/Dynamic+Client+Registration+v3.2#DynamicClientRegistrationv3.2-DynamicClientRegistrationv3.2-Uploadingcertificatetotheclienttruststore"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the QSealC keypair corresponding to QWAC or OBSealC keypair corresponding to OBWAC into a new JKS. For example, ","type":"text"},{"text":"wso2carbon-signing.jks. ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Place the JKS file in the ","type":"text"},{"text":"/repository/resources/security","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the ","type":"text"},{"text":"/repository/conf/finance/open-banking.xml","type":"text","marks":[{"type":"code"}]},{"text":" file:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following configs under the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" section:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"SoftwareStatementId","type":"text","marks":[{"type":"code"}]},{"text":" value needs to be configured according to the OBWAC/QWAC that has been configured in the ","type":"text"},{"text":"/repository/resources/security/wso2carbon.jks","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The OBIE service-related endpoints are for the OBIE sandbox environment.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t3600\n\tcom.wso2.finance.open.banking.gateway.service.obie.OBIECertValidationServiceImpl\n\t\n\t\tykNOgWd2RgnuoLRRyWBkaY\n\t\t\n\t\t\tASPSPReadAccess\n\t\t\tTPPReadAccess\n\t\t\tAuthoritiesReadAccess\n\t\t\n\t\thttps://matls-sso.openbankingtest.org.uk/as/token.oauth2\n\t\thttps://matls-dirapi.openbankingtest.org.uk/certificate/validate\n\t\thttps://matls-api.openbankingtest.org.uk/scim/v2/OBAccountPaymentServiceProviders\n\t\tGB\n\t\n\t\n\t\taccounts+\n\t\tpayments+\n\t\tfundsconfirmations+\n\t\n","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the ","type":"text"},{"text":"<","type":"text","marks":[{"type":"code"}]},{"text":"SigningKeystore","type":"text","marks":[{"type":"code"}]},{"text":">","type":"text","marks":[{"type":"code"}]},{"text":" tag with the file path of the JKS file that contains the OBSealC.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" tags with the alias and KID value of the signing certificate (OBSealC):","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\tsigning\n\t\n\t1pbTEt6v6_o0WpPFzmNXj6ediKw\n\t\n\t\t${carbon.home}/repository/resources/security/wso2carbon-signing.jks\n\t\twso2carbon\n\t\twso2carbon\n\t\n","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the ","type":"text"},{"text":"/repository/resources/api_templates/velocity_template.xml","type":"text","marks":[{"type":"code"}]},{"text":" file:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following handler as the first handler:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\n\t\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the TPP validation handler after the ","type":"text"},{"text":"#if($apiObj.additionalProperties.get(\"ob-spec\") == \"berlin\")","type":"text","marks":[{"type":"code"}]},{"text":" configuration as follows:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"#if($apiObj.additionalProperties.get(\"ob-spec\") == \"berlin\")\n ## TPP validation service handler\n ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Republish your Accounts, Payments, and CoF APIs with the ","type":"text"},{"text":"ob-spec,","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"ob-api-version,","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"ob-api-type","type":"text","marks":[{"type":"code"}]},{"text":" properties. For more information, see ","type":"text"},{"text":"Deploying APIs for Berlin","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.wso2.com/display/OB200/Deploying+APIs+for+Berlin#DeployingAPIsforBerlin-CreateandpublishanAPI"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open each API xml file(Accounts, Payments, and CoF APIs) in ","type":"text"},{"text":"/repository/deployment/server/synapse-configs/default/api","type":"text","marks":[{"type":"code"}]},{"text":" and make sure that both ","type":"text"},{"text":"APIPropertiesHandler","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"TPPValidationHandler","type":"text","marks":[{"type":"code"}]},{"text":" are available.","type":"text"}]}]}]}]}],"version":1},"cxhtml":"TPP_Validation_SupportINLINE

Prerequisites:

Make sure you have uploaded QWAC or OBWAC as the transport certificate in <WSO2_OB_APIM_HOME>/repository/resources/security/wso2carbon.jks.
Update <WSO2_OB_APIM_HOME>/repository/resources/security/client-truststore.jks with the OBIE root, issuer certificates as mentioned .

Add the QSealC keypair corresponding to QWAC or OBSealC keypair corresponding to OBWAC into a new JKS. For example, wso2carbon-signing.jks.
Place the JKS file in the <WSO2_OB_APIM_HOME>/repository/resources/security directory.
Open the <WSO2_OB_APIM_HOME>/repository/conf/finance/open-banking.xml file:
1. Add the following configs under the <CertificateManagement> section:
  - The SoftwareStatementId value needs to be configured according to the OBWAC/QWAC that has been configured in the <WSO2_OB_APIM_HOME>/repository/resources/security/wso2carbon.jks.
  - The OBIE service-related endpoints are for the OBIE sandbox environment.
    xml\n\t3600\n\tcom.wso2.finance.open.banking.gateway.service.obie.OBIECertValidationServiceImpl\n\t\n\t\tykNOgWd2RgnuoLRRyWBkaY\n\t\t\n\t\t\tASPSPReadAccess\n\t\t\tTPPReadAccess\n\t\t\tAuthoritiesReadAccess\n\t\t\n\t\thttps://matls-sso.openbankingtest.org.uk/as/token.oauth2\n\t\thttps://matls-dirapi.openbankingtest.org.uk/certificate/validate\n\t\thttps://matls-api.openbankingtest.org.uk/scim/v2/OBAccountPaymentServiceProviders\n\t\tGB\n\t\n\t\n\t\taccounts+\n\t\tpayments+\n\t\tfundsconfirmations+\n\t\n]]>
2. Configure the <SigningKeystore> tag with the file path of the JKS file that contains the OBSealC.
3. Configure the <SigningCertificateAlias> and the <SigningCertificateKid> tags with the alias and KID value of the signing certificate (OBSealC):
  xml\n\t\n\tsigning\n\t\n\t1pbTEt6v6_o0WpPFzmNXj6ediKw\n\t\n\t\t${carbon.home}/repository/resources/security/wso2carbon-signing.jks\n\t\twso2carbon\n\t\twso2carbon\n\t\n]]>
Open the <WSO2_OB_APIM_HOME>/repository/resources/api_templates/velocity_template.xml file:
1. Add the following handler as the first handler:
  xml\n\t\n\t\n\t\n]]>
2. Add the TPP validation handler after the #if($apiObj.additionalProperties.get("ob-spec") == "berlin") configuration as follows:
  xml]]>
Republish your Accounts, Payments, and CoF APIs with the ob-spec, ob-api-version, and ob-api-type properties. For more information, see Deploying APIs for Berlin.
Open each API xml file(Accounts, Payments, and CoF APIs) in <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api and make sure that both APIPropertiesHandler and TPPValidationHandler are available.

"}}},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"legacy-content","text":"","parameters":{"nestedContent":{"type":"doc","content":[{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"MultiExcerptName":{"value":"Custom_Certificate_Validation"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"1c7d7a0f-1bf1-4b8b-a07a-e533621a4770"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"heading","attrs":{"level":5},"content":[{"text":"Integrating a Custom Certificate Validation Service","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want to integrate a custom validation service rather than OBIE, you can configure as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Implement the following interface for the required certificate validation service.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"package com.wso2.finance.open.banking.gateway.service;\npublic interface TPPValidationService {\n /**\n * Validate the status of a TPP\n *\n * @param peerCertificate Certificate of the TPP\n * @param requiredPSD2Roles Roles that are required to be validated with the TPP validation service according to\n * the current flow\n * @param metadata Metadata information\n * @return\n * @throws TPPValidationException\n */\n boolean validate(X509Certificate peerCertificate, List < PSD2RoleEnum > requiredPSD2Roles, Map < String, Object > metadata) throws TPPValidationException;\n\n /**\n * Get the cache key used for the caching the response. Implementation should return an appropriate ID that is\n * unique to the API flow.\n *\n * @param peerCertificate Certificate of the TPP\n * @param requiredPSD2Roles Roles that are required to be validated with the TPP validation service according to\n * the current flow\n * @param metadata Metadata information\n * @return\n * @throws TPPValidationException\n */\n String getCacheKey(X509Certificate peerCertificate, List < PSD2RoleEnum > requiredPSD2Roles, Map < String, Object > metadata) throws TPPValidationException;\n\n}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once implemented, build a JAR file for your custom certificate validation service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Place the above-created JAR file in the ","type":"text"},{"text":"/repository/components/dropins","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the ","type":"text"},{"text":"/repository/conf/deployment.toml","type":"text","marks":[{"type":"code"}]},{"text":" file and find the ","type":"text"},{"text":"[open_banking.cert_mgt.tpp_validation_service] ","type":"text","marks":[{"type":"code"}]},{"text":"tag.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure your TPP validation service using its ","type":"text"},{"text":"Fully Qualified Name (FQN)","type":"text"},{"text":" as follows:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"[open_banking.cert_mgt.tpp_validation_service]\ncache_expiry=3600\ntpp_validation_impl_class=\"\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following tags below the ","type":"text"},{"text":"[open_banking.cert_mgt.tpp_validation_service]","type":"text","marks":[{"type":"code"}]},{"text":" configurations:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"[open_banking.cert_mgt.tpp_validation_service.scope_regex_patterns]\naisp=\"accounts+\"\npisp=\"payments+\"\ncbpii=\"fundsconfirmations+\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure you have the following handler as the first handler under the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" section in the ","type":"text"},{"text":"/repository/resources/api_templates/velocity_template.xml","type":"text","marks":[{"type":"code"}]},{"text":" file. Otherwise add the handler.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\n\t\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the ","type":"text"},{"text":"TPPValidationHandler","type":"text","marks":[{"type":"code"}]},{"text":" handler right after the ","type":"text"},{"text":"#if($apiObj.additionalProperties.get(\"ob-spec\") == \"berlin\")","type":"text","marks":[{"type":"code"}]},{"text":" configuration in the ","type":"text"},{"text":"/repository/resources/api_templates/velocity_template.xml","type":"text","marks":[{"type":"code"}]},{"text":" file.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"#if($apiObj.additionalProperties.get(\"ob-spec\") == \"berlin\")\n ## TPP validation service handler\n ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Republish your Accounts, Payments, and CoF APIs using publisher. Make sure that you have added the ","type":"text"},{"text":"ob-spec, ob-api-version","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"ob-api-type","type":"text","marks":[{"type":"code"}]},{"text":" properties before republishing the APIs.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open each API xml file (Accounts, Payments, and CoF APIs) in ","type":"text"},{"text":"/repository/deployment/server/synapse-configs/default/api","type":"text","marks":[{"type":"code"}]},{"text":" directory and make sure that both ","type":"text"},{"text":"APIPropertiesHandler","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"TPPValidationHandler","type":"text","marks":[{"type":"code"}]},{"text":" are added under the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" section.","type":"text"}]}]}]}]}],"version":1},"cxhtml":"Custom_Certificate_ValidationINLINE

Integrating a Custom Certificate Validation Service

If you want to integrate a custom validation service rather than OBIE, you can configure as follows:

Implement the following interface for the required certificate validation service.
java requiredPSD2Roles, Map < String, Object > metadata) throws TPPValidationException;\n\n /**\n * Get the cache key used for the caching the response. Implementation should return an appropriate ID that is\n * unique to the API flow.\n *\n * @param peerCertificate Certificate of the TPP\n * @param requiredPSD2Roles Roles that are required to be validated with the TPP validation service according to\n * the current flow\n * @param metadata Metadata information\n * @return\n * @throws TPPValidationException\n */\n String getCacheKey(X509Certificate peerCertificate, List < PSD2RoleEnum > requiredPSD2Roles, Map < String, Object > metadata) throws TPPValidationException;\n\n}]]>
Once implemented, build a JAR file for your custom certificate validation service.
Place the above-created JAR file in the <WSO2_OB_APIM_HOME>/repository/components/dropins directory.
Open the <WSO2_OB_APIM_HOME>/repository/conf/deployment.toml file and find the [open_banking.cert_mgt.tpp_validation_service] tag.
Configure your TPP validation service using its Fully Qualified Name (FQN) as follows:
xml
Add the following tags below the [open_banking.cert_mgt.tpp_validation_service] configurations:
xml
Make sure you have the following handler as the first handler under the <Handlers> section in the <WSO2_OB_APIM_HOME>/repository/resources/api_templates/velocity_template.xml file. Otherwise add the handler.
xml\n\t\n\t\n\t\n]]>
Add the TPPValidationHandler handler right after the #if($apiObj.additionalProperties.get("ob-spec") == "berlin") configuration in the <WSO2_OB_APIM_HOME>/repository/resources/api_templates/velocity_template.xml file.
xml]]>
Republish your Accounts, Payments, and CoF APIs using publisher. Make sure that you have added the ob-spec, ob-api-version and ob-api-type properties before republishing the APIs.
Open each API xml file (Accounts, Payments, and CoF APIs) in <WSO2_OB_APIM_HOME>/repository/deployment/server/synapse-configs/default/api directory and make sure that both APIPropertiesHandler and TPPValidationHandler are added under the <handlers> section.

"}}}]},{"type":"bodiedExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt","parameters":{"macroParams":{"location":{"value":"top"},"MultiExcerptName":{"value":"token-generation"},"atlassian-macro-output-type":{"value":"INLINE"}},"macroMetadata":{"macroId":{"value":"7ede1729-6d6e-472e-99c4-91d1ec3c86a9"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt (legacy)"}}},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Token generation","type":"text"}]},{"type":"paragraph","content":[{"text":"WSO2 Open Banking supports Private Key JSON Web Token (JWT) and MTLS as token authentication methods. ","type":"text"}]},{"type":"table","attrs":{"layout":"align-start"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Authentication method","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Private Key JWT","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Sign JWT using QSealC.","type":"text"}]},{"type":"paragraph","content":[{"text":"The signing certificate needs to be mentioned under ","type":"text"},{"text":"software_jwks_endpoint","type":"text","marks":[{"type":"code"}]},{"text":" of the SSA. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MTLS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Initiate the access token request using the QWAC certificate as the certificate for mutual authentication. In the request header, mention the path to the public and private keys of the transport certificate. To find the sample request for the user-access token, see ","type":"text"},{"text":"Accounts Information Service Provider Flow v1.3.6","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.wso2.com/display/OB200/Accounts+Information+Service+Provider+Flow+v1.3.6"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Thereby, the public key of the transport certificate provided for the token endpoint will be verified against the ","type":"text"},{"text":"software_jwks_endpoint","type":"text","marks":[{"type":"code"}]},{"text":" in the SSA.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The following diagram describes how the token generation is implemented in WSO2 Open Banking with accordance to eIDAS:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":800,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1280,"id":"024392dc-4932-4b09-ae8a-7947c5feb201","collection":"contentId-48632365","type":"file","height":879}}]},{"type":"paragraph","content":[{"text":"For more information about the token authentication methods used in WSO2 Open Banking, see ","type":"text"},{"text":"API Security for Berlin","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.wso2.com/display/OB200/API+Security+for+Berlin"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"API invocation","type":"text"}]},{"type":"paragraph","content":[{"text":"Account Information Service Provider, Payment Initiation Service Provider, and Card-Based Payment Instrument Issuer are roles for a TPP. This role is validated so that only a particular TPP is allowed to invoke an API. APIs are protected using MTLS, which uses the QWAC as the transport certificate in each of the requests. To see how MTLS affects in the API invocations, see ","type":"text"},{"text":"API Security for Berlin","type":"text","marks":[{"type":"link","attrs":{"href":"https://wso2docs.atlassian.net/wiki/spaces/OB200/pages/48632350/API+Security+for+Berlin#APISecurityforBerlin-MutualTransportLayerSecurity(MTLS)"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"[","type":"text"},{"text":"Back to Top","type":"text","marks":[{"type":"link","attrs":{"href":"https://wso2docs.atlassian.net/wiki/spaces/OB200/pages/48632365"}}]},{"text":"]","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Sources of Information","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eIDAS regulation","type":"text","marks":[{"type":"link","attrs":{"href":"https://ec.europa.eu/futurium/en/system/files/ged/eidas_regulation.pdf"}}]}]}]}]},{"type":"paragraph","content":[{"text":"[","type":"text"},{"text":"Back to Top","type":"text","marks":[{"type":"link","attrs":{"href":"https://wso2docs.atlassian.net/wiki/spaces/OB200/pages/48632365"}}]},{"text":"]","type":"text"}]}]}],"version":1}

eIDAS Implementation for Berlin