Running the Functional Conformance Suite for UK

The  Open Banking Implementation Entity (OBIE) Functional Conformance Certificate allows WSO2 Open Banking to demonstrate that the solution has successfully implemented all required functional elements of the OBIE Read/Write API specifications, passing all tests performed by the Functional Conformance Tool.

This document contains the following topics:

Configuring the solution 

1. Set the RenewTokenPerRequest property to false in <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml as follows:

2. In <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml, update the <WSO2_OB_APIM_HOST> placeholder with the hostname of the API Manager server for IDTokenIsuuerID:

3. Change the MaximumFuturePaymentDays value to 365 in <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml as follows:

4. Open the <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml and <WSO2_OB_APIM_HOME>/repository/conf/deployment.toml files and set the following configuration to false:

5. The Functional conformance suite invokes the endpoints exposed by the host machine. Therefore, you need to add a hostname to the  Docker-bridge interface.  Thereby, both WSO2 Open Banking Identity and Access Management (WSO2_OB_IAM_HOST) and WSO2 Open Banking API Management (WSO2_OB_APIM_HOST) servers can be accessed via the server hostnames and Docker-bridge hostname (DOCKER_SEVER_HOST).

   1. Create a new server key and a certificate including the following parameters:

      1. server hostname as Common Name (CN).

      2. DOCKER-BRIDGE_SEVER_HOST as Subject Alternative Name (SAN).  See the sample given below:

         [req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = VA L = SomeCity O = MyCompany OU = MyDivision CN = <WSO2_OB_APIM_HOST> [v3_req] keyUsage = keyEncipherment, dataEncipherment, digitalSignature extendedKeyUsage = serverAuth, clientAuth subjectAltName = @alt_names [alt_names] DNS.1 = <DOCKER-BRIDGE_SEVER_HOST>
         openssl req -x509 -nodes -days 3560 -newkey rsa:4096 -keyout wso2carbon.key -out wso2carbon.crt -config req.conf -extensions 'v3_req'

   2. Create a new keystore with the generated certificate. Please use the same keystore password (KEYSTORE_PASSWORD) that you have already configured for the existing keystore:

      openssl pkcs12 -export -in wso2carbon.crt -inkey wso2carbon.key -name <KEYSTORE_PASSWORD> -out <WSO2_OB_APIM_HOST>.p12

   3. Import the generated server certificate (step a) to client truststore of both WSO2_OB_IAM_HOST and WSO2_OB_APIM_HOST servers:

      keytool -importcert -file wso2carbon.crt -keystore client-truststore.jks -alias "<WSO2_OB_APIM_HOST>"

Configuring JWS validation

1. Open the deployment.toml files and do the following configurations:

   • <WSO2_OB_IAM_HOME>/repository/conf/deployment.toml

   • <WSO2_OB_APIM_HOME>/repository/conf/deployment.toml

2. Configure signing configurations as follows: 

   [open_banking.uk.signing_config] enable = true obie.trusted_anchors.signing = "openbanking.org.uk" obie.trusted_anchors.validation = "openbanking.org.uk" obie.org_id = "<org_id in the SSA or Organizational Unit of the certificate Owner>"

3. Find the following tags and define the alias and kid values for the primary signing certificates:

   [open_banking.ob_identity_retriever.server] signing_cert_alias="<production-key alias>" signing_cert_kid="<production kid>"

4. Follow the API Security - JSON Web Signature (JWS) documentation and configure JWS validation support for Waiver 007.

5. Combine the signing certificate and key to a pk12 format file using the command below: 

   openssl pkcs12 -export -in <pem file> -inkey <key file> -name <alias> -out CertAndKey.p12

6. Create a new keystore file: 

   keytool -genkey -alias <keystore alias> -keyalg RSA -keystore <keystore name>.jks -keysize 2048

7. Import the p12 files to the new keystore. 

   keytool -importkeystore -deststorepass <keystore password> -destkeystore <keystore name>.jks -srckeystore CertAndKey.p12 -srcstoretype PKCS12

8. Add the new keystore to the client-truststore.

   1. Go to the <WSO2_OB_IAM_HOME>/repository⁩/⁨resources⁩/security directory.

   2. Export the public certificate of the keystore to a .pem file. 

      keytool -export -alias <alias> -keystore <keystore_name>.jks -file <keystore_name>.pem

   3. Import the  .pem  file to  client-truststore.jks. 

      keytool -import -alias <alias> -file <keystore name>.pem -keystore client-truststore.jks -storepass wso2carbon

   4. Go to the <WSO2_OB_APIM_HOME>/repository⁩/⁨resources⁩/security  directory and repeat the above steps. 

9. Duplicate and place the new keystore in the following locations:

   • <WSO2_OB_IAM_HOME>/repository⁩/⁨resources⁩/security

   • <WSO2_OB_APIM_HOME>/repository⁩/⁨resources⁩/security

10. Configure the new keystore file in deployment.toml files:

    [keystore.primary] file_name = "<new_keystore.jks>" type = "JKS" password = "<new keystore password>" alias = "<new private key alias>" key_password = "<new private key password>"

11. Update the Organization JWKS URL configuration with the JWKS URL retrieved from the Open Banking directory: 

    [oauth.endpoints] oauth2_jwks_url = "<org_jwks_endpoint in the SSA>"

Running the solution

1. Start WSO2 Open Banking API Manager and WSO2 Identity Access Management servers.

2. Deploy Account and Transaction API v3.1.5, Payment Initiation API v3.1.5, and Confirmation of Funds API v3.1.5.

3. Sign in to the API Developer Portal as a TPP at https://<WSO2_OB_APIM_HOST>:9443/store.

4. Change the redirect URL of the application to “https://< DOCKER-BRIDGE_SEVER_HOST> :8443/conformancesuite/callback”.

Setting up the test suite