Configuring Security

The token is validated against the algorithm provided in the configuration and the original value available in the JWT token. If there is a mismatch in these two values, IRIS ignores this request and send an unauthorised response back.

<beans:property name="idTokenSignedAlg" value="RS256" />

In the above example, the token is Algorithm RS256. However, this value can be changed according to your token type.

To enable signature validation, set the below property to true. By default, this is set to false.

<beans:property name="idTokenSigned" value="" />

Every JWT token is signed by the token provider using their private key, and this signature can be validated only with the public key provided by the token provider. The public key is configured to validate the signature of the JWT token in IRIS. IRIS supports four ways to obtain the public key, and anyone of the below four properties is mandatory for IRIS to validate the signature.

• <beans:property name="pkEncoded" value="" /> - use this property if the client has the public key as a String , which can be base64 encoded and added here.
• <beans:property name="pkCertEncoded" value="" /> - use this property if the client has the key certificate as a String, which can be base64 encoded and added here.
• <beans:property name="pkCertFilePath" value="" /> - use this property if the client has the key certificate as a certificate file (.cer or .pem), and that location can be directly configured here.
• <beans:property name="pkJwksUri" value="" /> - use this property if the client can expose the JWKS URI to obtain the public key.

<beans:property name="idTokenSigned" value="false" />

ClaimValidator is a generic validator for different claims in the token. Each instance of the ClaimValidator validates one specific claim. The claim that needs to be validated is injected into an instance.

Following are the mandatory claims in any JWR token:

• exp
• iss
• iat

The user can use the following configurations to perform any claim validations other than the default claim validations.

<beans:bean id="customClaim" class="com.temenos.irf.web.security.jwt.validator.CustomClaimValidator">

<beans:property name="customClaims">

<beans:map>

<beans:entry key="" value="" />

<beans:entry key="" value="" />

</beans:map>

</beans:property>

</beans:bean>

The user can add any number of keys and values in the above property. All the values must be validated against the values present in the JWT token, and if any validation fails, then IRIS sends an un-authenticated response to the user.

The client or support development can extract the values from the JWT token and use them later in the published or /provider services. The following bean is configured to extract those values from the token and set them in the request context header.

<beans:bean id="requiredFields" class="com.temenos.irf.web.security.jwt.parser.RequiredFieldsExtractor">

<beans:property name="claimsToExtract">

<beans:list>

<beans:value></beans:value>

<beans:value></beans:value>

</beans:list>

</beans:property>

</beans:bean>

The user can add any number of values in the above property to extract. The below screen shot is an example.

After the token is validated, the validation filter builds and propagates the authenticated principal and invokes the remaining filter change as usual.

Spring Security uses org.springframework.security.core.userdetails. UserDetails to manage user information across the application. After authenticating the requests, spring security makes userDetails available as a part of the Spring Authentication object.

IRISAuthenticatedUser is the iris-authenticated user object used to carry user data as part of the Spring Authentication object.

After the token is authenticated, the successfulAuthentication callback sets the Spring Authentication object references in the Spring Security Context. The Security Context holds the user information (IRISAuthenticatedUser), which is available across the IRIS Version and Enquiry processors.

To get this user principle, the user or client needs to configure the claim where the user principle is available, which is configured in the below property. The default value is "sub".

<beans:property name="principalClaim" value="sub" />

Configure the below setup in the psd2 iris war files:

The value in 'roleId' must correspond to a record in the EB.USER.ROLE table. Only the enquiries and available versions associated with this record will be accessible. A sample is shown in the screenshot below.

After creating the consent or payment, the gateway generates a token with the below payload structure and sends it to Temenos Transact for further processing.

{
"iss": "OpenBankingGateway",          
"aud": "PSD2",            
"sub": "IB100404",       
"exp": 2162243203,    
"iat": 1562243203,
"scp": "AISP",
"referenceId": "AAACT231083Q8T2RBL",
"tppId": "TeePee",
"tppName": "TeePee",
"registeredCompanyName": "Temenos"
}