JWS signature validation changes after waiver 007 expiry

kasundharmadasa commented 4 years ago

Description:

Add the following handler as the first handler at the section in the /repository/resources/api_templates/velocity_template.xml

## API properties handler to add the required properties to the message context
<handler class="com.wso2.finance.open.banking.gateway.common.APIPropertiesHandler">
<property name="xWso2ApiSpec" value='$apiObj.additionalProperties.get("ob-spec")'/>
<property name="xWso2ApiVersion" value='$apiObj.additionalProperties.get("ob-api-version")'/>
<property name="xWso2ApiType" value='$apiObj.additionalProperties.get("ob-api-type")'/>
</handler>

Make sure that the following handler is uncommented in velocity_template.xml and available in all the Accounts, Payments an CoF APIs.
```
 <handler class="com.wso2.finance.open.banking.gateway.jws.UKJwsSignatureHandler"/>
```

Add the following handler in the /repository/conf/synapse-handlers.xml file as the last handler.

<handler name = "UkJwsResponseSignatureHandler" class="com.wso2.finance.open.banking.gateway.jws.UkJwsResponseSignatureHandler">
</handler>

Login to WSO2 OB API Manager Publisher portal (https://localhost:9443/publisher)
Edit the existing Accounts, Payments and COF APIs to include the following API Property. Edit API -> Manage -> API Properties

Property Name : ob-api-version Property Value : 3.1.1 (or the specification version that have been currently implemented)
Save and Publish to redeploy all the Accounts, Payments and COF APIs.

The signature validation related configuration can be found under the and in /repository/conf/finance/open-banking.xml


<SigningConfiguration>
        <!-- Enable Response Signing -->
        <Enable>true</Enable>
        <OBIE>
            <!--
                Trusted Anchor Configuration
            -->
            <TrustedAnchors>
                <!-- Domain name that is registered to and identifies the Trust Anchor that hosts the public counter-part of the key used for signing the response. Included in the claim http://openbanking.org.uk/tan -->
                <Signing>openbanking.org.uk</Signing>
                <!--
               Trusted domain names that are registered to and identifies the Trust Anchor that hosts the public counter-part of the key used for request signing by the TPP. The value included in the claim http://openbanking.org.uk/tan of the TPP's JOSE header will be validated against the following list of domain names.
                    Multiple values supported with `|` delimiter
                    IE - trustanchor.org|trustanchor.org.uk
                -->
                <Validation>openbanking.org.uk</Validation>
            </TrustedAnchors>
            <!-- Organization Id of the ASPSP. This value is used as the http://openbanking.org.uk/iss claim during response signing -->
            <OrganizationId>ABC1234</OrganizationId>
        </OBIE>
        <!-- Default Singing Algorithm is PS256, to support others uncomment line below -->
        <!--<Algorithm>RS256</Algorithm>-->

        <!-- By default the UK specification mandates the Payment and Even Notification APIs to have request/response message signing. Hence, the following specified APIs will be mandated for message signing. -->
        <MandatedAPIs>
            <APIContext>/open-banking/v3.0/event-notification/</APIContext>
            <APIContext>/open-banking/v3.0/pisp/</APIContext>
            <APIContext>/open-banking/v3.1/event-notification/</APIContext>
            <APIContext>/open-banking/v3.1/pisp/</APIContext>
        </MandatedAPIs>

        <ResponseSignatureRequiredAPIs>
            <APIContext>/open-banking/v3.0/pisp/</APIContext>
            <APIContext>/open-banking/v3.1/pisp/</APIContext>
        </ResponseSignatureRequiredAPIs>
    </SigningConfiguration>


 ```xml
 <OBIdentityRetriever>
        <!--
            Server Key configuration
            used for singing purposes IE - message signing
        -->
        <Server>
            <!-- alias the certificate used for signing (in repository/resources/security/wso2carbon.jks)-->
            <SigningCertificateAlias>wso2carbon</SigningCertificateAlias>

            <!-- KID value for primary signing certificate that is exposed by the JWKS endpoint under OIDC well-known endpoint (by default https://localhost:8243/.well-known/openid-configuration) -->
            <SigningCertificateKid></SigningCertificateKid>
        </Server>
    </OBIdentityRetriever>