Slides from our Open Banking Tech Talk: https://www.meetup.com/London-Identity-Tech-Talks/events/242088293/

1. © 2017 ForgeRock. All rights reserved.
Deep dive into the Open
Banking payments flows
with AM
1

2. © 2017 ForgeRock. All rights reserved.
Quentin Castel
● Software engineer
● Senior sustaining engineer for ForgeRock
○ Also do engineering development,
specially around OAuth2/OIDC
● quentin@openbanking.web-castel.com
● https://www.linkedin.com/in/quentin-castel-257b1b75/
2

3. © 2017 ForgeRock. All rights reserved.
● Why building a payment flow demo
● Brief presentation of the flow
● As a AS, the key features required for this flow
● A demo of the payment flow with AM as the AS
● Deep dive into the code of the demo
What are we going to talk
about today
3

4. © 2017 ForgeRock. All rights reserved.
Why build a payment flow demo?
4

5. © 2017 ForgeRock. All rights reserved.
What is the payment flow?
5

6. © 2017 ForgeRock. All rights reserved.
● PISP : Payment initiation service provider
● ASPSP-AS: Account Servicing Payment Service Provider Authorization server.
● ASPSP-RS: Account Servicing Payment Service Provider Resource server.
● RCS: Remote Consent Service (ForgeRock solution)
○ From the open banking point of view, it will be like the AS.
● ACR: Authentication Context class Reference
In simple words:
● PISP : The shop, the place where you want to finalise your order
● ASPSP-AS: Your bank Access manager. The app in charge of identifying you
and authorize the shop to trigger a payment
● ASPSP-RS: The actual bank account. A virtualisation of your money.
● RCS: the app in charge of asking you if you consent the payment.
● ACR: The authentication chain the user is going to use.
6

7. © 2017 ForgeRock. All rights reserved.
https://openbanking.atlassian.net/wiki/spaces/WOR/pages/3948338/Security+Pro
file+Implementation+Guide+v0.2
The payment flows, that this scary diagram
You can find it here:
Payment flow
7

8. © 2017 ForgeRock. All rights reserved.
Payment flow
8

9. © 2017 ForgeRock. All rights reserved.
Payment flow with AM 5.5
9

10. © 2017 ForgeRock. All rights reserved.
AS: Key features needed
● Client authentication JWT
● Request parameter JWT
● Encrypted ID token
10

11. © 2017 ForgeRock. All rights reserved.
Client authentication JWT
11

12. © 2017 ForgeRock. All rights reserved.
Client authentication JWT
Deep dive into the demo code to see how to generate a client authentication JWT
12

13. © 2017 ForgeRock. All rights reserved.
Request parameter JWT
The request parameter is encrypted for the AS, so the user can’t
read the content of it.
13

14. © 2017 ForgeRock. All rights reserved.
Request parameter JWT
I printed the request parameter just before the encryption, so we can explore
what is inside of it. Technically, only the AS can decrypt and read the content
14

15. © 2017 ForgeRock. All rights reserved. 15

16. © 2017 ForgeRock. All rights reserved.
Request parameter JWT
Deep dive into the demo code to see how to generate a proper request
parameter
16

17. © 2017 ForgeRock. All rights reserved.
ID Token
Like the request parameter, the ID token is encrypted so the user can’t read it. This
time, it’s encrypted for the PISP, so only the PISP can decrypt it and read it.
17

18. © 2017 ForgeRock. All rights reserved.
ID Token
I printed the id token after the PISP decrypted, so we can explore the consent of it.
18

19. © 2017 ForgeRock. All rights reserved.
Demo of the payment flows
http://openbanking.web-castel.com/
19

20. © 2017 ForgeRock. All rights reserved.
Appendix : How was this demo made?
Nimbus JOSE + JWT
Eureka by netflix
20

21. © 2017 ForgeRock. All rights reserved.
Questions?
21

22. © 2017 ForgeRock. All rights reserved.
Thanks!
22