Updated nonce to be required "The API Provider must be replay the supplied nonce parameter in any ID Token response."
Updated at_hash to be optional in ID Token response
Clarification that a Confidential Client "shall accept and verify signed ID Tokens (JWS)"
Clarification that "OpenID Connect Request Object values (in the JWT) supersede those which are passed using the OAuth 2.0 request query parameter syntax." in the draft3-RequestObject
Updated 8.2.1 to state "Authorization servers must not support the Request Object Endpoint (request_uri)"
"The scope parameter must contain openid" as the profile mandates the hybrid flow
"Third Parties must specify code id_token" as the profile mandates the hybrid flow
...
Panel
title
Read and Write API Security Profile Variations
borderStyle
solid
5.2 Read and Write API Security Provisions
5.2.1 Introduction
The NZ Banking Data API Security Profile does not distinguish between the security requirements from a technical level between "read" and "write" resources. The security requirements for accessing Customer resources held at API Providers requires more protection level than a basic OAuth 2.0 (RFC6749) supports.
As a profile of The OAuth 2.0 Authorization Framework, this document mandates the following to the NZ Banking Data APIs.
5.2.2 Authorization Server
The Authorization Server
shall only support confidential clients;
shall secure its token endpoint using mutually authenticated TLS;
shall only support the response_type value code id_token;
shall require the ConsentId to be passed in the authorisation request as an essential claim;
shall issue an ID Token in the token response as in Section 3.1.3.3 of OIDC with its "sub" value corresponding to the ConsentId;
may support refresh tokens; and
shall provide a discovery endpoint that does not require a client certificate to authenticate using a TLS certificate that should be trusted by the user agent.
5.2.4 Confidential Client
A Confidential Client
may use separate and distinct Redirect URI for each Authorization Server that it talks to; and
shall accept and verify signed ID Tokens (JWS);
6. Accessing Protected Resources
6.1 Introduction
The FAPI endpoints are OAuth 2.0 protected resource endpoints that return various financial information for the resource owner associated with the submitted access token.
6.2 Access Provisions
6.2.1 Protected resources provisions
The resource server with the FAPI endpoints
shall mandate mutually authenticated TLS; and
shall verify that the client identifier bound to the underlying mutually authenticated TLS transport session matches the client that the access token was issued to.
6.2.2 Client Provisions
The confidential client supporting this document
shall use mutually authenticated TLS;
shall supply the last time the customer logged into the client as defined by FAPI clause 6.2.2.3;
shall supply the customer's IP address if this data is available as defined by FAPI clause 6.2.2.4;
shall supply the merchant's IP address if this data is available in the x-merchant-ip-address header, e.g., x-fapi-merchant-ip-address: 198.51.100.119; and
shall supply the customer's user agent if this data is available in the x-customer-user-agent header.
7. Request Object Endpoint
7.1 Introduction
OPs:
shall not support request_uri, OIDC Request Object by Reference;
shall only support Request Objects passed by value as in clause 6.3 of OIDC.
8. Security Considerations
The Message containment failure considerations in FAPI section 7.4 shall be followed.
8.5 TLS Considerations
The TLS considerations in FAPI section 7.1 shall be followed; and
The TLS considerations in FAPI-RW section 8.5 shall be followed.
8.6 JWS Algorithm Considerations
The JWS algorithm considerations in FAPI-RW section 8.6 shall be followed.
...
Field
NZ Banking Data Profile
Notes
aud
Required
The aud value should be or include the API Provider's Issuer Identifier URL.
iss
Required
The iss value should be the Client Id of the Third Party, unless it was signed by a different party than the Third Party.
nbf
Required
The time before which the JWT must notbe accepted for processing. The processing of the "nbf" claim requires that the current date/time MUST be after or equal to the not-before date/time listed in the nbf claim.
Expressed as an epoch i.e. number of seconds from 1970-01-01T0:0:0Z as measured in UTC. RFC7519.
exp
Required
Token expiration date/time.
Expressed as an epoch i.e. number of seconds from 1970-01-01T0:0:0Z as measured in UTC. RFC7519.
iat
Required
Token issuance date/time.
Expressed as an epoch i.e. number of seconds from 1970-01-01T0:0:0Z as measured in UTC. RFC7519.
jti
Required
The jti (JWT ID) claim provides a unique identifier for the JWT.
scope
Required
Third Parties must specify the scopes that are being requested.
The scope parameter must contain openid
The scopes must be a sub-set of the scopes that were registered during Client Registration with the API Provider.
ConsentId
Required
Third Parties must provide a ConsentId for which this authorisation is requested.
client_notification_token
Optional
Third Parties must provide this field if registered to use Ping mode.
It is a bearer token provided by the Third Party that will be used by the API Provider to authenticate the callback request to the Third Party.
login_hint_token
Optional
A token containing information identifying the Customer for whom authentication is being requested.
The particular details for the login_hint_token are documented in the NZ Banking Data API standard.
Third Parties must provide either a login_hint_token or an id_token_hint
id_token_hint
Optional
An ID Token previously issued to the Third Party by the API Provider being passed back as a hint to identify the Customer for whom authentication is being requested.
Third Parties must provide either a login_hint_token or an id_token_hint
requested_expiry
Optional
A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
The API Provider may use this value to influence the lifetime of the authentication request and is encouraged to do so where it will improve the user experience, for example by terminating the authentication when as it knows the client is no longer interested in the result.
...
The sequence diagram below highlights the OAuth 2.0 Client Credentials Grant and OIDC Hybrid flow that are used by the Payments API. Image Removed\
...
Payment Initiation with Client Credentials Grant Type and OIDC Hybrid Flows
.png?version=1&modificationDate=1573522027392&cacheVersion=1&api=v2)
\