Security

We use Liftweb, a highly secure web framework written in Scala: liftweb security

OBP has a built in OAuth 1.0a Server. We have experimental support for OpenId Connect.

TESOBE and the community provide Apache / MIT style OAuth ready client SDKs

Direct Login can be used in innovation contexts or for server side, trusted Apps.

Gateway Login can be used when an API Gateway authenticates the user and passes a trusted token to OBP API.

In production, OBP storage can be separated from the API layer using AKKA. A message queue (e.g. Kafka) typically sits between OBP and the Core Banking system: Deployment scenario, security separation

Users gain access to Accounts and Transactions through being an "owner" of one or more accounts or by having access to one or more Views. See here

Users gain access to other API Endpoints via Roles which are granted via Entitlements. See here

Consumers (Apps) are managed by a set of API calls e.g. Enable Disable Consumers

The OBP API Manager is used by bank staff to manage the API and uses OBP API calls under the hood.