Security

We use Liftweb, a highly secure web framework written in Scala: liftweb security

OBP has a built in OAuth 1.0a Server. Use of external OAuth servers should also be possible with some modifications. We have experimental support for OpenId Connect.

TESOBE and the community provide Apache / MIT style OAuth ready SDKs

Direct login can be used in innovation contexts or for server side, trusted Apps: Direct Login

In production, OBP storage can be separated from the API layer using AKKA. A message queue (e.g. Kafka) sits between OBP and the Core Banking system: Deployment scenario, security separation

Users gain access to Accounts and Transactions through being an "owner" of the account or having access to one or more Views. See here

Users gain access to other API Endpoints via Roles which are granted via Entitlements. See here

Consumers (Apps) are managed by a set of API calls e.g. [Enable Disable Consumers] https://apiexplorersandbox.openbankproject.com/?ignoredefcat=true&tags=Role#2_1_0-enableDisableConsumers

There is an API Management project which bank IT staff can use: [OBP Manager][https://github.com/OpenBankProject/API-Manager]