Security

We use Liftweb, a highly secure web framework written in Scala: liftweb security

OBP has a built in OAuth 1.0a Server. We have experimental support for OpenId Connect.

TESOBE and the community provide Apache / MIT style OAuth ready client SDKs

Direct login can be used in innovation contexts or for server side, trusted Apps: Direct Login

In production, OBP storage can be separated from the API layer using AKKA. A message queue (e.g. Kafka) typically sits between OBP and the Core Banking system: Deployment scenario, security separation

Users gain access to Accounts and Transactions through being an "owner" of one or more accounts or by having access to one or more Views. See here

Users gain access to other API Endpoints via Roles which are granted via Entitlements. See here

Consumers (Apps) are managed by a set of API calls e.g. Enable Disable Consumers

There is an API Management project which bank IT staff can use: [OBP Manager][https://github.com/OpenBankProject/API-Manager]