Overview
As per Brasil Open Finance/Banking/Insurance specifications, Data Recipients must register with Data Transmitter according to the OAuth 2.0 Dynamic Client Registration protocol. The Cloudentity platform is part of Data Holder ecosystem facilitating all the security profile requirements, including all the OAuth capabilities to handle the dynamic client registration of Data Recipient entities. Once registered, Data Recipients can utilize the registered client information to mint CDR-compliant tokens from the Cloudentity authorization platform to retrieve consumer data from the Data Holder in a secure manner.
Register Data Recipient with Brasil Directory
Open Banking Brasil Directory (Brasil ICP or the Directory of Participants) issues software statements to accredited TPP/Data reciever organizations. DCR requests against the data provider must contain a software statement which has been issued by the Open Banking Brasil Directory. This means that the API caller must obtain a software statement in advance before making a DCR request.
Cloudentity implementation validates the software statement included in a DCR request. The most important part of the validation is to confirm that the software statement has been signed by the Open Banking Brasil Directory.
A Software Statement Assertion(SSA) issued by the Directory is a digitally signed JSON Web Token (JWT) created in accordance with a JWT that asserts metadata values about the client software.
A sample SSA (decoded view) issued by the by the Open Finance Brasil directory of participants looks like the following:
The Open Finance Brasil directory of participants has chosen to use PS256 as the signing algorithm, conforming to FAPI-RW Section 8.6 for signing the Software Statement Assertion (SSA). Cloudentity verifies the signature of this PS256 signed Software Statement Assertion(SSA) presented in DCR request body.
DCR configuration in Cloudentity
DCR is enabled by default in Cloudentity when the Open Finance Brasil compliant workspace is created.
-
In the workspace, go to OAuth » Authorization Server » Client Registration from the sidebar.
-
In the DCR tab, you can see Enable dynamic client registration enabled.
-
In the DCR tab, you can see Protected by software statement enabled as well.
Register TPP with Data Provider
To register with a Data Provider, TPP sends an HTTP POST request to the Data provider registration endpoint. Cloudentity platform provides the DCR endpoint. As per the DCR API specification the registration request must be passed as body param in the request.
Manage registered TPP
As the Infosec provider component of a Data Holder, the Cloudentity platform exposes all the Data Recipient Client Registration Management endpoints as defined in the APIs.
OIDC configuration endpoints can be located easily within the Cloudentity administrative portal.
Within the OIDC Discovery configuration endpoint, DCR endpoint location is specified
under registration_endpoint key
"registration_endpoint": "https://authorization.cloudentity.com:8443/default/openbanking_brasil/oauth2/register"
Cloudentity provides all the DR compliant DCR APIs as in the specification for TPP dynamic client registration within the Data Provider ecosystem.