Security

We use Liftweb, a highly secure web framework written in Scala: liftweb security

OBP has a built in OAuth 1.0a Server. We have experimental support for OpenId Connect.

TESOBE and the community provide Apache / MIT style OAuth ready client SDKs

Direct login can be used in innovation contexts or for server side, trusted Apps.

In production, OBP storage can be separated from the API layer using AKKA. A message queue (e.g. Kafka) typically sits between OBP and the Core Banking system: Deployment scenario, security separation

Users gain access to Accounts and Transactions through being an "owner" of one or more accounts or by having access to one or more Views. See here

Users gain access to other API Endpoints via Roles which are granted via Entitlements. See here

Consumers (Apps) are managed by a set of API calls e.g. Enable Disable Consumers

The OBP API Manager project is used by bank staff to manage the API and uses OBP API calls under the hood.