From 13a06517a41067e6c1a0de3b4c4a37105c31fcd3 Mon Sep 17 00:00:00 2001 From: Hongwei Date: Fri, 14 Aug 2026 12:35:48 +0200 Subject: [PATCH] docs: document the props added in #2881, #2882 and #2883 Every props key those PRs introduced was reachable only by reading the source. Two gaps, and the second is the one that bites. sample.props.template was missing two keys: uk_open_banking_expired_consents_interval_in_seconds (#2881), which unlike its berlin_group_ and obp_ counterparts has a default and runs unless set to 0; and open_corridor.platform_bank_id (#2883), which has no usable default. release_notes.md had no entry for any of this line of work, including a behaviour change operators cannot discover from the symptom. #2882 made a consent resolve against the Consumer that lodged it; previously a PSU match ended the enquiry before the Consumer was compared, so a second TPP holding a session for the same PSU could read and revoke a consent the first TPP had lodged. Removing that short circuit makes sca_front_end_consumer_ids required for every Berlin Group Redirect deployment, because under Redirect the PSU authenticates at the ASPSP and the authorisation calls arrive from the ASPSP's own front end rather than the lodging TPP. An instance that has not declared its front end now gets 403 OBP-35015 on POST /berlin-group/v1.3/consents/{consentId}/authorisations, with nothing in the response pointing at configuration. Confirmed against a local stack. The entry also records that the props is read into a val at class initialisation and packaged inside obp-api.jar, so the change needs a rebuild rather than a restart, and that system_views.reconcile_permissions_at_boot defaults to true and therefore rewrites hand-tuned system view permissions at every boot. Scoped to the keys these PRs introduced. The other Open Corridor keys (open_corridor_enabled, .outbox_relay_interval, .publish_response_timeout, .settlement_system) are undocumented too but arrived before #2883, so they are left for a separate change. Documentation only -- no source or test changes. --- .../resources/props/sample.props.template | 15 ++++ release_notes.md | 74 +++++++++++++++++++ 2 files changed, 89 insertions(+) diff --git a/obp-api/src/main/resources/props/sample.props.template b/obp-api/src/main/resources/props/sample.props.template index 71aeb66167..63d25b0fd7 100644 --- a/obp-api/src/main/resources/props/sample.props.template +++ b/obp-api/src/main/resources/props/sample.props.template @@ -240,6 +240,14 @@ jwt.use.ssl=false ## Unit is a second # obp_expired_consents_interval_in_seconds = +## Expire UK Open Banking consents with status "Authorised" +## Unlike the three keys above this one HAS a default (601 seconds, a prime near 10 minutes, so the +## sweep does not settle into step with other periodic schedulers). Set it to 0 to stop the task. +## Turning it off does not grant access to an expired consent: checkUKConsent rejects one reactively +## on every request whatever this task's timing. The sweep only keeps the stored status accurate for +## GET and dashboard purposes. +# uk_open_banking_expired_consents_interval_in_seconds = 601 + ## Enable writing API metrics (which APIs are called) to RDBMS ## Default lives in code.metrics.MetricsProps (WriteMetricsDefault) @@ -1197,6 +1205,13 @@ featured_apis=elasticSearchWarehouseV300 #rabbitmq.adapter.enabled=false +# -- Open Corridor ---------------------------------------------- +# The platform is modelled AS a bank, and this is its BANK_ID -- the creditor side of the platform +# fee settlement instructions raised by the fee-accrual endpoints. There is no usable default: with +# this unset, sweeping accrued fees fails with OBP-10035 rather than paying an unintended bank. +# Only relevant on an instance that has Open Corridor turned on and settles platform fees. +# open_corridor.platform_bank_id= + # -- Scopes ----------------------------------------------------- # Scopes can be used to limit the APIs a Consumer can call. diff --git a/release_notes.md b/release_notes.md index 3005375582..ee7863b57f 100644 --- a/release_notes.md +++ b/release_notes.md @@ -3,6 +3,80 @@ ### Most recent changes at top of file ``` Date Commit Action +13/08/2026 298e1af87 Added props open_corridor.platform_bank_id. + The platform fee accrual endpoints settle to the platform, which is + modelled as a bank; this names its BANK_ID. There is no usable default, + so sweeping accrued platform fees fails with OBP-10035 until it is set + rather than paying an unintended bank. Only relevant on an instance that + has Open Corridor turned on and settles platform fees; instances that do + not need no action. + +13/08/2026 7bfefcb9f BEHAVIOUR CHANGE: a consent is now resolved against the Consumer that + lodged it, which makes sca_front_end_consumer_ids REQUIRED for anyone + running Redirect SCA or their own approval screen. + Berlin Group scopes a dynamically created resource to "the same TPP" + that created it (Implementation Guidelines 4.11) and UK scopes GET and + DELETE of an account-access-consent to one "that they have created". + Previously a PSU match ended the enquiry before the Consumer was ever + compared, so a second TPP holding a session for the same PSU could read + and revoke a consent the first TPP had lodged. That short circuit is + gone. + + Who is affected: any instance whose Strong Customer Authentication + screen is served by a different Consumer than the TPP that lodges the + consent — which is every Berlin Group Redirect deployment, because under + Redirect the PSU authenticates at the ASPSP and the authorisation calls + therefore arrive from the ASPSP's own front end. Nothing in the request + distinguishes that front end from a second TPP holding a PSU session, so + the ASPSP has to declare it. + + Symptom if you do not: + POST /berlin-group/v1.3/consents/{consentId}/authorisations returns + 403 OBP-35015 (ConsentDoesNotMatchConsumer). SCA cannot start and the + consent stays at "received". The UK approval screen's read of an + unclaimed consent is governed by the same declaration. + + Action: set sca_front_end_consumer_ids to the consumer_id (not the + consumer key) of whatever serves the approval screen — the OBP Portal in + a stock deployment, found with + select consumerid, name, redirecturl from consumer + where redirecturl like '%%'; + Comma separate several. The older + berlin_group_sca_front_end_consumer_ids is still read, so an instance + already configured for Berlin Group Redirect SCA needs no edit. Empty + stays the default, and empty keeps the lodging-TPP rule applying to + every caller. + + Note APIUtil.scaFrontEndConsumerIds is a val read at class + initialisation and props are packaged inside obp-api.jar, so the change + needs a rebuild before restarting — a plain restart keeps the old value. + + Also added props consent_allow_legacy_unrecorded_tpp (default false). + A consent recording no lodging Consumer now matches no caller and is + refused; rows like that predate the Consumer being recorded at all. + Turning this on restores the old behaviour for them, and the old + behaviour is that ANY authenticated caller can read and revoke them, + which is why it warns on every use. It is a migration window, not a + setting: re-lodge the affected consents and turn it back off. + +12/08/2026 5f1f90694 Added props uk_open_banking_expired_consents_interval_in_seconds + (default 601) and system_views.reconcile_permissions_at_boot. + The consent expiry sweep is the UK counterpart of the existing + berlin_group_ and obp_ keys, but unlike those it runs by default; set it + to 0 to stop it. Turning it off does not grant access to an expired + consent — checkUKConsent rejects one reactively on every request — the + sweep only keeps the stored status accurate for GET and dashboard + purposes. + + system_views.reconcile_permissions_at_boot defaults to TRUE, and that + default rewrites data: at every boot the UK Open Banking and Berlin + Group system views are reconciled to the permission set this build + defines. It is deliberate — a permission set the code tightened has to + reach the installations that have the problem, not only fresh ones — but + an operator who has hand-tuned those rows will see the edits overwritten + and should set it to false, which logs a warning and falls back to + create-if-absent. + 28/07/2026 bc2b2aeb3 BEHAVIOUR CHANGE: UK Open Banking PSD2 gate now reads the mTLS transport certificate (PSD2-CERT), not TPP-Signature-Certificate. When requirePsd2Certificates=ONLINE, the certificate identifying the