Skip to content

docs: document the props added in #2881, #2882 and #2883 #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hongwei1 merged 1 commit into from
Aug 14, 2026
Merged

docs: document the props added in #2881, #2882 and #2883 #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions obp-api/src/main/resources/props/sample.props.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,14 @@ jwt.use.ssl=false
## Unit is a second
# obp_expired_consents_interval_in_seconds =

## Expire UK Open Banking consents with status "Authorised"
## Unlike the three keys above this one HAS a default (601 seconds, a prime near 10 minutes, so the
## sweep does not settle into step with other periodic schedulers). Set it to 0 to stop the task.
## Turning it off does not grant access to an expired consent: checkUKConsent rejects one reactively
## on every request whatever this task's timing. The sweep only keeps the stored status accurate for
## GET and dashboard purposes.
# uk_open_banking_expired_consents_interval_in_seconds = 601


## Enable writing API metrics (which APIs are called) to RDBMS
## Default lives in code.metrics.MetricsProps (WriteMetricsDefault)
Expand Down Expand Up @@ -1197,6 +1205,13 @@ featured_apis=elasticSearchWarehouseV300
#rabbitmq.adapter.enabled=false


# -- Open Corridor ----------------------------------------------
# The platform is modelled AS a bank, and this is its BANK_ID -- the creditor side of the platform
# fee settlement instructions raised by the fee-accrual endpoints. There is no usable default: with
# this unset, sweeping accrued fees fails with OBP-10035 rather than paying an unintended bank.
# Only relevant on an instance that has Open Corridor turned on and settles platform fees.
# open_corridor.platform_bank_id=


# -- Scopes -----------------------------------------------------
# Scopes can be used to limit the APIs a Consumer can call.
Expand Down
74 changes: 74 additions & 0 deletions release_notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,80 @@
### Most recent changes at top of file
```
Date Commit Action
13/08/2026 298e1af87 Added props open_corridor.platform_bank_id.
The platform fee accrual endpoints settle to the platform, which is
modelled as a bank; this names its BANK_ID. There is no usable default,
so sweeping accrued platform fees fails with OBP-10035 until it is set
rather than paying an unintended bank. Only relevant on an instance that
has Open Corridor turned on and settles platform fees; instances that do
not need no action.

13/08/2026 7bfefcb9f BEHAVIOUR CHANGE: a consent is now resolved against the Consumer that
lodged it, which makes sca_front_end_consumer_ids REQUIRED for anyone
running Redirect SCA or their own approval screen.
Berlin Group scopes a dynamically created resource to "the same TPP"
that created it (Implementation Guidelines 4.11) and UK scopes GET and
DELETE of an account-access-consent to one "that they have created".
Previously a PSU match ended the enquiry before the Consumer was ever
compared, so a second TPP holding a session for the same PSU could read
and revoke a consent the first TPP had lodged. That short circuit is
gone.

Who is affected: any instance whose Strong Customer Authentication
screen is served by a different Consumer than the TPP that lodges the
consent — which is every Berlin Group Redirect deployment, because under
Redirect the PSU authenticates at the ASPSP and the authorisation calls
therefore arrive from the ASPSP's own front end. Nothing in the request
distinguishes that front end from a second TPP holding a PSU session, so
the ASPSP has to declare it.

Symptom if you do not:
POST /berlin-group/v1.3/consents/{consentId}/authorisations returns
403 OBP-35015 (ConsentDoesNotMatchConsumer). SCA cannot start and the
consent stays at "received". The UK approval screen's read of an
unclaimed consent is governed by the same declaration.

Action: set sca_front_end_consumer_ids to the consumer_id (not the
consumer key) of whatever serves the approval screen — the OBP Portal in
a stock deployment, found with
select consumerid, name, redirecturl from consumer
where redirecturl like '%<sca-frontend-host>%';
Comma separate several. The older
berlin_group_sca_front_end_consumer_ids is still read, so an instance
already configured for Berlin Group Redirect SCA needs no edit. Empty
stays the default, and empty keeps the lodging-TPP rule applying to
every caller.

Note APIUtil.scaFrontEndConsumerIds is a val read at class
initialisation and props are packaged inside obp-api.jar, so the change
needs a rebuild before restarting — a plain restart keeps the old value.

Also added props consent_allow_legacy_unrecorded_tpp (default false).
A consent recording no lodging Consumer now matches no caller and is
refused; rows like that predate the Consumer being recorded at all.
Turning this on restores the old behaviour for them, and the old
behaviour is that ANY authenticated caller can read and revoke them,
which is why it warns on every use. It is a migration window, not a
setting: re-lodge the affected consents and turn it back off.

12/08/2026 5f1f90694 Added props uk_open_banking_expired_consents_interval_in_seconds
(default 601) and system_views.reconcile_permissions_at_boot.
The consent expiry sweep is the UK counterpart of the existing
berlin_group_ and obp_ keys, but unlike those it runs by default; set it
to 0 to stop it. Turning it off does not grant access to an expired
consent — checkUKConsent rejects one reactively on every request — the
sweep only keeps the stored status accurate for GET and dashboard
purposes.

system_views.reconcile_permissions_at_boot defaults to TRUE, and that
default rewrites data: at every boot the UK Open Banking and Berlin
Group system views are reconciled to the permission set this build
defines. It is deliberate — a permission set the code tightened has to
reach the installations that have the problem, not only fresh ones — but
an operator who has hand-tuned those rows will see the edits overwritten
and should set it to false, which logs a warning and falls back to
create-if-absent.

28/07/2026 bc2b2aeb3 BEHAVIOUR CHANGE: UK Open Banking PSD2 gate now reads the mTLS
transport certificate (PSD2-CERT), not TPP-Signature-Certificate.
When requirePsd2Certificates=ONLINE, the certificate identifying the
Expand Down
Loading