openbankingstandard / auth

Authorisation & Authentication

auth (Authorisation & Authentication)

This repository forms part of the Open Banking Standard project. Please refer to framework/README.md for further information.

Relevant sections of the OBWG Report can be found in Report.md

v0.1 Scope (proposed)

The following initial scope has been proposed but has not yet been adopted by the CTC.

• OAuth-style authentication and authorisation for permitting third-party access to payment accounts
• Support multiple permissions or levels of access that correspond to the initial scope of the Account Information API
• Limit permission duration (intended to be decided by the end user)
• Support unilateral revocation of authorisation by the end user or the account provider

---

auth's Issues

Token Binding - Binding bearer tokens to TLS sessions

There has been a lot of noise about the downsides of OAuth 2 bearer tokens - namely that they are susceptible to replay attacks and if stolen would provide an attacker to unfettered access.

Token Binding is a potential solution. [This](https://www.pingidentity.com/en/blog/2015/01/20/new_standards_emerging_for_hok_tokens.html
With) is a good overview of the issue and possible mitigations and this is a more technical overview.

The Financial API Working Group is also discussing recommending Token Binding for Write API access to bank accounts.

While token binding has many advantages:

• transparent to end-users
• re-uses existing TLS handshake
• re-uses existing Public Key Infrastructure

It is not yet available in all browsers or even all TLS libraries, e.g. OpenSSL Feature Request

This issue is for discussion of token binding and to track its implementation status.

Transcribe report recommendations

I'll take this up - just working out how to split it up.