Posts

Showing posts from August, 2017

OPA for HTTP Authorization

Open Policy Agent[1] is a promising, light weight and very generic policy engine to govern authorization is any type of domain. I found this comparion[2] very attractive in evaluating OPA for a project I am currently working on, where they demonstrate how OPA can cater same functionality defined in RBAC, RBAC with Seperation of Duty, ABAC and XACML.  
Here are the steps to a brief demonstration of OPA used for HTTP API authorization based on the sample [3], taking it another level up.
Running OPA Server First we need to download OPA from [4], based on the operating system we are running on.  For linux, curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v0.10.3/opa_linux_amd64 Make it executable, chmod 755 ./opa Once done, we can start OPA policy engine as a server.
./opa run --server Define Data and Rules Next we need to load data and authorization rules to the server, so it can make decisions. OPA defines these in files in the format of .rego. Below is a sample …

Regulatory Technical Standard (RTS) for PSD2 SCA in Plain Text

Image
Abbreviations Used with PSD2Payment Services Directive 2 -PSD2Regulatory Technical Standard(RTS)- A recommendation requested by PSD2 as a technical guideline to be compliant with PSD2 Strong Customer Authentication -SCAPayment Service User -PSUAccount Servicing Payment Service Provider (ASPSP) - the existing banksPayment Initiation Service Provider (PISP) - a third party entity or a bank itself that can initiate the payment process Account Information Service Provider (AISP) - a third party or a bank itself which can retrieve PSU's account information may be to show an aggregate view of all accounts. Payment Service Providers issuing card- based payment instruments (PSP) - payment service providers that existed in pre PSD2 era who are doing payments through card networks like VISA or Mastercard. Sometime this is also used to refer all PSPs including PISP and AISP.Common and Secure Communication (CSC) Third Party Payment Service Providers (TPP)Access to accounts - XS2A When addres…

The Role of IAM in Open Banking

This presentation discusses on PSD2 standards in detail with the PISP and AISP flows, the technologies involved around the standard and finally how it can be adopted for Sri Lankan financial market.