Pushpalanka's Blog

Following are the slides I used in a webinar by WSO2 to look at the IAM and overall security aspects of a fully PSD2 Complaint Solution. While it lists down the basic requirements to be PSD2 complaint, it also explains the requirements that are not visible out in the surface, but very valuable in building a comprehensive and robust solution that will have a long term vision while being PSD2 complaint as per the urgent need. Building a Fool Proof Security Strategy for PSD2 Compliance from WSO2 Inc. The webinar recording is available at  https://wso2.com/library/webinars/2017/11/building-a-fool-proof-security-strategy-for-psd2-compliance/  

Abbreviations Used with PSD2 Payment Services Directive 2 -   PSD2   Regulatory Technical Standard   ( RTS )   - A recommendation requested by PSD2 as a technical guideline to be compliant with PSD2  Strong Customer Authentication -   SCA   Payment Service User -   PSU   Account Servicing Payment Service Provider ( ASPSP ) - the existing banks Payment Initiation Service Provider ( PISP ) - a third party entity or a bank itself that can initiate the payment process  Account Information Service Provider ( AISP ) - a third party or a bank itself which can retrieve PSU's account information may be to show an aggregate view of all accounts.  Payment Service Providers issuing card- based payment instruments ( PSP ) - payment service providers that existed in pre PSD2 era who are doing payments through card networks like VISA or Mastercard. Sometime this is also used to refer all PSPs including PISP and AISP. Common and Secure...

This presentation discusses on PSD2 standards in detail with the PISP and AISP flows, the technologies involved around the standard and finally how it can be adopted for Sri Lankan financial market.

Following webinar recording I did being at WSO2 discusses in detail on the security implications of PSD2, the available technical standards around the recommendations and what WSO2 products are in-line to cater for those.  Source :  http://wso2.com/library/webinars/2017/04/frictionless-adoption-of-payment-services-directive-with-wso2/ The detailed article can be found at :  http://wso2.com/library/articles/2017/05/frictionless-adoption-of-the-security-recommendations-for-the-payment-services-directive-2-psd2-with-wso2/

European Union has enforced Payment Service Directive version 2 (PSD2) for the Payment Service Providers to adapt by the year 2018. Following slide-deck discusses the PSD2 background  PSD2 effects on the business domain  Security implications of the directive  What technologies, standards are available to meet the requirements  How WSO2 products can support to adapt PSD2 Frictionless Adaption of PSD2 with WSO2 from Pushpalanka Jayawardhana The whole webinar based on the slides is can be found at [1]. [1] - http://wso2.com/library/webinars/2017/04/frictionless-adoption-of-payment-services-directive-with-wso2/  

Identity mediation for enterprise identity bus from Pushpalanka Jayawardhana

As identified and predicted by several prominent analyst firms(Forrester, Gartner) , acquiring and merging has been the frequent mechanism for enterprises to expand in the recent past and the years to come. With this expansion there is a rising need for enterprises to handle the enterprise across identity and access management procedures in a secured way that is fast enough to have the competitive advantage of the merged or acquired assets. With different enterprises having variety of standards and protocols in use for identity and access management, catering for this requirement is absolutely challenging given the time factor. A similar situation has been addressed by Enterprise Service Bus(ESB) concept few years back, when the requirements raised to mediate between different transport protocols and data formats when communication is required between disparate enterprise systems that are legacy and modern. We are trying to apply the same concepts around ESB in the arena of identit...

WSO2Con ASIA 2016: Enterprise Security Uncovered from WSO2 Inc.

With this post I am to share the steps of a popular solution using WSO2 Identity Server and WSO2 API Manager. Following diagram will give an initial insight on this solution. Overview 1.  Webapp that requires single sign on(SSO) facility with some other applications.                  - To achieve this we are using WSO2 Identity Server(IS) as the Identity Provider(IDP).  2.  Webapp needs to consume some APIs secured with OAuth tokens.                  - To expose the APIs secured with OAuth tokens we are using WSO2 API Manager(AM) here.                 - Since we already have the SAML Response received at SSO step, SAML2 Bearer grant type is ideal to use at this scenario to request an OAuth token to access the required APIs.                 - Allowing AM to properly issue an OAuth...

This is the 3rd post I am writing to explain the use of extension points in WSO2 Identity Server. WSO2 Identity Server has so many such extension points which are easily configurable and arm the server with lot of flexibility. With this, we can support so many domain specific requirements with minimum efforts. Firstly I have shared the usage and steps of writing a custom user store manager .  Secondly a custom claim handler which is also related with SAML SSO Response.  Now this third post deals with writing a custom SAML SSO Assertion signer. What we can customize? Credentials used to sign the SAML Assertion (The private key) Signing Algorithm This sample can be extended to customize how we sign the SAML Response and validate the signature as well. How? We have to write a class extending  The class 'org.wso2.carbon.identity.sso.saml.builders.signature.DefaultSSOSigner' or Implementing, The interface 'org.wso2.carbon.identity...

Overview The latest release of WSO2 Identity Server (version 5.0.0), is armed with an "application authentication framework" which provides lot of flexibility in authenticating users from various service providers who are using heterogeneous protocols. It has several extension points, which can be used to cater several customized requirements commonly found in enterprise systems. With this post, I am going to share the details on making use of one such extension point. Functionality to be Extended When SAML Single Sign On is used in enterprise systems it is through the SAML Response that the relying party get to know whether the user is authenticated or not. At this point relying party is not aware of other attributes of the authenticated user which it may need for business and authorization purposes. To provide these attribute details for the relying party, SAML specification has allowed to send attributes as well in the SAML Response. WSO2 Identity Server supports...

The first Webinar conducting experience for me happened on July 02nd 2014, with opportunity given  by WSO2 Lanka (pvt) Ltd, where I am currently employed. As always that was a great opportunity given by the company to me. The Webinar was done to highlight the capabilities introduced with WSO2 IS 5.0.0, the First Enterprise Identity Bus, which is 100% free and open source. This Webinar, in detail discuss and demonstrate the power and value it adds when these capabilities of federation are leveraged in combination with WSO2 API Manager.  Following are the slides used at the Webinar.  The session went under following outline and you can watch the full recording of the session at WSO2 library, ' Leveraging federation capabilities of Identity Server for API gateway '. Configuring WSO2 Identity Server as the OAuth2 key manager of the API Manager Identity federation capability of Identity Server 5.0 How to connect existing IAM solution with API Manag...

Digital signing is a widely used mechanism to make digital contents authentic. By producing a digital signature for some content, we can let another party capable of validating that content. It can provide a guarantee that, is not altered after we signed it, with this validation. With this sample I am to share how to generate the a signature for SOAP envelope. But of course this is valid for any other content signing as well. Here, I will sign The SOAP envelope itself An attachment  Place the signature inside SOAP header  With the placement of signature inside the SOAP header which is also signed by the signature, this becomes a demonstration of enveloped signature. I am using Apache Santuario library for signing. Following is the code segment I used. I have shared the complete sample here to to be downloaded . public static void main(String unused[]) throws Exception {         String keystoreType = "JKS";         Stri...

In this post I am to share my experience and understandings using WSO2 API Manager(API-M) for a very common and useful scenario in the industry.  In brief following is the flow. An API is exposed for app developers to be used under the control of API Manager (which adds access control for the API). Then app developers make their apps consuming those APIs. After development and testing is completed they make it available for end users at App store. The end users can then get registered in the store and use the apps with own credentials. The app will provide the desired services calling the APIs it has subscribed to. The above scenario is well demonstrated in WSO2 API-M with the pizza shack example explained in the documentation at [1]. For clarity I will be including the steps in brief. For detailed steps we can refer documentation at [1].  API Developer Role We deploy the back-end services related to 'pizza ordering' in WSO2-Application server ...