How to use FAPI feature

​

Overview

FAPI feature is available since Authlete 2.0. If you are using Authlete 2.2+, refer to Financial-grade API (FAPI) Basics.

​

Introduction

​

FAPI Support in Authlete

• Read-only API profile (specified in Part 1)
• Read-and-write API profile (specified in Part 2)

1. Static Mode: All incoming requests are evaluated for compliance with the configured FAPI level. While strict, this mode may not be suitable in environments where the authorization server needs to support multiple clients with varying conformance levels.
2. Dynamic (Runtime) Mode: FAPI conformance checks are applied dynamically based on the OAuth scope provided in each request. This mode is more flexible and allows the authorization server to serve clients with different compliance requirements.

1. Extract the scopes included in the request or associated with the request.
2. Check the attributes of each scope (see Appendix 1) and apply the following logic:

​

Service configurations

1. Log in to the Management Console.
2. Click Create New Service.
3. On the Service Setup screen:
   • Enter a Service Name and Description.
   • Select FAPI in FAPI Service Profile.

​

Configurations for read-only API profile

​

Configurations for read-and-write API profile

​

Client configurations

​

Configurations for read-only API profile

​

Configurations for read-and-write API profile

​

Request

​

Authorization request

​

Authorization request for read-only API profile

#
# An example request from a public client.
#
# Note:
#   * scope: 'account' scope has a "read-only" attribute.
#   * state: Optional but recommended (OAuth 2.0).
#   * nonce: Required if the 'response_type' request parameter contains
#      'id_token' (OpenID Connect).
#
GET /api/authorization?

response_type=code+id_token&
client_id=285946231596&
redirect_uri=https://my-client.com/callback&
scope=openid+accounts&
code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&
code_challenge_method=S256&
state=mystate&
nonce=mynonce

​

Authorization request for read-and-write API profile

{
  "id_token": {
    "acr": {
      "essential": true,
      "values": ["urn:mace:incommon:iap:silver"]
    }
  }
}

#
# An example request from a confidential client.
#
# Note:
#   * scope: 'account' scope has a "read-and-write" attribute.
#   * state: Optional but recommended (OAuth 2.0).
#   * nonce: Required if the 'response_type' request parameter contains
#      'id_token' (OpenID Connect).
#
GET /api/authorization?

response_type=code+id_token&
client_id=291985138172&
scope=openid+payments&
redirect_uri=https://my-client.com/callback&
state=mystate&
nonce=mynonce&
claims={"id_token":{"acr":{"essential":true,"values":["urn:mace:incommon:iap:silver"]}}}&
request=eyJh...[省略]...nPQ

​

Token request

​

Token request for read-only API profile

#
# An example request from a public client.
#
POST /api/token

client_id=285946231596&
grant_type=authorization_code&
code=_vaXlQ_ItUX4hiWzXgOT-Jp9-oVPKGQ6Q6QZu_P2GXw&
redirect_uri=https://my-client.com/callback&
code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

​

Token request for read-and-write API profile

#
# An example request from a confidential client.
#
# Note:
#   * The client uses PRIVATE_KEY_JWT as its client authentication method.
#   * The client needs to present a client certificate to the token endpoint,
#      as 'TLS Client Certificate Bound Access Tokens' is enabled for the client.
#
POST /api/token

client_id=291985138172&
grant_type=authorization_code&
code=YG-gD9v-vmnuKaHkRHcvWq1UxlxT_9vgj28ffxIAX40&
redirect_uri=https://my-client.com/callback&
client_assertion=eyJh...[omitted]...OWg&
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer

​

Appendix

​

1. Scope attributes

​

2. JARM

​

3. Requirements for key size

Financial Services – Financial API - Part 1, 5.2.2. Authorization Server The authorization server,
  …
  5. shall require a key of size 2048 bits or larger if RSA
    algorithms are used for the client authentication;
  6. shall require a key of size 160 bits or larger if elliptic
    curve algorithms are used for the client authentication;

​

4. Requirements for request objects

Financial Services – Financial API - Part 2, 5.2.2. Authorization Server The authorization server,
  …
  1. shall require the request or request_uri parameter to be passed as a JWS signed JWT as in clause 6 of [OIDC];
  …
  10. shall require that all parameters are present inside the signed request object passed in the request or request_uri parameter;
  …
  13. shall require the request object to contain an exp claim;
  …
  15. shall require the aud claim in the request object to be, or to be an array containing, the OP’s Issuer Identifier URL;

Financial Services – Financial API - Part 2, 8.6 JWS algorithm considerations Both clients and authorization servers:
    1. shall use PS256 or ES256 algorithms;
    2. should not use algorithms that use RSASSA-PKCS1-v1_5 (e.g. RS256);
    3. shall not use none;

• Must be signed with the algorithm specified as ‘Request Object Signature Algorithm’.
• Must include all the request parameters.
• Must include the ‘exp’ claim
• Must include the ‘aud’ claim and the value must be the value of ‘Token Issuer Identifier’.

{
  "response_type": "code id_token",
  "exp": 1554973000,
  "aud": "https://my-authz-server.com/",
  "client_id": "291985138172",
  "scope": "openid payments",
  "redirect_uri": "https://my-client.com/callback",
  "state": "mystate",
  "nonce": "mynonce",
  "claims": {
    "id_token": {
      "acr": {
        "values": ["urn:mace:incommon:iap:silver"],
        "essential": true
      }
    }
  }
}