Skip to content

Commit 93f3c9a

Browse files
NigelSomerfieldPNZNigelSomerfieldPNZ
authored
Merge pull request #11 from PaymentsNZ/V3.0.0
V3.0.0 release
2 parents 6d55b73 + 9a3cb3b commit 93f3c9a

File tree

64 files changed

+5411
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+5411
-0
lines changed

‎dist/v3.0.0/README.md

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# V3.0.0 schemas
2+
3+
This folder contains schemas for the V3.0.0 security profile. This includes:
4+
5+
- Client authentication [schema](./client-authentication/jwt-bearer-auth-schema.json) (for use with `private_key_jwt`)
6+
- Authorization Code Flow request [schema](./authorization-code-flow/authorization-request-schema.json) for Pushed Authorization Requests with PKCE, PAR response [schema](./authorization-code-flow/PAR-response-schema.json) and JARM response [schema](./authorization-code-flow/JARM-response-schema.json)
7+
- Hybrid flow authorization request [schema](./hybrid-flow/authorization-request-schema.json)
8+
- CIBA decoupled flow relevant [schemas](./ciba-flow/README.md)
9+
- ID token [schema](./id-token/id-token-body-schema.json)
10+
- Generic JWS header [schema](./common/JOSE-header-schema.json)
11+
- Authorisation Server Metadata [schema](authorization-server-metadata/metadata-schema.json)
12+
13+
These are assistive in nature, and supplementary to the Security Profile documentation. It is highly recommended to follow that documentation first.

‎dist/v3.0.0/authorization-code-flow/JARM-response-schema.json

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"title": "Version 1 of JARM response payload",
3+
"$id": "http://apicentre.paymentsnz.co.nz/schemas/jarm-response-schema.json",
4+
"type": "object",
5+
"$schema": "http://json-schema.org/draft-07/schema#",
6+
"additionalProperties": false,
7+
"required": [
8+
"iss",
9+
"code",
10+
"aud",
11+
"exp",
12+
"state"
13+
],
14+
"properties": {
15+
"iss": {
16+
"type": "string",
17+
"format": "uri",
18+
"minLength": 1,
19+
"description": "Token issuer - e.g. https://secure.examplebank.co.nz/token",
20+
"examples": ["https://secure.examplebank.co.nz/token"]
21+
},
22+
"code": {
23+
"type": "string",
24+
"minLength": 1,
25+
"description": "Authorization Code, to be exchanged for Access Token.",
26+
"examples": ["AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4"]
27+
},
28+
"aud": {
29+
"description": "The audience for the token, must contain the Client ID of the third party. May also contain other audiences.",
30+
"oneOf": [
31+
{
32+
"type": "string",
33+
"minLength": 1,
34+
"examples": ["third_party_client_id", "sadUTdfTANIhditInecaqwEZdsUL"]
35+
},
36+
{
37+
"type": "array",
38+
"items": {
39+
"type": "string",
40+
"minLength": 1
41+
},
42+
"description": "Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value.",
43+
"examples": [
44+
"third_party_client_id",
45+
"ERVWyYqQM6AstKLmpuQdTiK8or02pe1i"
46+
]
47+
}
48+
]
49+
},
50+
"exp": {
51+
"type": "integer",
52+
"description": "Expiration time on or after which the ID Token MUST NOT be accepted for processing.",
53+
"examples": [1496397168]
54+
},
55+
"state": {
56+
"type": "string",
57+
"minLength": 1,
58+
"description": "The state value as sent by the client in the authorization request",
59+
"examples": ["sadrewvdHASDTAW"]
60+
}
61+
}
62+
}
63+

‎dist/v3.0.0/authorization-code-flow/PAR-response-schema.json

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"title": "Version 1 of PAR response payload",
3+
"$id": "http://apicentre.paymentsnz.co.nz/schemas/par-response-schema.json",
4+
"type": "object",
5+
"$schema": "http://json-schema.org/draft-07/schema#",
6+
"additionalProperties": false,
7+
"required": [
8+
"request_uri",
9+
"expires_in"
10+
],
11+
"properties": {
12+
"request_uri": {
13+
"type": "string",
14+
"format": "uri",
15+
"description": "A unique reference for the request object requiring authorization",
16+
"examples": ["urn:ietf:params:oauth:request_uri:8qi1b0XAGrV9Ypv1cMyLAS_2AIchvqXx"]
17+
},
18+
"expires_in": {
19+
"type": "integer",
20+
"description": "Expiration time on or after which the request_uri MUST NOT be accepted for processing.",
21+
"examples": [1496397168]
22+
}
23+
}
24+
}
25+

‎dist/v3.0.0/authorization-code-flow/authorization-request-schema.json

+205
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
{
2+
"definitions": {},
3+
"$schema": "http://json-schema.org/draft-07/schema#",
4+
"$id": "http://apicentre.paymentsnz.co.nz/schemas/authorization-code-request-schema.json",
5+
"type": "object",
6+
"title": "The schema for the Authorisation Request (OIDC/FAPI compliant) token",
7+
"additionalProperties": true,
8+
"required": [
9+
"aud",
10+
"iss",
11+
"response_type",
12+
"response_mode",
13+
"client_id",
14+
"redirect_uri",
15+
"scope",
16+
"state",
17+
"nonce",
18+
"claims",
19+
"exp",
20+
"nbf",
21+
"code_challenge",
22+
"code_challenge_method"
23+
],
24+
"properties": {
25+
"aud": {
26+
"title": "The audiences for the token",
27+
"description": "The value should be or include the API Provider Issuer Identifier URL",
28+
"oneOf": [
29+
{
30+
"type": "string",
31+
"examples": ["https://api.alphanbank.com"],
32+
"format": "uri"
33+
},
34+
{
35+
"type": "array",
36+
"items": {
37+
"type": "string",
38+
"pattern": "^(.+)$"
39+
},
40+
"examples": ["https://api.alphanbank.com"]
41+
}
42+
]
43+
},
44+
"iat":{
45+
"type": "integer",
46+
"description": "Time on which the Request Object was issued. May be used for determining age",
47+
"examples": [1496397168]
48+
},
49+
"exp": {
50+
"type": "integer",
51+
"description": "Expiration time on or after which the Request Object MUST NOT be accepted for processing.",
52+
"examples": [1496397168]
53+
},
54+
"nbf": {
55+
"type": "integer",
56+
"description": "Time before which the Request Object MUST NOT be accepted for processing.",
57+
"examples": [1496397168]
58+
},
59+
"iss": {
60+
"type": "string",
61+
"title": "The Issuer of the token",
62+
"description": "The value should be the client ID of the third party, unless signed by a different party",
63+
"default": "",
64+
"examples": ["s6BhdRkqt3"],
65+
"pattern": "^(.+)$"
66+
},
67+
"jti": {
68+
"type": "string",
69+
"title": "The unique identifier of the token",
70+
"description": "Used for determining token uniqueness. The value should be have sufficient entropy to make likelihood of collisions negligible.",
71+
"examples": ["d92f1393-752e-49c2-8ce3-90abc6b29655"]
72+
},
73+
"response_type": {
74+
"type": "string",
75+
"title": "The type of the response token",
76+
"default": "code",
77+
"examples": ["code"],
78+
"enum": ["code"]
79+
},
80+
"response_mode": {
81+
"type": "string",
82+
"title": "The mode used to deliver the response token",
83+
"default": "jwt",
84+
"examples": ["jwt"],
85+
"enum": ["jwt"]
86+
},
87+
"client_id": {
88+
"type": "string",
89+
"title": "The ID of the third-party client",
90+
"default": "",
91+
"examples": ["s6BhdRkqt3"],
92+
"pattern": "^(.+)$"
93+
},
94+
"redirect_uri": {
95+
"type": "string",
96+
"title": "The URI to which to redirect the customer User Agent after authorization",
97+
"default": "",
98+
"examples": ["https://api.mytpp.com/cb"],
99+
"format": "uri"
100+
},
101+
"code_challenge": {
102+
"type": "string",
103+
"title": "The PKCE code challenge value",
104+
"examples": ["roXsvRC1K-5WAYWLWsqQJpXTR8NznFgysjjqKhqhSO4"],
105+
"pattern": "^[a-zA-Z0-9\\-_]*$"
106+
},
107+
"code_challenge_method": {
108+
"type": "string",
109+
"title": "The mode used to deliver the response token",
110+
"examples": ["S256"],
111+
"default": "S256",
112+
"enum": ["S256"]
113+
},
114+
"scope": {
115+
"type": "string",
116+
"title": "The OAuth scopes requested",
117+
"description": "Must include 'openid' and any other scopes required",
118+
"default": "openid",
119+
"examples": ["openid payments"],
120+
"pattern": "^openid([ ].*)*$"
121+
},
122+
"state": {
123+
"type": "string",
124+
"title": "The third-party specific state",
125+
"description": "Opaque to API provider",
126+
"default": "",
127+
"examples": ["af0ifjsldkj"],
128+
"pattern": "^(.+)$"
129+
},
130+
"nonce": {
131+
"type": "string",
132+
"title": "Third party nonce to avoid replay",
133+
"default": "",
134+
"examples": ["n-0S6_WzA2Mj"],
135+
"pattern": "^(.+)$"
136+
},
137+
"max_age": {
138+
"type": "integer",
139+
"title": "Third-party specified maximum authentication age",
140+
"default": 0,
141+
"examples": [86400]
142+
},
143+
"display": {
144+
"type": "string",
145+
"title": "Specify how to display authentication and consent to customer",
146+
"enum": ["page", "popup", "touch", "wap"]
147+
},
148+
"prompt": {
149+
"type": "string",
150+
"title": "Specify whether the authorisation server should prompt for authentication and consent to customer",
151+
"examples": ["none", "login consent", "consent", "select_account"]
152+
},
153+
"ui_locales": {
154+
"type": "string",
155+
"title": "Specify preferred languages to display authentication and consent to customer",
156+
"examples": ["en-nz", "mi", "en-nz mi"]
157+
},
158+
"id_token_hint": {
159+
"type": "string",
160+
"description": "An ID token that was previously issued to the third party being replayed as a hint to the user identity"
161+
},
162+
"claims_locales":{
163+
"type": "string",
164+
"title": "Specify preferred languages to return claims to third party",
165+
"examples": ["en-nz", "mi", "en-nz mi"]
166+
},
167+
"claims": {
168+
"type": "object",
169+
"title": "Claims object that holds the id_token request",
170+
"additionalProperties": true,
171+
"required": ["id_token"],
172+
"properties": {
173+
"id_token": {
174+
"type": "object",
175+
"title": "The ID token request claims",
176+
"additionalProperties": true,
177+
"required": ["ConsentId"],
178+
"properties": {
179+
"ConsentId": {
180+
"type": "object",
181+
"title": "The Consent ID object",
182+
"additionalProperties": false,
183+
"required": ["value", "essential"],
184+
"properties": {
185+
"value": {
186+
"type": "string",
187+
"title": "The value of Consent ID",
188+
"default": "",
189+
"examples": ["urn-alphabank-intent-58923"],
190+
"pattern": "^(.+)$"
191+
},
192+
"essential": {
193+
"type": "boolean",
194+
"title": "Essential claim identifier",
195+
"default": false,
196+
"examples": [true]
197+
}
198+
}
199+
}
200+
}
201+
}
202+
}
203+
}
204+
}
205+
}

‎dist/v3.0.0/authorization-server-metadata/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# PNZ Authorisation Server Metadata
2+
3+
## Schema
4+
5+
The [schema](metadata-schema.json) may be used to validate authorisation server metadata. For example:
6+
7+
- `npx ajv validate -c ajv-formats -s .\metadata-schema.json -d .\example.json`
8+
9+
This validates the indicated `example.json`.

0 commit comments

Comments
 (0)