How Can I Sign New York Banking Form

How can i industry sign banking new york form computer

we're good in this tutorial in this chapter we're going to talk about the security flow around the account and transaction advice the idea really is to focus on the security features at around the api's and we're going to use the transactions app unite to show you how it's done so first let's introduce the actors so we go to Alice and which is called the PS you will own the data as Italy you go to bank one we're going to use full of bounty later on which open which as the data are stored in the database now regarded developer which probably you and that wants to consume Alice data that are all stood in the bank so let's see how those three people can agree to share the data in the sacred manner you it's a six steps process really the first one is between the developer analyst you're going to make sure that it is understand that you want to access our data and what can a data you want to access transaction balance etc so next one is between the bank and the developer what you want to do is prepare and the consent and say to the part that you're going to access on what kind of thing you want to access the third one is when everything is ready the developer is going to redirect Alice to the bank with certain context under Bank will be able to authenticate Alice ensure the consent I'm making sure that Alice understand that what kind of information she's sharing and making sure that at step one the tbp shows some information they wanted to access and as indeed the information that she sees on step three once Alice has consented and everything is good the park is going to issue a token and redirect that token back to the TPP so at this point because he goes to Alice and you want to make sure just to deliver get it they see step called token exchange which basically make sure that only the TPP can get to real key right so the token is public but only the TPP with his credential and I can actually convert it to an access token to are--oh key that's what this step is about one the TPP I got the key I can just use that key to access the data I'm called the bank API using that key once you got the dollar one you do what you want to do right under certain the last step really is about presenting the service using such data you may not have an present those data to Alice you know you make done some analysis some security risk or whatever so let's see more in details all this six step we will concentrate mainly from the constant preparation really because lots of men challenging path the directors right so step one is you're going to authenticate Alice and present a constant page and as you can see you just make sure that at least understand what she's doing and what can information you want so here we want the icon details so balance our transactions you as a concert preparation is only between the developer the bank and basically you want to prepare the concern by sending what kind of information you're going to ask access so here you send that you want access the account balance and the transactions and you send that in a sacred manner to through TLS but we'd also mi TLS so you basically authenticate yourself at the same time so the bone can verify who you are which it scared you on buying this consent to you the developer so once you've done that then the bank saver in the database and return you a constant ID which is a reference to that consent and when Alice is going to see the bank she's going to need a context about what she's doing there and this is this consent ID that you're going to use for that so for that you generate what we call a request parameter a request parameter it's a message side and inside the message signed by you you're going to put the concert ID and you're going to invite it that into the request that a.m. is going to go to the bank so you basically you do a redirection to Alice to the bank with this request parameter technically is a parameter right so you just put it in the get parameter and so when Alice actually go to this page the bank the bank is able to retrieve the constant ID which is the main information so this is what is happening that's the six right alice is authenticating bunkies loading the concern from the database we had a concern tidy that you said a new quest parameter and the bunk is able to show that right you want to access that undetermined so balanced on a transaction which although Alice to confirm that is indeed what she agreed step one with typically when she approved the request the bank is going to use the same method it's going to redirect Alice so the developer Sue's a callback that you registered at the dynamic registration so what so TPP is going to receive he's an ID token which is signed by the bank and contained a code ashram stay - plus a code which is kind of the token we were talking about earlier under state which allows you to retrieve the contacts from the initial requests because it's kind of state and synchronous right you lose the TPP to actually load the contacts that was initially he triggering the flow so why an ID token or all of that is because the ID token is sign right so as a solo the TPP to verify that the code Arshad is signed by the bank is equal to the code so it's kind of a security step here really I'm but the essential information is to get the code right once you get the code anyone can get the code in a wire right but the important bit is that you are the only one to be able to exchange it to an access token and because the reason for that is because you're doing that through MIT LS as you can see that you're putting your credential which is your transport certificate and only you can actually do that because you're the only owner of the private key so that always about to be sure that the access token is only given to you even if Alice has so the code somehow you know screws or a direction she's not able to do anything with it only you got the key I know that you get the key is a bit really is you only need to do risco using that key as a bearer token and you get the data from Alice the bank is able to assess is talking to do all the verification that they need reading the concert ID making sure it's been approved and written exactly the data for what ice has been sharing the consent for once you get a data where you do whatever you like really um you know example which is to eat internal during like an aggregator you can really do what any innovative ideas which may not do it as a rendering to Alice let's see how it works is for shop my bank and we directly go to the concern preparation because tape one is about Alice and developer now to the concern that's really up to you how you want to do that so what you need to do at this step is to create an access consent and as you can see in the middle there is this kind of fingerprint doesn't mean that you need to be authenticated to be able to do that and the way standing up and banking is using the client credential flow so you basically get an access token and this access token is what you need to use to actually create a consent so let's do that so as you can see that when you go to access preparation postman your three requests the first one is a client assertion which is a stroke that is used to actually get the access token this is a way we choose to authenticate it there is three different ways and the client assertion is one of them so it's a job that you have to design and if you choose the conversion correctly then it can be used as a notification with it so you go to the access token in front of am using the client credential flow which is basically sending those three parameters and that give you a key this key is very limited it can only allows you to create and read consent and we're going to throw that in post memory just to make it easier to use so now you can actually create a consent so you put the access token in the header right so we're making sure that only user can create a consent and is binding to use developer to TPP right that's important you said basically what kind of permission you want that's what Alice agreed so we get everything in the example and as a response the bank's agree there's no problem it's returning you the same kind of a page of the New York West but with three different things the concert ID and the state is telling you that you are requesting authorization we just done step two on steps trip as a bank and we get the constant ID so what we need to do now is to create the request parameter and buried the concert ID in there and redirect Alice to the bank this request parameter as a get parameter so let's see how you can do that all right so you go to the next step which is in order to request parameter and you can see it's basically a jobs so you use the jockey - what we use in tournament registration and you embedded the concert ID in there and you should see that in a year in postman there is a constant ID in the memory so it's going to be replaced automatically right so you create this job which is just a basic c4 as you can see there and you're going to embody that in the request and you can see that in the get parameter there is a request parameter at the end right so basically we want Alex to follow that request right so what you do is we use a postman trick which is basically being able to generate a request but you don't execute it you actually go to your web browser because alice is going to use a repressor not going to use postman so we simulate the redirection so at least see that so we are highly at the moment what we're going to use to top of it I have to be honest here so we authenticate right when the banks is able to reload the content and it's better to say right this is this TPP and you can see that this is the one we we've done during onboarding you got your logo that you put in the directory and it's showing you that the different bank accounts that you have and you can select select the account that you actually want to share so TPP doesn't really kind of really unfold that you really choose that at this point as Alice and you get a different permission that so TPP is trying to access once you agree all you need to do is to click on proceed and what is happening there is that you get a redirection to the callback and if you remember during the dynamic registration we I use the google.com for that and it's just because we as you're is using postman we don't really want to also service so we've just songs to Google and we can actually other direction happening and extract the code from the the Curry's we just did step 607 and as you can see we on Google and we are step 7 so what we need to do is get in the code and exchange it right we're going to skip step 8 because it's all about security and verify it's important to do right and not say in the contrary you're just for understanding it I think we can skip it that for now and when you get more time and doing the real implementation you can actually do step 8 but don't forget to do it right very important step to do so we're going to directly jump to step 9 so step nummies about taking the code that is in New York um right and say it to the bank a little bit for that we need to have and we need to educate you see the fingerprint is not scary end point and we're going to use a transport certificate for that let's go back to Google so from the your eyes and the fragment you can extract the code so just copy it and let's go back to postman with that all right so good to talk in exchange in there you get in the body you get the good so just replace the good here right little bit obviously you can do that automatically but for the postman experience you have to do it manually so you send this unless you can say you get the access token so this access token has more power than previous one it got the concert inside so that's why we're going to collect the access token waste consent inside now that you get the access token with the consent you can actually use it to get the resources you can do any of them and we're going to do the slash icons I'll let you do the other one for the phone in the other you send the token and as a response you can see that you get a payload so you successfully I managed to get the data and what we do in the past man just to show you is that we actually storing deckhand ID in the memory you know just of the first icon you can see sir how it could it does that allows you to do the you know this kind of requests which are asking you to have a specific account so you search for it just for the postman experience really right and we can do for example get into transaction for that account right and you get all the information you need so I think that from there a lot of you will have a lot of ideas on what you can do with this transaction maybe good things to mention at this point is I see some links and these pages right so you can actually like goes through that endpoint and do like H equal pay equal 5 and then you get a transaction from the fifth page of of the transactions right so that's how you get all the transactions you get them for four guys in this ten transaction but some of may return more than that maybe less is up to ten really you get also the back end point which is slash attack sign so this time there is no icon ID so you get really all the transaction of the users it's maybe what you want I don't know and you can see there's many more page right so it's really up to you on how you want to access the data so thank you for watching that video I hope you enjoyed it don't forget to put a like or to subscribe and I see you to the next tutorial