Open Id Configuration

All the information required to successfully complete the Authorization flow is contained within the .well-known/openid-configuration file. The information is different for Open Banking (UK specific) and PSD2 (whole world including UK)

Open Banking

The OAuth2 authorization endpoint: obp-auth.danskebank.com/open-banking/{channel}/.well-known/openid-configuration where {channel} corresponds to the type of PSU and can be private or business.

private channel - access to resources available in Personal eBanking.
business channel - access to resources available in business specific solution – District.

PSD2

The OAuth2 authorization endpoint: psd2-auth.danskebank.com/psd2/{countryCode}/{channel}/.well-known/openid-configuration where {channel} corresponds to the type of PSU and can be private or business, and {countryCode} is the ISO2 code.

private channel - access to resources available in Personal eBanking and Business eBanking. Note that business accounts may be accessible via this channel in cases when PSU has a specific setup of access/mandates in Business eBanking.
business channel - access to resources available in business specific solution - District.

Country codes supported with private channel:

• dk - Denmark
• se - Sweden
• fi - Finland
• gb - Great Britain

Country codes supported with business channel:

• dk - Denmark
• no - Norway
• se - Sweden
• fi - Finland
• ie - Republic of Ireland
• gb - Great Britain
• pl - Poland

The combination of channel and country determines the Strict Customer Authentication (SCA) process for the PSU and reflects what Danske Bank offers to its own clients in these markets.

Sandbox

The OAuth2 authorization endpoint: sandbox-obp-auth.danskebank.com/sandbox-open-banking/{channel}/.well-known/openid-configuration where {channel} corresponds to the type of PSU and can be private or business. PSD2 sandbox is under development, PSD2 TPPs should register using the Open Banking Sandbox.

Parameter description

The openid configuration file is a JSON format file, containing the following parameters:

• issuer -This should correspond with the audience (aud) value sent by the TPP in the request JWT.
• authorization_endpoint - The endpoint that should be used for authorization redirect requests.
• token_endpoint - The endpoint that should be used for token calls.
• jwks_uri - The location of the JWKS file which contains the public key needed to validate the issuer signature.
• token_endpoint_auth_methods_supported - The authentication methods supported by the ASPSP, for Danske Bank it is tls_client_auth (mTLS)
• registration_endpoint - The endpoint that should be used for registration requests
• scopes_supported - Scopes supported by the ASPSP. Danske Bank does not support multi scope consents, so "openid accounts payments" should not be used.
• response_types_supported - Response types supported by the ASPSP. Danske Bank supports only code id_token which corresponds to the OIDC hybrid flow.
• grant_types_supported - Grant types supported by the ASPSP.
• claims_supported - Claims that are supported and should be provided by the TPP in the authorization request
• signature algorithms - The algorithm used for signing and signature validation. Danske Bank supports only PS256