Installation and setup

Provides instructions for installing and setting up the Testing Tool using Docker, including prerequisites and initial configuration. This tool has been successfully tested on Ubuntu Linux and on MacOS.

Usage instructions

Details the commands and options available in the Testing Tool CLI tool, with examples for effective usage.

Testing

Explains the testing procedures and conformance checks, including how to run tests and interpret the results.3. Audience

-v "$(pwd)/config:/usr/o3/tr-ozone-connect/config"

If the LFI configuration is not provided, the tool will attempt to connect to a the Ozone Connect mock server deployed by Ozone in the cloud. For detailed information on the configuration file format, please refer to the configuration file section: 7.1.2

SSL certificates are necessary for secure mTLS connection between the Testing Tool and LFI’s implementation of Ozone Connect. The method to generate these certificates is documented in the Certificates Generation section: 7.2

After generating the certificates, copy them into a folder named config/certs on the host machine from where the test command will be executed. These copied files are then passed to the Docker container using the configuration options mentioned earlier.

-v "$(pwd)/logs:/usr/o3/tr-ozone-connect/logs"

This option is mandatory and must be provided to access the logs after the program runs. Both the logs and the HTML output report will be available in this folder once the tests are complete.

public.ecr.aws/g5c5c6i0/tr-image/tr-ozone-connect:2026.01.0 \

This is the location of the publicly available Test Tool Docker image.

-h, --help

Show help (boolean)

-c, --config

Input test configuration files in .yaml or .json format
(Format : string, required)

config.yaml, config.json, ./config/config.yaml

-f, --folder

Preconfigured path to the folders with the test files
(Format : string, required)

src/tests, tests, ./src/tests

-o, --out

Output file name
(Format : string, optional)
A log file and an HTML output report are generated with the name specified in this option.

results.json, output.json, ./test_output.json

-e, --formatter

Use a standard formatter for the output
(Format : string, optional)

full, terse, medium, errors

-s, --regex_for_test_suite

Provide the full name of the test suite from the list.
comma separated list if multiple SuiteId needs to be tested. (No leading and trailing whitespace)
To exclude specific test suite just add '!' before test suite.

To run all the suites, use .*

(Format : comma separated string, optional)

The full list of test suites currently available are :

SuiteIds

If this flag is absent then all suites will get execute.

‘Id:[GET /accounts/{accountId}/customer]’,

‘Id:[GET /accounts/{accountId}/customer,GET /accounts/{accountId}]’
‘Id:[!GET /accounts/{accountId}/customer]’ → this will exclude test suite ‘GET /accounts/{accountId}/customer’ and execute remaining others.

-r, --regex_for_test_case

Provide a regular expression for running selected tests.

(Format : string, required)

The list of the test case names can be found in the

Ozone Connect Test Cases

If this flag is absent then all test cases will get execute.

Example regex values are mentioned in this document :
Regular Expression for Ozone Connect Testing Tool

-v, --loglevel-runner

Log level for the test runner (Format : string, optional)

debug, info, silent (In the order of precedence)

-l, --loglevel-suite

Log level for the test suite (Format : string, optional)

debug, info, error (In the order of precedence)

--version

Show version number (boolean)

baseUrl

• Description: The base URL for the API endpoints.

• Type: String

• Example Value: https://<Some URL>

accounts-schema-file

• Description: Path to the dereferenced swagger file for the data-sharing apis

• Type: String

• Default and only value : der-cbuae-ozone-connect-data-sharing-openapi.json

• This field is required for validating the response with the schemas.

payments-schema-file

• Description: Path to the dereferenced swagger file for the service-initiation apis

• Type: String

• Default and only value : der-cbuae-ozone-connect-service-initiation-openapi.json

• This field is required for validating the response with the schemas.

event-action-schema-file

• Description: Path to the dereferenced swagger file for the consent event action apis

• Type: String

• Default and only value : der-cbuae-ozone-connect-consent-events-actions-openapi.json

• This field is required for validating the response with the schemas.

insurance-schema-file

• Description: Path to the dereferenced swagger file for the insurance apis

• Type: String

• Default and only value : cbuae-ozone-connect-insurance-data-sharing-openapi.json

• This field is required for validating the response with the schemas.

products-schema-file

• Description: Path to the dereferenced swagger file for the product apis

• Type: String

• Default and only value : der-cbuae-ozone-connect-products-data-openapi.json

• This field is required for validating the response with the schemas.

bank-open-data-schema-file

• Description: Path to the dereferenced swagger file for the bank open data apis

• Type: String

• Default and only value : der-cbuae-ozone-connect-bank-open-data-openapi.json

• This field is required for validating the response with the schemas.

authorization_type

• Description: The type of authorization.

• Type: String

• Currently we support only JWT, CCG and none.

• If CCG is selected, the following 4 fields (ccgDetails) are required to be updated.
  If CCG is selected, and the ccgClientAssertionType is selected as private_key_jwt then, the (server) fields are required to be updated.

  • If JWT is selected, the (server) fields are required to be updated.

clientId

• Description: ClientId

• Type: String

jwksUrl

• Description: Valid jwksUrl (Secure)

• Type: String

default_pii_data

• Description: Valid jwksUrl (Secure)

• Type: Yaml Object

ccgDetails

• authorisationServerTokenUrl

• Description: The complete path for the authorization server end point.

• Type: String

• Example Value: authUrl/token

ccgDetails

• ccgClientAssertionType

• Description: Type of client credential grant

• Type: String

• Example Value: clientCredentials, private_key_jwt

ccgDetails

• clientId

• Description: Client Id for client credential grant

• Type: String

ccgDetails

• clientSecret

• Description: Client Secret for client credential grant

• Type: String

certs

TPP: Configuration for the Third-Party Provider.
This is the entity (e.g., a fintech app) that accesses financial data on behalf of a user.
The config is required to simulate the TPP performing payload signing & encryption.

application.name: The application name from the OFTF.
application.id: The application ID from the OFTF.

'sig1': Configuration for the TPP's primary SIGNING certificate. (Mandatory section)
This key pair is used to sign requests, assertions, and JSON Web Tokens (JWTs).

sig1.pemFileName: The path to the public certificate file.
sig1.keyFileName: The path to the corresponding private key file.
sig1.kid: The Key ID used in JWS headers to identify this signing key
sig1.jwks_url: 'jwks_url': The URL where the JSON Web Key Set (JWKS) can be retrieved

certs

APIHUB: Configuration for the API Hub / Central Registry.
The config is required to simulate the API Hub performing JWT Auth payload signing.

'application': The OFTF Application representing the APIHub in the Ozone Testing Tool.
'name': The application name from the OFTF.
'id': The application ID from the OFTF.

'sig3': Configuration for the APIHub's SIGNING certificate. (Mandatory section if authorization_type: JWT or CCG)
sig3.pemFileName: The path to the public certificate file.
sig3.keyFileName: The path to the corresponding private key file.
sig3.kid: The Key ID

sig3.jwks_url: https://keystore.sandbox.directory.openfinance.ae/${FLI.organisation.id}/${APIHUB.application.id}/application.jwks

'c4': Configuration for the APIHub's TRANSPORT certificate (for mTLS Mandatory section if certs are require to authenticate api calls)
c4.ca: Path to the CA certificate for transport layer security.
c4.certFileName: Path to the transport layer certificate file.
c4.keyFileName: Path to the private key file for the transport layer certificate.

certs

LFI: Configuration for the Licensed Financial Institution (e.g., a bank).
This config is required to simulate the LFI performing payload decryption.
'organisation': The OFTF Organisation representing the LFI in the Ozone Testing Tool.

organisation.name: The organisation name from the OFTF.
organisation.id: The organisation ID from the OFTF.

'enc1': Configuration for the LFI's ENCRYPTION certificate.
enc1.aud: AUD value for PII data encryption.
enc1.pemFileName: The path to the public certificate file. Tool will look for this by default. In its absense it will use jwks_url in enc1
enc1.keyFileName: The path to the corresponding private key file.
enc1.kid:
enc1.jwks_url: (mandatory) https://keystore.sandbox.directory.openfinance.ae/${FLI.organisation.id}/application.jwks

server

• aud

Identifier for the party receiving the JWT. This must be set to the PROVIDER_ID specified by Ozone during configuration.

server

• request_object_signing_alg

PS256

server

• expiry_in_sec

We recommend an expiry time of 10-30s.

When validating the JWT, allow for a 10s clock skew.

server

certs

• signing

  • kid

The key ID of key-pair used to sign the message as published on the JWKS. The specification does not support the use of other means of identifying the key as they are not considered to be secure enough (e.g. x5c and x5u are not supported).