Assess → Remediate
Findings
Gaps between discovered configuration and the target Directory state, prioritised by severity and cutover impact.
Critical5
High7
Medium4
Low2
Cutover blockers3
18 of 18
| Control | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| FND-1042 | Critical | Legacy Directory endpoint detectedBlocker | TPP Registration Service | Directory API | Production | DIR-001 | Open | Unassigned | 12 Sept, 08:41 |
| FND-1043 | Critical | OAuth audience references legacy token endpointBlocker | Jans IAM | OAuth & Authentication | Production | OAUTH-002 | Assigned | L. Mensah | 13 Sept, 06:10 |
| FND-1044 | Critical | Signing key selected by position, not kidBlocker | Jans IAM | JWKS | Production | JWKS-002 | Open | Unassigned | 13 Sept, 06:12 |
| FND-1045 | Critical | Keyfactor issuing CA absent from trust store | TPP Registration Service | PKI | Production | PKI-001 | In Remediation | A. Whitfield | 09 Sept, 10:00 |
| FND-1046 | Critical | TPP role validated from certificate only | TPP Registration Service | TPP Registration | Production | TPP-002 | Open | Unassigned | 11 Sept, 14:22 |
| FND-1047 | High | Directory API client pinned to v2.1 | Developer Portal | Directory API | Production | DIR-002 | Assigned | R. Okafor | 10 Sept, 09:00 |
| FND-1048 | High | Legacy SCIM interface still enabled | TPP Registration Service | TPP Registration | Production | SCIM-001 | Open | Unassigned | 12 Sept, 08:41 |
| FND-1049 | High | Hard-coded Entrust issuer DN in signature validation | Payment API | PKI | Production | PKI-003 | Open | Unassigned | 13 Sept, 06:10 |
| FND-1050 | High | NGINX client CA bundle Entrust-only | NGINX Reverse Proxy | Trust Stores | Production | PKI-001 | Assigned | A. Whitfield | 13 Sept, 06:12 |
| FND-1051 | High | Outbound proxy allow-list lacks new Directory host | Outbound Proxy | Network Connectivity | Production | DIR-001 | Open | Unassigned | 09 Sept, 10:00 |
| FND-1052 | High | JWKS client rejects application/jwk-set+json | Jans IAM | JWKS | Production | JWKS-001 | Open | Unassigned | 11 Sept, 14:22 |
| FND-1053 | High | Payment API trust store Entrust-only | Payment API | Trust Stores | Production | PKI-001 | Open | Unassigned | 10 Sept, 09:00 |
| FND-1054 | Medium | Deprecated Directory OAuth scopes requested | TPP Registration Service | OAuth & Authentication | Production | OAUTH-003 | Open | Unassigned | 12 Sept, 08:41 |
| FND-1055 | Medium | Keyfactor CRL fetch intermittently times out | Certificate Validation Service | Revocation | Production | REV-002 | Assigned | S. Patel | 13 Sept, 06:10 |
| FND-1056 | Medium | SSA validation ignores org_jwks_endpoint | TPP Registration Service | SSA | Sandbox | SSA-001 | Open | Unassigned | 13 Sept, 06:12 |
| FND-1057 | Medium | 4096-bit CA chain not tested on Sandbox proxy | Sandbox Reverse Proxy | PKI | Sandbox | PKI-004 | Open | Unassigned | 09 Sept, 10:00 |
| FND-1058 | Low | Directory monitoring probe targets legacy host | Open Banking Monitoring | Operational Readiness | Production | OPS-003 | Open | Unassigned | 11 Sept, 14:22 |
| FND-1059 | Low | Certificate path building not tested with cross-signed intermediate | Certificate Validation Service | Certificate Validation | Sandbox | PKI-005 | Open | Unassigned | 10 Sept, 09:00 |