Migration notes 5.2

This page explains the changes required to migrate to the stated version of Atoti FRTB.

Migrate to 5.2.0

Upgrading from version 5.1.0, see Atoti FRTB 5.2 Release Notes.

Atoti FRTB uses Atoti Server 6.0.9 and Atoti UI 5.1.x. For new features and fixes included in these releases, please see the Atoti UI documentation and Atoti UI Migration Notes, and the release notes for Atoti Server.

For clients licensed to use ActiveMonitor, a skeleton module based on version 6.0.9 is included with the Atoti FRTB 5.2.0 release.

Breaking Changes

• DRC non-Sec risk-weights configuration : A “bucket” column has been added to the Default_Risk_Weights configuration file. This column must be added to existing files, but it may be empty.
• Variable name changes in Topic Config : Changes to variable names and references for the topic configs.
• Java 17: Java 17 is now required to run Atoti FRTB and additional JVM options are needed.
• “Category” Hierarchies removed: For SBM Equity and CSR, the technical “Category” hierarchies are no longer needed and have been removed.
• “DRC Seniority Ranking” level removed: This technical level is no longer needed and has been removed.
• Security Configuration upgraded: The security configuration has been upgraded to Spring Security 5.8 and no longer uses deprecated classes.
• CSR Correlation configuration: The CSR gamma correlations are now fully defined by bucket pairs, instead of just the “sector” component.
• Equity Correlation configuration: The Equity gamma correlations are now defined by bucket pairs in a new file.
• DirectQuery Database: The SASensitivities table is now used for the RRAO Notional, instead of the SATradeDescription table.

Summary

• Upgraded Spring Security to version 5.8.7 to resolve vulnerabilities and prepare for the upgrade to Spring Security 6.0 (via Spring Boot 3).
• Added “bucket” column to the Default_Risk_Weights configuration file.
• Updated configuration files to include support for US-NPR parameter set.
• Changed variable names and references for the topic configs.
• In the Stress Calibration cube:
  • Replaced PnL vector with PV vector and base PV.
  • Added scenario FX rates.
• Added file formats for loading SA summary data.
• Move to Java 17.
• Schema clean-up.
• Variable name changes in topic configs.
• Reference configuration data for non-BCBS Parameter sets have been separated into their own folders. Additionally, file names for separated data have suffixes denoting parameter set.

DirectQuery Database Schema

We have made the following changes to clean up the DirectQuery Database Schema:

The following tables are no longer needed:

• SENIORITY_DESCRIPTION
• CSRBUCKET_DESC
• EQUITY_BUCKET_DESC

The Notional used for RRAO will be stored in the SASENSITIVITIES table instead of the SATRADE_DESCRIPTION table.

Configuration Files

The gamma correlations for CSR and Equity are now configured by bucket pairs in configuration files. Previously, only the “sector” component of the CSR gamma correlations was stored this way, and the Equity gamma correlations were configured through several properties.

The DRC Seniority Description file has been changed into a configuration file and the “as-of date” column removed. As part of this move, the SeniorityDescription table has been removed from the star Schema, and the “DRC Seniority Ranking” level is no longer available in the cube.

RRAO File

A new RRAO file has been added. This replaces the RRAO columns in the Trade Attributes file.

The old trade attributes files can still be loaded, but the RRAO-related columns have been deprecated. A script is included to generate the new RRAO files from old trade attributes files.

“Category” Hierarchies Removed

The technical “Category” hierarchies used for the Equity and CSR risk classes have been removed. For each of the removed hierarchies, there is a non-Category hierarchy that may be used in its place.

While we don’t expect these hierarchies to be used in saved queries or bookmarks, if you would like to restore these hierarchies as a customization, please contact us.

Spring Security Upgrade

We have upgraded to Spring Security 5.8.7, see Spring’s migration guide.

The frtb-common module has been removed and security configurations which were previously found there have been moved into frtb-starter.

You will eventually need to migrate your own custom security configuration(s) in preparation for Spring Security 6.0. We have upgraded our out-of-the-box security configurations to help in this migration.

The default security users and roles have not changed, only the way we implement the security. We have done so by making the following changes:

Stop Using WebSecurityConfigurerAdapter

We have replaced instances of WebSecurityConfigurerAdapter with SecurityFilterChain beans. Note that in our reference implementation these can now be found inside FRTBSecurityFilterChainsConfig.

Use the new requestMatchers methods

In Authorize Http Requests, we have replaced invocations of http.authorizeHttpRequests((authz) -> authz.antMatchers(...)) with http.authorizeHttpRequests((authz) -> authz.requestMatchers(...)).

Use the new securityMatchers methods

We have replaced invocations of http.antMatchers(...) with http.securityMatchers(...).

As an example of the previous changes, the configuration for accessing the endpoint which exposes the JWT token changed from:

@Configuration
@Order(1)
public static abstract class AJwtSecurityConfigurer extends WebSecurityConfigurerAdapter {

  @Autowired
  protected ApplicationContext context;

  @Autowired
  @Qualifier(BASIC_AUTH_BEAN_NAME)
  protected AuthenticationEntryPoint authenticationEntryPoint;

  @Override
  protected void configure(HttpSecurity http) throws Exception {
	  http
            .antMatcher(JwtRestServiceConfig.REST_API_URL_PREFIX + "/**")
            // As of Spring Security 4.0, CSRF protection is enabled by default.
            .csrf().disable()
            // Configure CORS
            .cors().and()
            .authorizeRequests()
            .antMatchers("/**").hasAnyAuthority(ROLE_USER)
            .and()
            .httpBasic().authenticationEntryPoint(authenticationEntryPoint);
  }
}

to

@Bean
@Order(1)
protected SecurityFilterChain jwtSecurityFilterChain(HttpSecurity http, ApplicationContext applicationContext) throws Exception {
final AuthenticationEntryPoint basicAuthenticationEntryPoint = applicationContext.getBean(BASIC_AUTH_BEAN_NAME, AuthenticationEntryPoint.class);
        return http
                // As of Spring Security 4.0, CSRF protection is enabled by default.
                .csrf(AbstractHttpConfigurer::disable)
                // Configure CORS
                .cors().and()
                .securityMatcher(url(JwtRestServiceConfig.REST_API_URL_PREFIX, WILDCARD))
                .authorizeHttpRequests(auth -> auth.requestMatchers(HttpMethod.OPTIONS, url(WILDCARD))
                    .permitAll()
                    .anyRequest()
                    .permitAll()
                )
                .httpBasic(basic -> basic.authenticationEntryPoint(basicAuthenticationEntryPoint))
                .build();
        }

Removed imports of ActivePivotRemotingServicesConfig

This class imports org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter, which may (if used) expose access to CVE-2016-1000027 in the Spring-web project.

Variable name changes in topic configs

We have changed variable names and references for the topic configurations in our source configs. While the variables used have been changed or removed, the values themselves remain unchanged.

Here’s a summary of the variable name and reference changes:

• Removed redundant static variables in source configs, which were duplicates of existing static store name variables.
• Made use of store name variables from datastore configs in source configs, DLC, tuple publishers, and column calculators, where appropriate.
• Prefixed all topic variables with “TOPIC_”.
• Suffixed all store name variables with “_STORE_NAME”.

Source config changes

AConfigurationSourceConfig

ASensiSourceConfig

ASourceConfig

Datastore variable changes

Reference configuration data for non-BCBS Parameter sets

There are now separate directories holding the configuration for the individual parameter sets CRR2, CRR3, NPR, and PRA. The top-level configuration directory now retains just the BCBS parameter set.

Input file formats

Added

Modified

Configuration files

Files Added

DRC Seniority Description.csv

Changed the DRC Seniority Description input file into a configuration file, DRC Seniority Description.csv without the AsOfDate column.

Equity Bucket Correlations

The gamma correlations between Equity buckets is now configured in the Equity_Bucket_Correlations file.

Files Modified

Default_Risk_Weights

frtb-config.properties

Deleted properties:

frtb-data-load.properties

New properties:

Deleted properties:

CSRNS Bucket Correlations

The CSRNS Bucket Correlations file now contains the (full) gamma correlation, instead of just the “sector” component of the correlation.

Startup properties

Deleted properties:

Datastores

Added stores

Modified stores

Databases

Deleted tables

The following tables are no longer part of the star schema, so they are not needed in DirectQuery anymore:

• CSRBUCKET_DESC
• EQUITY_BUCKET_DESC
• SENIORITY_DESCRIPTION

Cube schema

Removed

Other changes

Java 17 JVM Options

To run Atoti FRTB using Java 17, the following needs to be added to the JVM options:

--add-opens java.base/java.util.concurrent=ALL-UNNAMED

See the Atoti Server documentation for more details.