Content
| Sommaire | ||||
|---|---|---|---|---|
|
Introduction
Banking and Connection Prerequisites 3DSecure
This treatment is based on the establishment of an additional control during an online purchase: in addition to banking data, the buyer will validate his payment by entering a secret data that will have provided his bank.
This system is accompanied by a regulatory change called "liability shift" or "transfer of responsibility", the principle of which is to bear the risk of unpaid invoices for the bearer's challenge to the bearer's bank and no longer to the merchant, if the holder has validated his payment by filling in the 3D Secure data and the merchant has complied with the security measures set out in the general terms and conditions of his e-commerce contract with his bank.
The payment solution Payline has performed a 3DSecure certification with banks, as well as with Visa and MCI.Subscription
The merchant must subscribe to a VADS contract (VAD type 3D Secure). The merchant informs Payline that he has subscribed to a VADS contract with 3DSecure, and the customer wishes to subscribe to the 3DSecure option. The Payline team must register the merchant with Visa and MCI, "10 days is required" Upon confirmation of the Visa and MCI networks, the Payline team informs the merchant that he will activate the VADS contract. Upon activation of the VADS contract, all flows on this contract will be 3DS transactions.
Prerequisites for using Payline payment solution
La solution 3D Secure en mode interface Direct assure le transfert sécurisé des données sensibles et traite les demandes d'authentification, d'autorisation.
Les points d'intégration :
- verifyEnrollment est nécessaire pour assurer l'authentification et doAuthorization pour réaliser l'autorisation ;
- récupérer le résultat de la transaction avec gettransactionDetails.
Vous devez vérifier la clé d'accès des services et configuration le paramétrage SOAP UI.
The 3D Secure solution in Direct interface mode ensures the secure transfer of sensitive data and processes requests for authentication and authorization.
Integration points:
- verifyEnrollment is required to provide authentication and doAuthorization to perform the authorization;
- get the result of the transaction with gettransactionDetails.
You must check the service access key and configure the SOAP UI setting.
3D-Secure in Direct Interface mode with a payment
This page presents the two web services "verifyEnrollment and doAuthorization" to perform a 3DSecure transaction using the direct interface mode of the payment solution Payline.Step 1 - verifyEnrollment :
This first call web service makes it possible to verify the eligibility of the bearer to the 3DSecure device, and therefore to know if the cardholder is registered with a VISA or Mastercard Directory Server.
Here is an example of a request / response for the web services verifyEnrollment:
verifyEnrollmentRequest | verifyEnrollmentResponse |
|---|---|
<impl:verifyEnrollmentRequest> | <verifyEnrollmentResponse> <termUrlName>TermUrl</termUrlName> |
Once the verifyEnrollment is done, authentication to the ACS server must be performed. For this, it is necessary to send the information of the verifyEnrollment on the authentication server.
Sending information
To send this information, simply create an HTML form in POST if you want to create a link if GET:
POST: The information will be sent to the authentication server through the form below. The field names and values are dynamically retrieved from the verifyEnrollmentResponse.- session tracking: value to retrieve in the verifyEnrollment response
- mdFieldName = MD
- mdFieldValue = 1Fz9nEnAZJNn8NvXEKDT
authentication request: value to retrieve in the verifyEnrollment- pareqFieldName = PaReq
- pareqFieldValue = eJxVkdtuwjAMhl+l4gGaA...
- Address where the authentication server. This address must be able to retrieve a form sent in "POST" and containing the answer of the authentication of the user.
- termUrlName = TermUrl
termUrlValue = https://acs.modirum.com/mdpayacs.php
- termUrlName = TermUrl
Sample HTML form to perform a test on your server:HTML form |
|---|
<form name="downloadForm" action="https://acs.modirum.com/mdpayacs/pareq" method="POST"> |
Receipt of information returned during authentication
The authentication server sends its message to the URL entered in the TermURL parameter (sent in the previous form). In the response form, two fields must be retrieved to continue the transaction in 3DSecure mode:
- The MD field: always the same field allowing the follow-up of the session
- the Payer Authentication Response (PaRes) field: an encrypted string containing the response of the authentication server. The value of the PaRes field will validate or not the transaction as a 3DSecure transaction.
These two fields are retrieved and allow to complete the doAuthorizationRequest in 3DSecure mode.
Sample script (here written in PHP) to retrieve the response to authentication:Script PHP : receive_form.php |
|---|
<?php |
Note: This script must be placed on a started web server and in a folder corresponding to the address sent via the TermURL field.
Example: if the server is local it is quite possible to put as value:
TermURL = http://127.0.0.1/3DSecure/receive_form.php
Step 2 : doAuthorizathion with3D Secure settings
The web service call of the doAuthorization method allows you to directly perform the transaction with the 3DSecure parameters.
The parameters entered: md / pares make it possible to check the authentication and thus the identity of the user before carrying out the transaction.
If the parameters are correct, the transaction is then directly carried out as for the classic doAuthorization.
doAuthorizationRequest | doAuthorizationResponse |
<impl:doAuthorizationRequest> | <doAuthorizationResponse> |
| Extrait | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||
3D-Secure en mode interface direct avec la possibilité ou pas d'effectuer un paiement Il est possible d'utiliser la fonction 3DSecure implémentée sur la solution de paiement Payline, sans utiliser la fonction standard de Payline « effectuer un paiement », donc vous utiliserez uniquement les deux premières étapes décrites ci-dessous. Étape 1 : appel du web service verifyEnrollmentComme expliqué précédemment, cette première action permet de vérifier l'enrôlement de la carte de l'utilisateur. Les éléments obligatoires de la méthode verifyEnrollment sont :
Étape 2 : authentificationUne fois le verifyEnrollment effectué, l'authentification auprès du serveur ACS doit être effectuée. Pour cela, il est nécessaire d'envoyer les informations du verifyEnrollment sur le serveur d'authentification. Les informations attendues par le MPI sont le MD (pour le suivi de session) et le paReq (requête d'authentification). Envoi des informationsPour envoyer ces informations, il suffit de créer un formulaire HTML regroupant les champs MD et paReq et pointant vers le serveur d'authentification.
Attention ces valeurs sont générés de manière dynamique et se renouvelleront à chaque demande. Réception des informations retournées lors de l'authentification
Étape 3 : doAutorizationLa dernière étape dans le cadre d'une transaction 3DSecure via l'interface Payline DIRECT est l'envoi d'une requête doAuthorization. Comme dans le cadre d'une transaction classique, le doAuthorization contiendra les champs obligatoires suivant :
|
Boack Office
Menu 'Technical follow-up of webservice calls' to find the call of the web service verifyEnrollment allows to see the details of the verifyEnrollment.
The result of the 3DSecure transaction is then visible in the Payline Administration Center: on the results of a search and in the detail of the transaction 3DSecure tab:
Screen searches for transactions:
Detail of the 3DSecure transaction
3D Secure payment scheme
| Extrait | ||
|---|---|---|
| ||
|