Secure Payment Processing - New Interface To Element Express

Transcription

1 Secure Payment Processing - New Interface To Element Express Simplify and Secure the Process of Electronic Payment Acceptance. SouthWare offers customers a fully integrated, PCI/DSS compliant, and cost-effective payment processing solution via is partnership with Element Payment Services, the industry leader in PCI DSS compliant payment processing solutions. Through a simple upgrade, capture every sale with easy-to-use, reliable payment processing solutions that simplify card payment acceptance and dramatically reduce the risk associated with handling cardholder data. The state-of-the-art Element Express Processing Platform supports credit, debit and check solutions and includes features such as TransForm tokenization, point-to-point encryption and comprehensive Web-based reporting, allowing customers to easily comply with PCI DSS requirements for your payment processing software. Key Benefits: Process Payments Using the Fully Integrated Payment Module in SouthWare, Eliminating the Need for Standalone POS Terminals Or Costly and Unsecure Third Party Software Option to Keep Your Current Processor While Leveraging the Advantages of Element s Processing Platform Security and Compliance with Industry Standards such as PCI DSS Access to 24 7 Customer Support at No Additional Cost Get the Most Valuable Payment Processing with Highly Competitive Processing Rates and Fees. Implementation Notes: Contact your SouthWare Dealer to sign-up for using the Element Gateway Install the full updates through 12/01/11 Setup Element Account IDs in XX Setup Credit Card Configuration IDs in XX Add Credit Card Configuration IDs to SouthWare Line records (XX field #12) If using PASS feature, create PASS records from Invoice History in XX051301

2 Element Express Setup Setup and Technical Notes 11/28/2011

3 Table of Contents Credit Card Interface Manager (XX ) Options Element Express Account Maintenance (XX ) Credit Card Interface ID Maintenance (XX ) Element Express User Interface Express Window accepting card information:... 5 Express Window with information already provided: Order Entry Processes (POS/OE) with Express Interface Special Note about Pre-Auths or Credits for cards that were processed through PCCharge or ICVerify: 6 PASS Information Additional Technical Notes: Terminal Services & Devices Purging of PASS IDs Create PASS Records from History Other Options (Support Tools) Info Only Credit Cards: Using ELEMENT with NetLink Activating Element Express Interface Dual-Use NetLink Pages The NetLink User Interface Communication with Element Express Under the Hood of the NetLink Interface Code Samples P a g e

4 Credit Card Interface Manager (XX ) The credit card interface manager changed a bit to include the Element interface. Credit card interface IDs for the Element Express product show information specific to that. Card Transaction types (including the tabs) and Commercial Card Ranges don t apply to the Element Express interface. The information sent to Express cannot be altered because all necessary information is already being sent to Element Express. The Credit Card Manager can be used to verify that ELEMENT is setup properly. Use the Option Check Status to determine if all the steps have been setup for ELEMENT. To view or create PASS records or to view Element Transactions, the workstation must be assigned an Element Credit Card Interface ID. Options View All Pass Records: Allows you to view all the PASS (stored credit card information) for your company Purge Expired Pass Records: Allows the user to purge any expired PASS credit cards from the ELEMENT Server. Express Transaction Inquiry: Allows the user to view transactions posted to ELEMENT. User has an option for a range of transaction dates. Create Initial PASS from Payment History: Allows the user to create PASS records for this company based on full credit card information stored in invoice history. A range of Invoice Dates to use for credit card # s can be entered when creating initial PASS records. Element Account Ids: From this option, the user can add or modify existing element account ids. 2 P a g e

5 Element Express Account Maintenance (XX ) This new program allows you to maintain credential information provided from Element for the accounts with them. This information is used during SouthWare s communication with Element Express. Most customers will only need one account, but in some situations where more than one account is required you may have multiple. Each field will be documented below. 1. Account Name Enter a unique ID for this account (up to 10 characters). This can be anything you want it to be. This ID is referenced in each Express Credit Card Interface ID. 2. Description Enter a description for this account (up to 30 characters). This is used to provide a more detailed description of this account and is for reference only. 3. Express AccountID Enter the AccountID provided from Element for your account. 4. Express AccountToken Enter the AccountToken provided from Element for your account. 5. Express AcceptorID Enter the AcceptorID provided from Element for your account. 6. Express TerminalID Enter the TerminalID provided from Element for your account. 7. Command Line Enter the command line to execute the non-windows Element Express Interface program. This command line is currently only necessary for non-windows web servers when using NetLink or Live Portals. The interface program is a java program and requires that java be installed on that server. This command line will default and can typically be left unchanged. However, if you have a need to modify the path, etc. you may do so here. 8. PASS Option? PASS (Payment Account Storage System) is a feature of Element Express where you can store payment card information so you can use them again for future transactions. This option should 3 P a g e

6 be an A or M if you signed up the PASS feature with Element. In order to pay via credit cards from past orders or use the info only feature, you must be using PASS. The options are: A utomatic which will only save credit cards that are manually entered. Scanned cards will not be saved N o PASS indicates that you do not want to save any credit card information and you will not be entering info only type transactions. M anual indicates that you do want to store credit card # s but that you will enter them manually. Credit Card Interface ID Maintenance (XX ) In order to use the new Element Express interface, the Credit Card Interface ID must be defined as an E Interface Type (field 3). Once this is done, there are several differences in this maintenance that are specific to the Element Interface. These changes are documented below. 3. Interface Type A new interface type E for Element Express is now available. If this is selected, you must enter an Element Express Account ID (or use F3 to lookup). This is the record with credentials that you setup in XX In addition, you may choose to enter a Prev ID. This previous CC Interface ID allows you to process old transactions that need processing with an interface ID for previously used software (PCCharge or ICVerify) during a temporary basis. This allows you to finalize Pre-Authorized transactions, etc. that must be done with the software that was used originally. 5. Swipe/Pinpad Device Info Element Express will work with or without a device. However, there is no need to specify which device is used because they all work the same with Express. The devices must be supported by Element. If you are using a device, choose Y es. Otherwise, choose N o. 6. Comment for Transmission This field doesn t apply to Element Express. There is no comment sent with transmission. 7. Rsvd Line #/User ID 4 P a g e

7 This field doesn t apply to Element Express. There is no need to have a unique line number or user ID per interface ID. 11. Manual Auth if Rejected? This field doesn t apply to Element Express. Credit Card information cannot be stored in SouthWare for the Element interface. 12. Override Request Format This field doesn t apply to Element Express. Override formats are not needed or supported. 15. Mail Order CVV/CVV2? This field doesn t apply to Element Express. The CVV/CVV2 code is not accepted in SouthWare for the Element Express interface in order to be out of scope for PA-DSS compliance. The CVV code is always prompted for when manual entry transactions occur in Element Express. 16. Level-2 Commercial Cards? This field doesn t apply to Element Express. Commercial Cards will be handled if they are used and a Customer Ref/Code is entered at payment time. If your card processor doesn t support this, then it simply won t be processed as a commercial card. 17. PCCharge IP Address This field doesn t apply to Element Express. This is a field for PCCharge only. 18. Card Present Default Enter whether the card is typically present for this Credit Card Interface ID or not. If this ID will be used for a Point of Sale workstation, this should be Y es. If the card is typically not present during transactions (mail order or phone order), then this answer should be N o. This option can be modified at runtime and is just a default. Element Express User Interface The Element Express User Interface is a web-based interface. When credit card information is required, a popup window will appear with information about the transaction. From within this window, the card number and expiration date can be scanned or entered. When credit card information is not needed (forcing a pre-auth or paying from history, etc), a confirmation window will appear showing the credit card information to be submitted. Express Window accepting card information: 5 P a g e

8 Express Window with information already provided: Order Entry Processes (POS/OE) with Express Interface Below are some key changes that you should notice when using the Express: When go to field 37 (payment) and select an amount, brings you into a plus box and then automatically into the Bar Select for the transaction type. This previously only occurred if using a device. Now, it happens every time. After selecting the transaction type, the new Express popup window opens where all the credit card entry takes place. After processed, the payment type is automatically chosen based on the card type used. If there are multiple payment types that match, you will be returned to the field 37 plus box to select a proper payment type. If you want to enter a non-credit card payment type, such as a coupon, etc., you should cancel out of the bar select for transaction type and enter the appropriate payment code and other information in the field 37 plus box. Special Note about Pre-Auths or Credits for cards that were processed through PCCharge or ICVerify: Any transactions done in PCCharge or ICVerify that require further action (forcing a pre-auth or crediting back a transaction) must be processed using the original software used. Element can only handle transactions created using the Element Express Interface. This is because our interface to Element Express is out of scope and we cannot handle cardholder information. To accommodate clearing out PCCharge or ICVERIFY Transactions, a Prev ID can be included on the Credit Card Interface ID (field 0303) that will be used if a transaction was not processed by Element. If the Order Entry process encounters a transaction that was not processed in Element, the Previous Credit Card Interface ID will be used instead. This means that the payment process will work just as it did for that interface (PCCharge or ICVerify). 6 P a g e

9 PASS Information PASS (Payment Account Storage System) IDs contain cardholder information on Element s secure storage system. Since SouthWare cannot store cardholder information in our system, it s critical to use PASS IDs for information only transactions or charging a card that was previously used by this customer. The use of PASS is optional and can be defined in the Element Account Maintenance (XX ). If PASS is set to A utomatic,, all credit cards manually entered (not scanned) as a sale will create as PASS record (with the exception of credit card sales for Miscellaneous Customers). To make a payment using the PASS ID, just select it from the bar select and press Process Transaction. If you want to maintain PASS IDs for a customer, there is an option in customer maintenance (Element Icon at the top right corner of customer maintenance). A grid will appear with the PASS IDs listed and you have the ability to add or remove any PASS records. NOTE: From any place where a link customer # is established you can execute the object CUSTPASS to retrieve this information. The direct program call to do this is: SWCCELEG[customer# with leading spaces if applicable]

10 7 P a g e 2335 Buttermilk Crossing, Suite 300, Crescent Springs, KY Phone: (859) Fax: (866)

11 Additional Technical Notes: Terminal Services & Devices There are known issues with the encrypted devices that Element supports with their product and use on a Remote Desktop Connection (such as Terminal Services). Element recommends setting the Keyboard option under Local Resources tab to On the local computer as shown here to avoid any issues. If this is not done, it s likely that the device will not be able to communicate with the Express product. Purging of PASS IDs SWCCELES/P/E: Purge all PASS records with expired cards - this is available from the Credit Card Manager (XX051301) Create PASS Records from History SWCCELES/C/R/E: Creates PASS records for credit card in invoice history - this option is available from the Credit Card Manager (XX P a g e

12 Other Options (Support Tools) SWCCELEG/A/L/L: Grid for all PASS records for a company SWCCELEG/T/R/N: Special Reporting to view ELEMENT transactions Info Only Credit Cards: When you process an info only type transaction, ELEMENT will verify that the credit card is valid and perform Address Verification Only. The card will be stored in ELEMENT until it is processed as a sale or pre-auth. If using PASS, once an un-scanned card is processed as a force or sale, it will be stored in PASS for future use. NOTE: PASS must be activated to process an Info Only type transaction. Using ELEMENT with NetLink Netlink has been modified to easily work with the new interface to Element Express in order for SouthWare to become out of scope of PA-DSS. This has been implemented in the 3 areas where credit cards are used on Rev 15 platform technologies - Shopping Cart, Order Entry Portal, and Customer Self-Service Portal. It can be implemented in other areas as well - there are instructions on how to do that later in this document. Since the interface to Express is done via the Internet, the transition to it s use fits nicely into our NetLink pages. The interface will work just like the SouthWare interface to Express - in fact, the same NL requests are used. In order to activate it, you just need to go to the NL Control Record and add an Element Express Credit Card Interface ID. Activating Element Express Interface In order to start using the Element Express interface in NetLink, first setup an Element Express credit card interface ID to be used by NetLink users. Then, simply enter that credit card interface ID in the NL control record (NL-01-01) in field 8 (Element CC ID). 9 P a g e

13 Dual-Use NetLink Pages SouthWare will continue to support the PCCharge technology in NetLink pages for some time, so it s necessary to code for both methods in the NL pages we distribute. In order to do this, a DD field has been defined to show whether Element is used or not. The new DD field is XX99, field 220 (Use Credit Card Inf.). The values for this field are: Y = Use Credit Card Interface (PCCharge mode) N = Don t use Credit Card Interface E = Use Credit Card Interface (Element Express mode) The three processes we have implemented Element Express into use this field as part of conditional logic to determine which interface to offer the user. The NetLink User Interface The Netlink user interface for all 3 implementations look similar to the image below. The user chooses to make a payment via credit card and this window is shown. Users may choose from a credit card they ve used in the past by clicking on the link towards the top of the window, or they can key in their credit card information in the area underneath. The options above are simply PASS records stored with Element and are the same as the choices shown in the bar select in SouthWare.

14 10 P a g e 2335 Buttermilk Crossing, Suite 300, Crescent Springs, KY Phone: (859) Fax: (866)

15 Communication with Element Express Though the implementation of Element Express into our NL technology is nearly identical to our implementation in the standard product, there is one big difference between NL and standard product. The standard product requires a Windows runtime to communicate with Element. Since this is typically not the case when using NL, we are utilizing a java program called ExpressProxy.jar for the communication. Each site that plans to implement the Element Express interface via NetLink will need the ability to execute a java program. This program will be loaded into the NL template directory by default, but this can be changed in the Element Express Account Record (XX , field 7). Under the Hood of the NetLink Interface This section explains how the different pieces work together to complete the Element Express NetLink interface. 11 P a g e

16 Process Flow The basic process flow is shown above. The NL Web page opens a window that calls to the WICCELEMENT request to when a credit card payment is desired. There are then 2 options within that window, a standard payment (where the user enters their credit card information into the Element Express iframe) or a PASS payment (where the user clicks on a hyperlink with their previous card information stored on Element s system. If the standard payment is chosen, the user will enter the information into the Element Express iframe (embedded nicely in our window) and press the Process Transaction button. Element Express will then process the transaction and return the results to WICCELEMENT2. WICCELEMENT2 will actually call back to WICCELEMNT to record the information in SouthWare and take back over the process flow. Once SouthWare is updated, the window is closed and the user is returned to the original NL web page. If a PASS payment is chosen, the use will be directed to RSBILCCD2 where they can confirm this is what they want to do. Once they confirm, SouthWare will transmit the transaction information to Element Express and then call back to the WICCELEMENT request to record the information in SouthWare and take back over the process flow. Once SouthWare is updated, the window is closed and the user is returned to the original NL web page. Details for Process Flow 1. Starting NL Web Page What Happens The NL Web Pages SouthWare releases contain dual logic to handle the Element Express payment and the PCCharge payment. If not using Element Express, it works as it did before. If using Element Express, it is using separate code to accept payment involving opening a pop-up window and calling to WICCELEMENT. In addition, this page contains the logic to close the window and do whatever other actions are needed once the window is closed after a successful payment transaction. How to Implement This in another situation 1. Add the following references to the <head> section of the web page if they are not already: <script type="text/javascript" src="codebase/dhtmlxwindows.js"></script> <link rel="stylesheet" type="text/css" href="codebase/dhtmlxwindows.css"> <link rel="stylesheet" type="text/css" href="codebase/skins/dhtmlxwindows_dhx_blue.css"> 2. Add DoPay() function. This function should open a window and callout to WICCELEMENT with the following parameters: - session_no - ele_pay_mode 12 P a g e

17 - ele_amount - ele_cust_no - ele_sls_ord_no - ele_trx_oper An example of a DoPay() function is later in this document under Code Samples. 3. Add ClosePayment() function. This function will be called from WICCELEMENT to close the payment window and do whatever other steps should be done at that time. (ClosePayment2(url) is called for the shopping cart to accommodate navigation to a new url). An example of a ClosePayment() function is later in this document under Code Samples. 4. Add conditional logic in the page to hide accepting of PCCharge information and to show the new Element Express logic. This should be done using XX99 field 220 like: --> A good approach for providing the variables needed for the DoPay() function is to use a form with hidden input fields and values. Then, you can refer to a field via the DOM (for example: document.otherpayform.card_amt.value would be the value of the card_amt field of the otherpayform form. 2. WICCELEMENT Request What Happens This request is loaded using the variables passed in the URL from the DoPay() function in the calling page. This allows it to automatically load PASS record options for the customer (if there is any) using a RM report. There is then javascript to show applicable information about the PASS records. Also before the page is loaded, a SouthWare subroutine (NLBILCCD) is called to get a TransactionSetupID from Element. This ID is used as part of the Element Express URL in an iframe at the bottom of the window. If a PASS record is chosen, RSBILCCD2 is called. Otherwise, Element Express processes the transaction and will call WICCELEMENT2. How to Implement This in another situation 1. Choose a new pay_mode and add it to the switch statement in the sendpayment() function to define the request ID and command (if applicable) that should be used to update SouthWare after the transaction is complete. This pay_mode should be used in the calling NL Web Page in the DoPay() function. Note that a NL subroutine change is usually required as well. 2. Add logic to the switch statement at the top of the page to define the text displayed on the page for this function. 3. WICCELEMENT2 Request What Happens Element Express has processed the transaction and afterwards it calls back into this request. This request is here for the sole purpose of communicating the response from Element Express back to WICCELEMENT. If successful, it will call the sendpayment() function of WICCELEMENT. If unsuccessful, it will close the payment window and display the message returned from Element Express. How to Implement This in another situation No steps needed. 4. RSBILCCD2 Request What Happens The user has chosen to use a PASS record (a credit card stored on file) to process. This page 13 P a g e

18 shows the information from the PASS record and gives the user an opportunity to cancel the transaction or continue. Once the Process Transaction button is pressed, the sendpass() function is called, which will call the subroutine (ajax call) setup in the original calling web page (#1) with the PASS ID, amount, etc. This subroutine is responsible for processing the PASS transaction and updating SouthWare properly. After the subroutine ajax call, if successful, the closepayment() routine will be called (from the original web page). If it is not, an error message will show and the payment window will be closed. How to Implement This in another situation 1. Add new pay_mode to the switch statement in the sendpass() function. 5. Subroutine to Update SW Request What Happens The request is called to update SouthWare (and also process the PASS request). Examples are wiolnlarpsub, wioenloesub, and vfypay. These requests will update the SouthWare files to correctly reflect the payment. The request was either called from WICCELEMENT (via WICCELEMENT2) or from RSBILCCD2. How to Implement This in another situation There should be a request and subroutine to handle this job. Code Samples function DoPay() { //display window to accept payment type info, which submits payment amount, and refreshes page dhxwins1 = new dhtmlxwindows(); DoPaywin = dhxwins1.createwindow("dopay", 400,1,400,450); paytext="make Payment"; DoPaywin.setText(payText); var amount = document.otherpayform.card_amt.value; var PAYurl = " ccelement&ele_pay_ mode=oep- ORDCARD&ele_amount="+amount+"&@cust_no=@var_cust_no_@&ele_cust_no =@var_cu st_no_@&ele_trx_oper=@var_dd_xx990255_@&ele_sls_ord_no=@var_dd_rs _@"; DoPaywin.attachURL(PAYurl); } ** Notes on DoPay(): The name of the window MUST be dopay in the 2 nd line.

19 function closepayment() { //closes amount window & refreshes main screen dhxwins1.window("dopay").close(); parent.refreshpayment(); 14 P a g e View Demonstration of payments ID: ELEMNT