CyberSource Global Payment Management Magento 2.x Implementation Guide Version 1.1.0 August 2017 Extract Use this guide to install and configure the CyberSource extension for Magento 2.x.
Contents Recent Changes... 4 1. Introduction:... 4 Payment Tokenization with Secure Acceptance... 4 Credit Card Services... 4 Decision Manager... 5 Payer Authentication (3-D Secure)... 5 PayPal Express Checkout... 5 2. CyberSource Business Center... 7 2.1. Profile Configuration... 7 2.1.1. Create New Profile... 8 2.1.2. General Settings... 9 2.1.3. Payment Settings... 11 2.1.4. Security... 12 2.1.5. Payment Form... 13 2.1.6. Notifications... 13 2.1.7. Customer Response Pages... 15 2.1.8. Create a Report Download User... 16 2.2. Decision Manager... 17 2.2.1 Orders... 18 2.2.2 Refunds... 18 2.2.3 Custom Fields... 18 3. Backend Configuration Settings... 20 3.1. General Setting... 20 3.2. SOAP Web Services Settings... 22 3.4. Echeck... 22 3.4. Tax... 27 3.4.1 Enable Customer VAT for Checkout... 30 2 CyberSource Global Payment Management for Magento 2.x August, 2017
3.5. Secure Acceptance... 32 3.6. PayPal Express Checkout... 34 3.7. Secure Acceptance Silent Order Post (SOP)... 35 3.8. Shipping Address Verification Service... 36 3.9. Device Fingerprint... 36 3.10. Bank Transfers... 37 Online banking services enable customers to pay for goods using direct online bank transfers from their bank account to your merchant account.... 37 3.10.1 Bancontact... 37 3.10.2 Sofort... 38 3.10.3 ideal... 38 3.11. Transactional Emails... 39 3.12. Cron Settings... 39 4. Frontend Use... 41 4.1. Using Iframe Mode... 41 4.2. Using Redirect Mode... 42 4.3. Tokens... 42 4.3.1. Managing Tokens... 42 5. Administration Use... 44 5.1 Capturing Funds for Authorized Transactions... 44 5.2. Canceling Authorized Transactions... 46 5.3. Refunding a Captured Order... 46 5.4. Creating an order in the Admin... 48 6. CyberSource Documentation... 49 August, 2017 CyberSource Global Payment Management for Magento 2.x 3
Recent Changes Version Release Changes 1.0.0 March 2017 Initial Release 1.1.0 August 2017 Added support for Secure Acceptance SOP, Electronic Checks, Online Bank Transfers (Bancontact, Sofort, ideal), Tax Calculation, and Delivery Address Verification 1. Introduction: The purpose of this manual is to guide a user through the configuration settings and use of the CyberSource Global Payment Management Extension for the Magento 2.x ecommerce platform. Where appropriate, this manual will reference documentation produced by CyberSource. The CyberSource Global Payment Management Extension for Magento 2 includes the following CyberSource payment management capabilities: Payment Tokenization with Secure Acceptance The CyberSource extension for Magento uses Secure Acceptance to securely collect sensitive card data from the consumer s browser. Secure Acceptance prevents sensitive payment data from ever touching your systems to reduce your overall PCI scope, potentially allowing merchants to qualify for the SAQ A or SAQ A-EP. The extension also incorporates CyberSource Tokenization, which replaces sensitive payment transaction data with a unique identifier that cannot be reverse-engineered. The unique identifier is called a payment token (also known as a Profile ID or Subscription ID), which is stored in Magento and takes the place of sensitive cardholder information, allowing your operations to run without sensitive card data in your environment. Credit Card Services The CyberSource Magento extension includes the following credit card services: Authorization Sale (Authorization + Capture) Authorization Reversal 4 CyberSource Global Payment Management for Magento 2.x August, 2017
Capture Credit Void Decision Manager Decision Manager is a fraud management platform that prevents fraud losses and gives you the flexibility to control business practices and policies in real time. With Decision Manager, you can accurately identify and review potentially risky transactions while minimizing the rejection of valid orders. The CyberSource Magento extension includes: Real-time fraud screening performed during Authorization Device Fingerprinting On-Demand Conversion Detail Report for changes in order status Payer Authentication (3-D Secure) CyberSource Payer Authentication services enable you to add support to your web store for card authentication services offered by Visa, MasterCard, and other card brands. These programs verify the cardholder's identity directly with the card issuing bank in real-time to increase payment security and reduce the risk of fraud; however, Payer Authentication is not a fraud management service, and CyberSource recommends that you implement a comprehensive fraud management program such as Decision Manager in addition to Payer Authentication services. The CyberSource Magento extension includes the following Payer Authentication services: Verified by Visa MasterCard Secure Code American Express SafeKey PayPal Express Checkout The CyberSource Extension for Magento includes the PayPal Express Checkout payment method. Processing your PayPal transactions through CyberSource allows you to consolidate all payment types under a single gateway account, simplify integration efforts, screen PayPal transactions for fraud with Decision Manager, and streamline reporting. The CyberSource Magento extension supports the following PayPal services: Set Get Details August, 2017 CyberSource Global Payment Management for Magento 2.x 5
Order Setup Authorization Authorization Reversal Capture Sale Refund Electronic Check (echeck) Electronic checks, also known as e-checks, is a form of digital payment that serves the same function as a physical check. When a merchant accepts an electronic check payment, the those funds are pulled directly from the customer s checking or savings account. The CyberSource Magento extension supports the following e-check services: Debit Credit Online Bank Transfers Online banking services enable customers to pay for goods using direct online bank transfers from their bank account to your merchant account. The CyberSource Magento extension supports the following payment methods and corresponding online bank transfer services: Bancontact o Sale o Check Status o Refund Sofort o Sale o Check Status o Refund ideal o Options o Sale o Check Status o Refund 6 CyberSource Global Payment Management for Magento 2.x August, 2017
Tax Calculation The tax calculation service provides real-time tax calculation at the time of checkout for orders placed worldwide with your business. The CyberSource Magento extension supports the Tax calculation service. Delivery Address Verification The Delivery Address Verification service verifies typed addresses and corrects invalid city/state/zip combinations in real-time. The CyberSource Magento extension supports the Delivery Address Verification service. 2. CyberSource Business Center Before configuring Magento, the CyberSource Enterprise Business Center needs to be configured. Customer payments are managed by both Magento and the CyberSource Enterprise Business Center (EBC). This section covers the mandatory settings that must be configured in the EBC, as well as some general use cases that will be typical in the day to day management of your Magento store. 2.1. Profile Configuration To start profile configuration, visit the CyberSource Business Center by following one of these URL s. Testing URL : https://ebctest.cybersource.com/ebctest/login/login.do Production URL : https://ebc.cybersource.com/ebc/login/login.do In the left navigation panel, choose Tools & Settings > Secure Acceptance Once on that panel, choose the button in the lower right labeled Create New Profile. August, 2017 CyberSource Global Payment Management for Magento 2.x 7
Figure 1 CyberSource Business Center Secure Acceptance - Profiles Configuration 2.1.1. Create New Profile A Magento instance can have many Secure Acceptance Profiles but you need at least one. The Profile will hold settings related to the cards you accept, the currency and other settings including the profile ID, and security access keys needed by Magento to communicate with CyberSource. Figure 2 below shows the profile creation screen. Secure Acceptance is offered in two different modes. Web/Mobile is a hosted pay page or redirect method. If your CyberSource Merchant Account is configured for Web/Mobile, use this option. Silent Order POST (SOP) is an alternate method for Secure Acceptance. It ensures that card data is sent directly from customers browser to CyberSource. The customer never leaves your site, and your site never receives any card data which reduces PCI DSS scope. If your CyberSource Merchant Account is configured for Silent Order Post, use this option. Ensure you also select all checkboxes in the Added Value Services section. Ensure you select the Web/Mobile Integration Method and you select all relevant checkboxes in the Added Value Services section. Note that Payment Tokenization is required for using this extension, and Decision Manager is optional. 8 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 2 CyberSource Business Center - Create New Profile 2.1.2. General Settings After you have saved the profile, you can begin configuring it. The first step is General Settings. Please make note of the Profile ID. This is a key setting needed for Magento. See section 3.3. August, 2017 CyberSource Global Payment Management for Magento 2.x 9
Figure 3 CyberSource Business Center Secure Acceptance Profiles Configuration - General Settings 10 CyberSource Global Payment Management for Magento 2.x August, 2017
2.1.3. Payment Settings In this section, you can specify which card types are allowed for the payment method. You can also select currency, CVN Display, CVN Required and Payer Authentication options. Please reference the following link for more information about Payer Authentication: http://apps.cybersource.com/library/documentation/dev_guides/payer_authentication_so_api/ Payer_Authentication_SO_API.pdf Figure 4 CyberSource Business Center Secure Acceptance Profiles Configuration - Payment Method Configuration If you select Enable PayPal Express Checkout it will expand (see figure 5), be sure to choose Authorization: Request a PayPal order setup and include the order setup reply values in the response. August, 2017 CyberSource Global Payment Management for Magento 2.x 11
2.1.4. Security Figure 5 PayPal Express console expanded showing additional options In the Security panel you will create a Security Access and a Secret Key needed to complete the setup of the Magento 2 Module. See section 3.3 Figure 6 CyberSource Business Center Secure Acceptance Profiles Configuration - Security Settings 12 CyberSource Global Payment Management for Magento 2.x August, 2017
2.1.5. Payment Form If using Secure Acceptance Web/Mobile, when a customer is either redirected to the hosted payment page at CyberSource or if they see the modal popup window during checkout, they will see a payment form that has been configured with the settings below. These settings are not applicable for the Secure Acceptance Silent Order POST configuration. Figure 7 CyberSource Business Center Secure Acceptance Profiles Configuration - Payment Form Settings These settings have no effect on the integration with Magento and can be configured to your specific needs. 2.1.6. Notifications On this configuration panel you must choose the Merchant POST URL tick box and also supply a valid URL. August, 2017 CyberSource Global Payment Management for Magento 2.x 13
Figure 8 CyberSource Business Center Secure Acceptance Profiles Configuration - Notifications Settings The Merchant POST URL is your base url + /CyberSource/index/receipt. For example if your website URL is http://www.example.com/ then the Merchant POST URL would be http://www.example.com/cybersource/index/receipt. When you configure a Merchant POST URL you will also see additional settings for the card digits displayed. If you are using Tokenization, then either the second or the third radio button depending on your preferred customer facing display format. 14 CyberSource Global Payment Management for Magento 2.x August, 2017
2.1.7. Customer Response Pages Response pages are URL s that customers get directed to when a transaction is completed or has been cancelled. Figure 9 CyberSource Business Center Secure Acceptance Profiles Configuration - Customer Response Pages Configuration Your Transaction Response page URL is your base url + /CyberSource/index/receipt. For example if your website URL is http://www.example.com/ then the Transaction Response URL would be http://www.example.com/cybersource/index/receipt. Your Custom Cancel Response Page URL is your base url + /CyberSource/index/cancel. August, 2017 CyberSource Global Payment Management for Magento 2.x 15
For example if your website URL is http://www.example.com/ then the Transaction Response URL would be http://www.example.com/cybersource/index/cancel. The Customer Redirect after Check- URL is your base url + /CyberSource/index/receipt. For example if your website URL is http://www.example.com/ then the Customer Redirect after Check-out URL would be http://www.example.com/cybersource/index/receipt. 2.1.8. Create a Report Download User The CyberSource Module for Magento makes use of a reporting API that allows Magento to query CyberSource for information about transactions. To activate this, you must create a separate CyberSource Business Center user with the role of Report Download Figure 10 CyberSource Business Center Main Navigation - User Administration 16 CyberSource Global Payment Management for Magento 2.x August, 2017
Navigate to the Account Management -> User Administration section of the main navigation. The screen will show a listing of active users. Click the Add User button. The next screen will look like this: Figure 11 Add New CyberSource Business Center User Screen Fill out the form and select Report Download User Role. Once you complete the Add User form, an email will be sent to the address used on the form. The email will contain a link and a onetime token used to validate the email account. Once the token is entered, you will be asked to reset the password. This password is needed in section 3.2 for the Report Password. 2.2. Decision Manager Decision Manager is an advanced fraud prevention tool that provides an extra layer of transaction scrutiny. Transactions processed by Decision Manager are applied to a series of preconfigured rules that are used to identify common features of a fraudulent transaction. For example, if the billing and Shipping addresses are in different countries, you might consider that to be an unusual transaction. You could configure Decision Manager to automatically reject, August, 2017 CyberSource Global Payment Management for Magento 2.x 17
hold or accept such a transaction. Transactions that are held cannot be fulfilled in Magento. Instead, an order status is set that prevents the order from being shipped. You must visit the Business Center and manually review the transaction and decide to accept it or reject it. Whatever decision is made, orders will be automatically updated in Magento if their state changes in the Business Center. To fully configure Decision Manager it is best to follow the CyberSource Decision Manager User Guide which can be found in the Business Center. To download the Decision Manager User guide, login to Business Center and on the left hand side, navigate to Documentation. Select Decision Manager and search for Decision Manager User Guide which is the 5th item from the top. For the purposes of configuring Magento to work with Decision Manager, the following sections outline some brief topics that help describe how Magento and Decision Manger will work together. 2.2.1 Orders When you change an order in Decision Manager Case Management from REVIEW to REJECT or ACCEPT, Magento will not immediately learn of this change. Magento will learn of any changes to payment transaction states periodically by contacting CyberSource and querying for changes. Section 3.6 describes how you configure Magento Cron settings that will trigger a Magento task that will look for Decision Manager changes and update Magento Orders accordingly. If a change in state is detected, Magento will update the order status in Magento from Pending Review to one of these states: Processing, Pending Payment or Closed. Please note that if an order is Pending Review in Decision Manager, you cannot prepare an invoice in Magento until it is accepted in Decision Manager. 2.2.2 Refunds Please note the order must be either Accepted or Rejected in Decision Manager before you are able to issue a refund. Rejecting an order in Decision Manager will automatically refund the order as part of the Cron process that queries CyberSource for updates in Decision Manager. 2.2.3 Custom Fields Decision Manager bases decisions about each transaction based on data. Much of this data is entered by customers as they complete the payment form. However, there are up to 100 additional fields that can be submitted in a transaction and used to create Decision Manager rules. The CyberSource Module for Magento 2 will send several additional fields but they must be configured inside Decision Manager. Once they are configured, you must also configure rules to make use of them. To configure rules, please refer to the CyberSource Decision Manager User Guide referenced in section 2.2 of this manual. 18 CyberSource Global Payment Management for Magento 2.x August, 2017
To add the additional custom fields provided by Magento 2, Login to the business center, on the left hand side navigate to Decision Manager > Configuration > Custom Fields. Use the tables below to configure the fields. Figure 12 - CyberSource Business Center Decision Manager Custom Fields Configuration To add a field, select Add Custom Field, select the Order Element and input the name. Follow the table below to map the correct element and name. Field Name Logged in customer Account creation date Purchase History Count Last Order Date Member account age Repeat customer Coupon Code Used Discount Amount Gift Message Order Source Order Element merchant_defined_data1 merchant_defined_data2 merchant_defined_data3 merchant_defined_data4 merchant_defined_data5 merchant_defined_data6 merchant_defined_data20 merchant_defined_data21 merchant_defined_data22 merchant_defined_data23 August, 2017 CyberSource Global Payment Management for Magento 2.x 19
3. Backend Configuration Settings Once logged into the administration section of your Magento 2 website, the configuration panel is found by navigating to the following screen: Stores->Configuration->Sales->Payment Methods Once on that screen you will see the settings for the CyberSource module. Inside this panel are four sub panels: 3.1. General Setting Figure 13 Main CyberSource configuration panel with 4 sub panels Figure 14 General Settings 20 CyberSource Global Payment Management for Magento 2.x August, 2017
Setting Enabled Title DM fail email sender DM fail email template Secure Acceptance Type Credit Card Types Report Server URL Service URL Service URL for tests New Order Status Decision Manager Review Status Payment from Applicable Countries Payment from Specific Countries Test Mode Debug Mode Sort Order Notes This setting activates or deactivates the module This text is displayed to customers as the name of this particular payment method If the order is rejected by Decision Manager, the customer will be notified. Select the admin sender contact here If the order is rejected by Decision Manager, the customer will be notified. Select the email template to be used here CyberSource Secure Acceptance Web/Mobile lets you securely accept payments made on the web or on mobile browsers, worldwide, without handling payment data (process involves a redirect to CyberSource). The Silent Order POST integration method securely passes or posts payment data from the customer directly to the CyberSource system (the process does not involve a redirect to CyberSource) Select which card types you would like to accept https://ebctest.cybersource.com/ebctest https://secureacceptance.cybersource.com https://testsecureacceptance.cybersource.com When an order is placed using this payment method, this setting sets the status of the order once checkout is complete When an order is placed using this payment method and it is flagged by the Decision Manger for REVIEW, this setting sets the status of the order once checkout is complete If set to All Allowed, Magento 2 global settings for allowed countries is used to determine if the customers billing Country is allowed to use this payment method. If set to Specific Countries the next setting is used to configure allowed countries for this module This is a multi select box allowing the store owner to specify countries that will be allowed to use this payment method If yes, CyberSource Test environments are used when processing transactions. If no, all transactions use production environments If Yes, diagnostic information is stored in log files on the Magento web server. If No, no information is logged Change the default module sort order here August, 2017 CyberSource Global Payment Management for Magento 2.x 21
3.2. SOAP Web Services Settings Figure 15 SOAP API Web Service Settings Setting Notes Use CVV on Token Purchases? If yes, customers will have to provide CVV on stored cards for additional security Auth Indicator See page 233 of CyberSource Credit Card Services pdf Report URL https://ebctest.cybersource.com/ebctest/conversiondetailre portrequest.do Report Password See Section 2.1.8 Merchant ID Your CyberSource merchant identifier Report Username See Section 2.1.8 Transaction Key See section 2.1.4 Use Test WSDL Yes/No Path to WSDL https://ics2wsa.ic3.com/commerce/1.x/transactionprocessor/c ybersourcetransaction_1.130.wsdl Path to test WSDL https://ics2wsa.ic3.com/commerce/1.x/transactionprocessor/c ybersourcetransaction_1.130.wsdl 3.4. Echeck 22 CyberSource Global Payment Management for Magento 2.x August, 2017
August, 2017 CyberSource Global Payment Management for Magento 2.x 23
Figure 16 CyberSource E-Check Settings Setting Enabled Notes This setting activates or deactivates the module 24 CyberSource Global Payment Management for Magento 2.x August, 2017
Title Pending Event Type This text is displayed to customers as the name of this particular payment method Other Types of Transactions BATCH_ERROR: The batch file was rejected by the processor because of transaction errors. After the file is reset, the invalid transactions will be marked as TRXN ERROR. BATCH_RESET: Either the complete batch or specific transactions were reset after the problems with the merchant, connections, or processor were resolved. CANCELLED: The transaction 0077as cancelled. CANCELED_REVERS: The reversal was cancelled. ERROR: An error occurred in your follow-on request. FAILED: The credit card (authorization, capture, or credit) or check debit request failed. The reason is not specified. FUNDED: The direct debit reversal is complete. MIPS: The PayPal billing agreement was created or modified. PAYMENT: The payment has been received. PENDING: The authorization was captured by CyberSource, the credit request was successful, or the credit card transaction was captured, and the request was sent to the payment processor. The reply from the payment processor is pending. REFUNDED: You initiated a refund of the payment. REVERSAL: The direct debit was reversed at the request of the customer. REVERSAL FAILED: The PIN-less debit reversal request failed. REVERSED: The PIN-less debit reversal request was successful. REVERSING: The initial PIN-less debit request timed out. The subsequent reversal request is pending. TRANSMITTED: The check debit request was processed successfully. August, 2017 CyberSource Global Payment Management for Magento 2.x 25
Reject Event Type Accept Event Type Test Event Type Use test environment? Test Service URL Service URL VOIDED: The request for the credit card capture, credit card credit, check debit, or check credit was successfully deleted. The authorization has not been deleted. You can see this transaction only on the search results page and in the exported search results. Failed Events Correction: A positive or negative correction occurred to a payment or refund. Declined: The account was invalid or disabled. For details about the decline, see <ProcessorMessage>. Error: An error occurred. For details about the error, see <ProcessorMessage>. Failed: The account was invalid or disabled. For details about the failure, see <ProcessorMessage>. Final NSF: The final instance of insufficient funds occurred. First NSF: The bank will attempt to re-deposit the funds. NSF: The bank returned the check because of insufficient funds. Other: The processor reported an unanticipated event. Second NSF: The bank will attempt to redeposit the funds for the second time. Stop Payment: The customer stopped the payment. Void: The check was successfully voided. Successful Events Submitted: Indicates a transaction with an effective date has been submitted. Payment: Payment has been received. The value is always positive. Refund: A refund (credit) occurred. The value is always negative. Completed: The transaction was completed. If yes, CyberSource Test environments are used when processing transactions. If no, all transactions use production environments. https://ebctest.cybersource.com/ebctest/query https://ebc.cybersource.com/ebc/query 26 CyberSource Global Payment Management for Magento 2.x August, 2017
Merchant password Merchant Username Payment from Applicable Countries Payment from Specific Countries Report check period, days Sort Order Password for Report Download user CyberSource Business Center Username with Report Download permissions If set to All Allowed, Magento 2 global settings for allowed countries is used to determine if the customers billing Country is allowed to use this payment method. If set to Specific Countries the next setting is used to configure allowed countries for this module This is a multi select box allowing the store owner to specify countries that will be allowed to use this payment method. The report is generated daily Monday through Friday unless CyberSource does not receive a data file from the processor, receives the data file after the cut-off time, or receives an empty data file. Because the report is not generated on weekends, the report that you download on Mondays contains all your weekend transactions. Make sure your implementation can handle reports that contain transactions spanning multiple processing days. Change the default module sort order here. 3.4. Tax August, 2017 CyberSource Global Payment Management for Magento 2.x 27
Figure 17 CyberSource Tax Settings 28 CyberSource Global Payment Management for Magento 2.x August, 2017
Setting Tax Calculation Nexus Regions Customer countries to calculate Tax for Ship from City Ship from Postcode Ship from Country Ship from Region Acceptance City Acceptance Postcode Acceptance Country Acceptance Region Origin City Origin Postcode Origin Country Origin Region Merchant VAT Notes This setting activates or deactivates the module You can specify which region(s) your business has nexus in by using this field. All the allowed countries to provide tax for The city the product will be shipping from The postal code the product will be shipping from The country the product will be shipping from The state or province the product will be shipping from The city of the place where you accept/approve the customer s order The postal code of the place where you accept/approve the customer s order The country of the place where you accept/approve the customer s order The state or province of the place where you accept/approve the customer s order The city where you receive the customer s order The postal code where you receive the customer s order The country where you receive the customer s order The state or province where you receive the customer s order Your business Value-Added Tax (VAT) number CyberSource Terminology: http://apps.cybersource.com/library/documentation/dev_guides/tax_so_api/html/wwhelp/wwhi mpl/js/html/wwhelp.htm#href=intro.4.1.html#1097715 August, 2017 CyberSource Global Payment Management for Magento 2.x 29
3.4.1 Enable Customer VAT for Checkout Store -> Configuration -> Customers -> Customer Configuration -> Name and Address Options -> Show Tax/VAT Number Figure 7 Store > Configuration > Customers > Customer Configuration 30 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 8: Name and Address Options > Show Tax/VAT Number field Setting Show Tax/VAT Number Notes No Buyer Registration number will not be asked for on checkout Optional Buyer Registration number field will be shown on checkout but not required. Required Buyer Registration number field will be shown on checkout and required to place the order. August, 2017 CyberSource Global Payment Management for Magento 2.x 31
3.5. Secure Acceptance Figure 20 Secure Acceptance Web / Mobile Settings Setting Enabled Use iframe Notes This setting activates or deactivates the module If yes, customers will see the credit card form inside an iframe on the merchant website. If this setting is set to no, the user will be redirected to a CyberSource hosted payment page. 32 CyberSource Global Payment Management for Magento 2.x August, 2017
Access Key Profile ID Secret Key Title Ignore AVS Ignore CVN Test Mode Debug Mode Decision Manager Review Status New Order Status Payment Action Payment from Applicable Countries See chapter 2 of Secure_Acceptance_WM.pdf This is found inside the CyberSource Business Center. See chapter 2 of Secure_Acceptance_WM.pdf See chapter 2 of Secure_Acceptance_WM.pdf This text is displayed to customers as the name of this particular payment method Setting this to Yes should result in passing the AVS parameter in the Secure Acceptance request Setting this to Yes should result in passing the CVN parameter in the Secure Acceptance request If yes, CyberSource Test environments are used when processing transactions. If no, all transactions use production environments. If Yes, diagnostic information is stored in log files on the Magento web server. If No, no log statements are executed. When an order is placed using this payment method and it is flagged by Decision Manger, this setting sets the status of the order once checkout is complete. When an order is placed using this payment method, this setting sets the status of the order once checkout is complete. Authorize Only will check the card for validity but not charge the account until the order is approved and invoiced. Authorize and Capture will charge the debit/credit card at the time of the order submission. If set to All Allowed, Magento 2 global settings for allowed countries is used to determine if the customers billing Country is allowed to use this payment method. If set to Specific Countries the August, 2017 CyberSource Global Payment Management for Magento 2.x 33
Payment from Specific Countries next setting is used to configure allowed countries for this module This is a multi select box allowing the store owner to specify countries that will be allowed to use this payment method. 3.6. PayPal Express Checkout Figure 21 PayPal Express Checkout Settings Setting Enabled Merchant ID Title Test Mode Notes This setting activates or deactivates the module Your PayPal Merchant ID This text is displayed to customers as the name of this particular payment method By using test mode, you can test and debug your application without referencing any real PayPal users or their 34 CyberSource Global Payment Management for Magento 2.x August, 2017
New Order Status PayPal Redirection Type Payment Action Payment from Applicable Countries Payment from Specific Countries live PayPal accounts. The Test Mode lets you operate your application in a safe environment and provides you a way to fine-tune your PayPal routines before moving your product into production. When an order is placed using this payment method, this setting sets the status of the order once checkout is complete. Traditional Express Checkout: Customer will be redirect to PayPal Payment Page. In-Context Express Checkout: A PayPal popup will appear to customer complete payment. Authorize Only will check the card for validity but not charge the account until the order is approved and invoiced. Authorize and Capture will charge the debit/credit card at the time of the order submission. If set to All Allowed, Magento 2 global settings for allowed countries is used to determine if the customers billing Country is allowed to use this payment method. If set to Specific Countries the next setting is used to configure allowed countries for this module This is a multi-select box allowing the store owner to specify countries that will be allowed to use this payment method 3.7. Secure Acceptance Silent Order Post (SOP) August, 2017 CyberSource Global Payment Management for Magento 2.x 35
Figure 22 CyberSource SOP Settings Setting Profile ID Access Key Secret Key Service URL Service URL for test Notes https://www.cybersource.com/products/payment_security/ secure_acceptance_silent_order_post/ See Creating a Security Key here See Creating a Security Key here https://secureacceptance.cybersource.com https://testsecureacceptance.cybersource.com 3.8. Shipping Address Verification Service Figure 23 CyberSource Shipping Address Verification Settings Setting Address Verification Address force normalization Notes This setting activates of deactivates the module Addresses processed by this system may return a suggested alternative address that will reduce misrouting of shipments. This setting will make suggested alternatives optional or mandatory. 3.9. Device Fingerprint Figure 24 CyberSource Device Fingerprint Settings Setting Active Notes This setting activates or deactivates Device Fingerprinting for Secure Acceptance Silent Order POST. 36 CyberSource Global Payment Management for Magento 2.x August, 2017
Org ID Obtain the Org ID from CyberSource and enter it here. There is an Org ID for the Test environment and another one for Production. 3.10. Bank Transfers Figure 25 CyberSource Device Fingerprint Settings Online banking services enable customers to pay for goods using direct online bank transfers from their bank account to your merchant account.3.10.1 Bancontact Bancontact is an ecommerce payment system which is offered in Belgium. It is based on online banking which enables customers to pay for goods using direct online bank transfers from their bank account to the merchant account. Figure 26 CyberSource Device Fingerprint Settings Setting Enabled Notes This setting activates or deactivates the module August, 2017 CyberSource Global Payment Management for Magento 2.x 37
Title This text is displayed to customers as the name of this particular payment method Merchant ID Assigned to you by CyberSource when you setup your account Transaction Key See section 2.1.4 Sort Order Change the default module sort order here 3.10.2 Sofort Sofort is the name of both the payment processor and the ecommerce payment system which is offered in many European regions. It is based on online banking that enables customers to pay for goods using direct online bank transfers from their bank account to your merchant account. Figure 27 CyberSource Device Fingerprint Settings Setting Notes Enabled This setting activates or deactivates the module Title This text is displayed to customers as the name of this particular payment method Merchant ID Assigned to you by CyberSource when you setup your account Transaction Key See section 2.1.4 Sort Order Change the default module sort order here 3.10.3 ideal ideal is an e-commerce payment system in the Netherlands which enables customers to pay for goods using direct online bank transfers from their bank account to the merchant account. 38 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 28 CyberSource Device Fingerprint Settings Setting Notes Enabled This setting activates or deactivates the module Title This text is displayed to customers as the name of this particular payment method Merchant ID Assigned to you by CyberSource when you setup your account Transaction Key See section 2.1.4 Sort Order Change the default module sort order here 3.11. Transactional Emails Marketing > Email Templates > DM Fail Transaction This email is for orders that have been rejected by Decision Manager. The customer will receive a notification that their order has been cancelled. 3.12. Cron Settings System > Configuration > Advanced > System Cron (Scheduled Tasks) > Cron configuration options for group: dm Please note all the values below are in minutes. The only option you should edit is the first option, Generate Schedules Every. This is the Cron frequency. A suitable time is every 5 minutes. August, 2017 CyberSource Global Payment Management for Magento 2.x 39
Figure 29 Magento 2 Cron Panel 40 CyberSource Global Payment Management for Magento 2.x August, 2017
4. Frontend Use The Secure Acceptance Web/Mobile payment method can be configured in two ways. Using the Iframe mode is a way to accept payments using a hosted payment page in a way that does not require the customer to leave the checkout page. Alternatively, the module can be configured as a traditional redirect method where the customer is redirected to a hosted CyberSource webpage containing the same payment webform. 4.1. Using Iframe Mode When the module is configured for Iframe mode, the payment screen looks like figure 28. The advantage of using this mode is that the customer never leaves the merchants website. August, 2017 CyberSource Global Payment Management for Magento 2.x 41
4.2. Using Redirect Mode Figure 30 Checkout Payment Form in Iframe Checkout Mode When the module is configured for Redirect mode, the customer is redirected to a completely different URL to complete the payment step. Once the customer has completed payment, they are redirected back to the merchants website. 4.3. Tokens When a logged in customer uses the checkout on your site, their card data is stored in a secured CyberSource datacenter. Once saved, a lookup value called a Token is provided to the merchant through this module and is stored against the Customer record. When a returning customer uses your checkout, they can opt to use a previously used card and thereby avoid having to rekey their card data. When a token is used, the customer is still redirected either through an Iframe or through a full browser redirect action to the CyberSource Hosted Payment page for payment confirmation. When a customer elects to checkout as a guest, the token system is not used. 4.3.1. Managing Tokens Logged in customers are able to create, update and remove tokens at any time. To do so, they would visit the My Account section of Magento and select the Manage Cards menu item. 42 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 31 Managing Tokens Use the Update and Delete links beside any stored tokens to alter or remove previously stored tokens. You can also use the Create new token button to add an additional card. August, 2017 CyberSource Global Payment Management for Magento 2.x 43
5. Administration Use The Secure Acceptance Web/Mobile and Silent Order POST payment methods can be configured with two different payment modes. 1. Authorize transactions performed on the site while in this mode are Authorized only. This only reserves funds and guarantees that later, the merchant can Capture funds up to the reserved amount. Capturing funds is done by preparing a Magento Invoice. 2. Authorize and Capture transactions performed in this mode are both Authorized and Captured at the same time. 5.1 Capturing Funds for Authorized Transactions While in Authorize mode (see section 2), the system will create an Order record, but it will not create an invoice. The status of created orders will be Pending Payment. Figure 32 Magento Order Grid showing Pending Payment Transaction In Magento, Capturing funds for Authorized transactions is done implicitly when you prepare an invoice. To prepare an invoice, open a Payment Pending order and Click the Invoice button. 44 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 33: Admin view of payment pending order featuring the Invoice Button When preparing an invoice make note of the section Items to Invoice. Each line item listed can be individually or partially invoiced by altering the Qty to Invoice column. This is how multiple invoices can be prepared for each order. Figure 34 Items to Invoice Section August, 2017 CyberSource Global Payment Management for Magento 2.x 45
To complete invoice creation and capture funds click the Submit Invoice button. Figure 35 Submit Invoice Button 5.2. Canceling Authorized Transactions To cancel an order that has been Authorized but not Captured (an invoice has not yet been created for the order), open the order and select the Cancel button on the order. Figure 36 Cancel Order Button 5.3. Refunding a Captured Order To refund an order that has been captured, a Credit Memo must be created. Please note that there are two types of Credit Memos; Offline Refunds and Online Refunds. Offline refunds can be created from the main Order record but no funds will be returned to the customer. You will need to refund the money using another method outside Magento. To refund customers in a way that triggers an automatic reversal of funds to the customer s card, you must prepare a credit memo from the invoice record. 46 CyberSource Global Payment Management for Magento 2.x August, 2017
Figure 37 Invoice Grid Showing Invoices Created for a Particular Order Clicking View on an invoice will open the invoice and from there you can create an Online Refund by creating a Credit Memo from within the Invoice Record. Figure 38 Credit Memo Button inside Invoice Record When creating a Credit Memo, you have the opportunity to refund all or part of an invoice. To issue a partial refund, alter the numbers in the column Qty to Refund. Figure 39 Quantity to Refund Column on Items to Refund Grid August, 2017 CyberSource Global Payment Management for Magento 2.x 47
To complete the Credit Memo, click the Refund button. Figure 40 Credit Memo Summary Section with Refund Totals 5.4. Creating an order in the Admin Simply create an order as you usually would: Sales > Orders > Create New Order. To process CyberSource in the admin, ensure you select a customer that has saved tokens to their account. Figure 41 Credit Memo Summary Section with Refund Buttons Note: CyberSource PayPal is not available in the Magento Admin. 48 CyberSource Global Payment Management for Magento 2.x August, 2017
6. CyberSource Documentation The CyberSource extension utilizes services and connection methods found in the following related documentation: Secure Acceptance Web/Mobile http://apps.cybersource.com/library/documentation/dev_guides/secure_acceptance_w M/Secure_Acceptance_WM.pdf Secure Acceptance Silent Order POST http://apps.cybersource.com/library/documentation/dev_guides/secure_acceptance_so P/Secure_Acceptance_SOP.pdf SOAP Toolkit API http://apps.cybersource.com/library/documentation/dev_guides/soap_toolkits/soap_to olkits.pdf Credit Card Services: http://apps.cybersource.com/library/documentation/dev_guides/cc_svcs_so_api/credit _Cards_SO_API.pdf Decision Manager o Developer Guide: https://ebctest.cybersource.com/ebctest/documentation/resource/dm_dev_guid e_so_api/dm_developer_guide_so_api.pdf o Device Fingerprinting Guide: https://ebctest.cybersource.com/ebctest/documentation/resource/dm_device_fi ngerprint_guide/decisionmanagerdevicefingerprint.pdf o Reporting Guide: https://ebctest.cybersource.com/ebctest/documentation/resource/dm_report_g uide/dmreportingguide.pdf Payment Tokenization Services: http://apps.cybersource.com/library/documentation/dev_guides/payer_authentication_s O_API/Payer_Authentication_SO_API.pdf Payer Authentication Services: http://apps.cybersource.com/library/documentation/dev_guides/payer_authentication_s O_API/Payer_Authentication_SO_API.pdf PayPal Express Checkout Services: http://apps.cybersource.com/library/documentation/dev_guides/paypal_express_so/pay Pal_Express_SO_API.pdf Online Bank Transfer Services http://apps.cybersource.com/library/documentation/dev_guides/onlinebanktransfers_s O_API/OnlineBankTransfers_SO_API.pdf Electronic Check Services http://apps.cybersource.com/library/documentation/dev_guides/echecks_so_api/electro nic_checks_so_api.pdf Tax Calculation Service August, 2017 CyberSource Global Payment Management for Magento 2.x 49
http://apps.cybersource.com/library/documentation/dev_guides/tax_so_api/tax_so_api.pdf Delivery Address Verification Services http://apps.cybersource.com/library/documentation/dev_guides/verification_svcs_so_ap I/Verification_Svcs_SO_API.pdf 50 CyberSource Global Payment Management for Magento 2.x August, 2017