Mengintegrasikan credit card dengan asp

Pada artikel sebelumnya kami pernah membagikan Cara Mengintegrasikan PayPal Dengan ASP.NET MVC. Jika sebelumnya mengenai PayPal, di artikel ini saya akan menjelaskan mengenai Cara mengintegrasikan pembayaran menggunakan credit card ke payment system Anda. Saya akan menggunakan 2 komponen dari /n software yaitu, IBiz VitalPS Integrator dan IP*Works! 3-D Secure MPI. Pada tutorial ini saya akan menggunakan edisi ASP, Meskipun fungsi ini juga dapat dilakukan dengan menggunakan edisi NET dalam aplikasi web ASP.NET. Atau menggunakan edisi C++ untuk membuat aplikasi CGI yang bisa dijalankan di server. Selain 2 komponen yaitu IBiz VitalPS Integrator dan IP*Works! 3-D Secure MPI, kita harus membuat akun dengan Visa’s PIT test server, dan juga mendownload dan menginstall beberapa certificates.

Merchant.inc

Untuk membuatnya menjadi sederhana, kita akan membagi file-file yang dibutuhkan menjad 4 bagian terpisah yaitu, Mechant.inc, OrderPage.asp, VerifyEnrollment.asp, ProcessPARes.asp, dan PaymentPage.asp. Kita akan mulai dari Mechant.inc, yang berisi semua pengaturan kita yang akan dimasukkan ke seluruh halaman lain. Dalam file ini, baik itu IBiz VitalPS Integrator dan IP*Works! 3-D Secure MPI harus di inisialisasi dengan data merchant Anda. Dalam tutorial ini kita menggunakan data test account

'===================
  '3-D Secure MPI setup:
  '===================
  Dim o3DS
  Set o3DS = Server.CreateObject("IPWorksMPIASP.ThreeDSecure")               
   
  o3DS.MerchantBankId   = "999995"       ' Must match "BIN" in PIT profile   
  o3DS.MerchantNumber   = "999999999911" ' Must match "Merchant ID" in PIT profile
  o3DS.MerchantPassword = "12345678"     ' Must match "Password" in PIT profile
  o3DS.MerchantName     = "TEST_MERCHANT" 
  o3DS.MerchantURL      = "http://www.testmerchant.com"   
  o3DS.DirectoryServerURL = "https://dropit.3dsecure.net:7443/PIT/DS"   
  ' Client-side certificate acquired from PIT.
  ' Your IP address will be your cert subject
  
  o3DS.SSLCertStoreType       = 2 'sstPFXFile
  o3DS.SSLCertStore           = "PFX\C:\pitclient.pfx"
  o3DS.SSLCertStorePassword   = "pitpass"
  o3DS.SSLCertSubject         = "12.34.56.78"
   
  ' Add the Root and CA signing certificates: (Prepending a "+" character adds 
  ' another certificate instead of overwriting.  NOTE: These are sample 
  ' certificates. Please download the latest certs from the PIT main page.
   
  o3DS.RootCertificate = "MIICHzCCAYigAwIBAgIUBJvEyXmLs6Ub9MX9W0Nn4w2JzY4w..."
  o3DS.RootCertificate = "+" & "MIICHjCCAYegAwIBAgIVAJyspltGwoe8VGp..."
  '===============
  'IBiz VitalPS Integrator setup:
  '===============
  Dim oVPS
  Set oVPS = Server.CreateObject("IBizPayASP.CCCharge")
   
  ' This is sample merchant data.  
  oVPS.MerchantBankId         = "999995"
  oVPS.MerchantCategoryCode   = "5999"
  oVPS.MerchantLanguage       = "00"
  oVPS.MerchantName           = "TEST_MERCHANT"
  oVPS.MerchantNumber         = "999999999911" 
  oVPS.MerchantServiceNumber  = "800-1234567"
  oVPS.MerchantState          = "NC"
  oVPS.MerchantStoreNumber    = "0011" 
  oVPS.MerchantTerminalNumber = "9911" 
  oVPS.MerchantTimeZone       = "705"   
  oVPS.MerchantZip            = "27709"

'===================

'3-D Secure MPI setup:

'===================

Dim o3DS

Set o3DS = Server.CreateObject("IPWorksMPIASP.ThreeDSecure")

o3DS.MerchantBankId = "999995" ' Must match "BIN" in PIT profile

o3DS.MerchantNumber = "999999999911" ' Must match "Merchant ID" in PIT profile

o3DS.MerchantPassword = "12345678" ' Must match "Password" in PIT profile

o3DS.MerchantName = "TEST_MERCHANT"

o3DS.MerchantURL = "http://www.testmerchant.com"

o3DS.DirectoryServerURL = "https://dropit.3dsecure.net:7443/PIT/DS"

' Client-side certificate acquired from PIT.

' Your IP address will be your cert subject

o3DS.SSLCertStoreType = 2 'sstPFXFile

o3DS.SSLCertStore = "PFX\C:\pitclient.pfx"

o3DS.SSLCertStorePassword = "pitpass"

o3DS.SSLCertSubject = "12.34.56.78"

' Add the Root and CA signing certificates: (Prepending a "+" character adds

' another certificate instead of overwriting. NOTE: These are sample

' certificates. Please download the latest certs from the PIT main page.

o3DS.RootCertificate = "MIICHzCCAYigAwIBAgIUBJvEyXmLs6Ub9MX9W0Nn4w2JzY4w..."

o3DS.RootCertificate = "+" & "MIICHjCCAYegAwIBAgIVAJyspltGwoe8VGp..."

'===============

'IBiz VitalPS Integrator setup:

'===============

Dim oVPS

Set oVPS = Server.CreateObject("IBizPayASP.CCCharge")

' This is sample merchant data.

oVPS.MerchantBankId = "999995"

oVPS.MerchantCategoryCode = "5999"

oVPS.MerchantLanguage = "00"

oVPS.MerchantName = "TEST_MERCHANT"

oVPS.MerchantNumber = "999999999911"

oVPS.MerchantServiceNumber = "800-1234567"

oVPS.MerchantState = "NC"

oVPS.MerchantStoreNumber = "0011"

oVPS.MerchantTerminalNumber = "9911"

oVPS.MerchantTimeZone = "705"

oVPS.MerchantZip = "27709"

OrderPage.asp

Halaman ini adalah di mana informasi kartu kredit pelanggan akan dikumpulkan. Pedagang telah lebih dulu memulai akan menghadapi sesuatu yang jauh lebih rumit, tetapi di tutorial ini kita akan kompres ke bentuk yang sederhana. Formulir ini selanjutnya akan dikirim ke halaman VerifyEnrollment.asp kita, di mana komponen 3-D Secure MPI digunakan untuk memverifikasi identitas pemegang kartu. Sebagian besar pedagang harus membuat sedikit perubahan pada halaman order mereka ada untuk menambahkan 3-D secure support. Perbedaannya hanyalah dua halaman menengah. Harap diperhatikan bahwa data berikut ini adalah data uji, dan jumlah yang diindikasikan tanpa titik desimal.

<FORM method="post" action="VerifyEnrollment.asp">
  <INPUT type="text" name="CardNumber"   value="4012001037141112">
  <INPUT type="text" name="ExpMonth"     value="05">
  <INPUT type="text" name="ExpYear"      value="06">
  <INPUT type="text" name="CustomerName" value="John Doe">
  <INPUT type="text" name="Address"      value="8320 S. Hardy Dr.">
  <INPUT type="text" name="City"         value="Tempe">
  <INPUT type="text" name="State"        value="AZ">
  <INPUT type="text" name="ZipCode"      value="85284">
  <INPUT type="text" name="Amount"       value="5500">
  <INPUT type="submit" name="Purchase"   value="Purchase">
</FORM>

</FORM>

VerifyEnrollment.asp

Setelah pelanggan menekan tombol order, data kartu kredit akan diposting ke halaman VerifyEnrollment.asp. Hal pertama yang kita lakukan di sini adalah menyimpan informasi untuk databese order. Setelah menyimpan info, kita menggunakan komponen 3-D Secure MPI untuk memeriksa apakah kartu kredit pelanggan terdaftar dalam program Visa Verified By Visa.

<!--#include file = "merchant.inc" -->
<%
  'Save order info and returns a unique key to access data
  key = SaveOrderInfoToDatabase() 
  o3DS.MessageId = "123456" ' Must be unique for each transaction
  o3DS.CardNumber = Request.Form("CardNumber")
  o3DS.VerifyEnrollment()

'Save order info and returns a unique key to access data

key = SaveOrderInfoToDatabase()

o3DS.MessageId = "123456" ' Must be unique for each transaction

o3DS.CardNumber = Request.Form("CardNumber")

o3DS.VerifyEnrollment()

Jika terjadi kesalahan komunikasi dengan Directory Server atau kartu dinyatakan tidak terdaftar, transaksi tersebut harus dilanjutkan secara normal ke Halaman Pembayaran. Catatan bahwa ini benar-benar transparan kepada pelanggan. Jika kartu nya tidak terdaftar di Verified By Visa atau Mastercard SecureCode, transaksi di proses seperti biasa. Namun, jika kartu tersebut terdaftar maka pelanggan akan diarahkan ke situs tertentu di ACSURL property komponen 3-D Secure.

If (Err.Number <> 0 Or o3DS.CardEnrolled <> "Y") Then
    ' If there's an error, here is where you can log it.
    ' Also, redirect the cardholder to the paymentpage.
    ' Send key so trans can be retrieved
    Response.Redirect("PaymentPage.asp?" & "MD=" & key) 
 
  Else
  
     'no error and the card is enrolled:
    o3DS.MessageId         = key 'Using unique database access key
    o3DS.TransactionId     = key 'Using unique database access key
    o3DS.CardExpMonth      = Request.Form("ExpMonth")
    o3DS.CardExpYear       = Request.Form("ExpYear")
    o3DS.TransactionAmount = Request.Form("Amount")
%>
<SCRIPT LANGUAGE="Javascript" >
<!--
function OnLoadEvent()   {   document.downloadForm.submit();   }
//-->
</SCRIPT>
<body OnLoad="OnLoadEvent();">
   <form name="downloadForm" action="<% =o3DS.ACSURL %>" method="POST">
     <INPUT type="hidden" name="PaReq" value="<% =o3DS.GetAuthenticationPacket()%>">
     <input type="hidden" name="TermUrl" value="https://yourserver/ProcessPARes.asp">
     <input type="hidden" name="MD" value="<% =key %>">
   </form>
</body>
<%
  End If
%>

If (Err.Number <> 0 Or o3DS.CardEnrolled <> "Y") Then

' If there's an error, here is where you can log it.

' Also, redirect the cardholder to the paymentpage.

' Send key so trans can be retrieved

Response.Redirect("PaymentPage.asp?" & "MD=" & key)

Else

'no error and the card is enrolled:

o3DS.MessageId = key 'Using unique database access key

o3DS.TransactionId = key 'Using unique database access key

o3DS.CardExpMonth = Request.Form("ExpMonth")

o3DS.CardExpYear = Request.Form("ExpYear")

o3DS.TransactionAmount = Request.Form("Amount")

<!--

function OnLoadEvent() { document.downloadForm.submit(); }

//-->

</SCRIPT>

<form name="downloadForm" action="<% =o3DS.ACSURL %>" method="POST">

</form>

</body>

End If

Harap dicatat bahwa di atas kode Javascript, atau sesuatu yang mirip, adalah sesuatu yang penting agar 3-D Secure MPI bekerja. Pelanggan harus diarahkan dari jendela browser sendiri. Pelanggan meninggalkan situs merchant dan pergi ke lokasi yang ditentukan dalam ACSURL property. Setelah pelanggan masukan password untuk kartu kredit, ia akan diarahkan kembali ke TermUrl, yang dalam hal ini adalah “ProcessPARes.asp” file yang berada di server merchant. Merchant data berisi kunci ke dalam database kita untuk memperoleh data transaksi, dan dikirim kembali ke TermUrl setelah pelanggan memasukkan password.

ProcessPARes.asp

Halaman ProcessPARes.asp adalah tempat Access Control Server yang ditunjukkan ke dalam ACSURL property atas posting apakah pelanggan telah dikonfirmasi atau tidak. Pos dari ACS akan mencakup bentuk variabel “Pares” dan “MD”. “Pares” berisi respon yang ditandatangani dan dienkripsi, dan “MD” melewati data merchant yang diperlukan untuk mengambil transaksi dari database merchant. Untuk mengurai paket respon ini, cukup dengan memberikan isi Pares dengan metode CheckAuthenticationResponse. Jika tidak terjadi kesalahan dan AuthenticationStatus property adalah “Y” (dikonfirmasi) atau “A” (upaya otentikasi), maka pelanggan dianggap telah dikonfirmasi . Jika dikonfirmasi, Anda dianggap telah lulus TransactionID property, AuthenticationCAVV, dan AuthenticationECI ke komponen Ibiz VitalPS oVPS agar dianggap memenuhi syarat untuk perlindungan ekstra dan mendapatkan diskon. Jika AuthenticationStatus adalah “N”, Anda TIDAK Di HARUSKAN menyelesaikan transaksi.

<!--#include file = "merchant.inc" -->
<%
  key = Request.Form("MD")
  LoadFromDatabase(key) 
  o3DS.MessageId         = key
  o3DS.TransactionId     = key
  o3DS.TransactionAmount = LoadFromDatabase(key, "TransactionAmount")
  o3DS.CardNumber        = LoadFromDatabase(key, "CardNumber")
  o3DS.CardExpMonth      = LoadFromDatabase(key, "CardExpMonth")
  o3DS.CardExpYear       = LoadFromDatabase(key, "CardExpYear")
  o3DS.CheckAuthenticationResponse(Request.Form("PaRes"))
  if (Err.Number <> 0) Then
    ' Log the error and then process the credit card. This should be 
    ' completely transparent to the customer.
    Response.Redirect("PaymentPage.asp?" & "MD=" & key)
  Else
    If (o3DS.AuthenticationStatus = "Y" Or o3DS.AuthenticationStatus = "A") Then
      ' Redirect to the payment page, including the ECI, XID, and CAVV values
      ' which are to be passed to the Vital processor.
      Response.Redirect("PaymentPage.asp?" & "MD=" & key & "&XID=" & _
                        o3DS.TransactionId & "&ECI=" & o3DS.AuthenticationECI & _
                        "&CAVV=" & o3DS.AuthenticationCAVV)
    Else
%>
      <b>Authentication Failed.</b><BR>
      Your financial institution has indicated that it could not authenticate this 
      transaction via Verified by Visa. To protect against unauthorized use, this 
      Visa card cannot be used to complete your purchase. You may complete the 
      purchase by clicking <a href=orderpage.asp>here</a> to select 
      another form of payment.
<%
    End If
  End If
%>

key = Request.Form("MD")

LoadFromDatabase(key)

o3DS.MessageId = key

o3DS.TransactionId = key

o3DS.TransactionAmount = LoadFromDatabase(key, "TransactionAmount")

o3DS.CardNumber = LoadFromDatabase(key, "CardNumber")

o3DS.CardExpMonth = LoadFromDatabase(key, "CardExpMonth")

o3DS.CardExpYear = LoadFromDatabase(key, "CardExpYear")

o3DS.CheckAuthenticationResponse(Request.Form("PaRes"))

if (Err.Number <> 0) Then

' Log the error and then process the credit card. This should be

' completely transparent to the customer.

Response.Redirect("PaymentPage.asp?" & "MD=" & key)

Else

If (o3DS.AuthenticationStatus = "Y" Or o3DS.AuthenticationStatus = "A") Then

' Redirect to the payment page, including the ECI, XID, and CAVV values

' which are to be passed to the Vital processor.

Response.Redirect("PaymentPage.asp?" & "MD=" & key & "&XID=" & _

o3DS.TransactionId & "&ECI=" & o3DS.AuthenticationECI & _

"&CAVV=" & o3DS.AuthenticationCAVV)

Else

<b>Authentication Failed.</b><BR>

Your financial institution has indicated that it could not authenticate this

transaction via Verified by Visa. To protect against unauthorized use, this

Visa card cannot be used to complete your purchase. You may complete the

purchase by clicking <a href=orderpage.asp>here</a> to select

another form of payment.

End If

PaymentPage.asp

Langkah terakhir adalah PaymentPage.asp. Di sinilah kartu kredit pelanggan sebenarnya dihitung dan dipotong untuk pembayaran. Komponen Vital PS oVPS dibuat pada langkah merchant.inc diatas. Sekarang kita akan menggunakan komponen ini untuk meng-otorisasi kartu pelanggan. Kita hanya akan memuat transaksi dari database, menambahkan 3D Secure XID, ECI, dan CAVV dan berakhir pada penagihan kartu kredit.

<!--#include file = "merchant.inc" -->
<%
  key  = Request.QueryString("MD")
  oVPS.CardNumber        = LoadFromDatabase(key, "CardNumber")
  oVPS.CardExpMonth      = LoadFromDatabase(key, "CardExpMonth")
  oVPS.CardExpYear       = LoadFromDatabase(key, "CardExpYear")
  oVPS.CustomerAddress   = LoadFromDatabase(key, "CustomerAddress")
  oVPS.CustomerZip       = LoadFromDatabase(key, "CustomerZip")
  oVPS.TransactionAmount = LoadFromDatabase(key, "Amount")
  oVPS.TransactionNumber = "0001" ' This should increment for each transaction
  oVPS.XID               = Request.QueryString("XID")  'If not present = ""
  oVPS.ECI               = Request.QueryString("ECI")  'If not present = ""
  oVPS.CAVV              = Request.QueryString("CAVV") 'If not present = ""
  oVPS.Authorize()
  If (Err.Number <> 0) Then
    'log the error and alert the customer
%>
    We're sorry, our payment system is currently experiencing technical 
    difficulties. Please call 1-800-555-5555 to place your order over the 
    phone. We are sorry for any inconvenience.     
<%
  ElseIf (DirectCharge.ResponseCode = "00" Or _
   DirectCharge.ResponseCode = "85") Then 
    Response.Write("Thank you for your purchase. Your tracking number is:" & key)
  Else 
    Response.Write("Your card has been declined for the following reason:")
    Response.Write(oVPS.ResponseText)
  End If
  UpdateDatabaseEntry(key)
%>

key = Request.QueryString("MD")

oVPS.CardNumber = LoadFromDatabase(key, "CardNumber")

oVPS.CardExpMonth = LoadFromDatabase(key, "CardExpMonth")

oVPS.CardExpYear = LoadFromDatabase(key, "CardExpYear")

oVPS.CustomerAddress = LoadFromDatabase(key, "CustomerAddress")

oVPS.CustomerZip = LoadFromDatabase(key, "CustomerZip")

oVPS.TransactionAmount = LoadFromDatabase(key, "Amount")

oVPS.TransactionNumber = "0001" ' This should increment for each transaction

oVPS.XID = Request.QueryString("XID") 'If not present = ""

oVPS.ECI = Request.QueryString("ECI") 'If not present = ""

oVPS.CAVV = Request.QueryString("CAVV") 'If not present = ""

oVPS.Authorize()

If (Err.Number <> 0) Then

'log the error and alert the customer

We're sorry, our payment system is currently experiencing technical

difficulties. Please call 1-800-555-5555 to place your order over the

phone. We are sorry for any inconvenience.

ElseIf (DirectCharge.ResponseCode = "00" Or _

DirectCharge.ResponseCode = "85") Then

Response.Write("Thank you for your purchase. Your tracking number is:" & key)

Else

Response.Write("Your card has been declined for the following reason:")

Response.Write(oVPS.ResponseText)

End If

UpdateDatabaseEntry(key)

Artikel ini menunjukkan bagaimana mengintegrasikan sebuah sistem pembayaran merchant yang sangat sederhana dari awal. Namun, 3-D Secure MPI dan Ibiz VitalPS Integrator dapat dengan mudah diintegrasikan ke dalam sistem yang ada. Jika gateway yang Anda gunakan support 3-D Secure data transport (XID, CAVV, dan ECI) Anda dapat menggunakan komponen IP*Works! 3-D Secure MPI untuk mengotentikasi pemegang kartu dengan menciptakan halaman penengah antara checkout dan pembayaran seperti yang ditunjukkan di atas. Dengan begitu sekarang Anda sudah berhasil bukan Mengintegrasikan Pembayaran via Credit Card ke Payment System Anda? Semoga bermanfaat