credit card authorization + capture

[Mike Voytovich-2]

Hi,

I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".  

However, now I hit the following error when the order is submitted:

2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))


I have 2 questions:

1) Is it reasonable to set up authorization + capture in this way?
2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?


Thanks for your help!

regards,
-mike

[Patrick-4]

Security permissions are set in partymgr they are associated with the
user login. Party manager is at  /partymgr/control/main

On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich <[hidden email]> wrote:

> Hi,
>
> I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".
>
> However, now I hit the following error when the order is submitted:
>
> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))
>
>
> I have 2 questions:
>
> 1) Is it reasonable to set up authorization + capture in this way?
> 2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?
>
>
> Thanks for your help!
>
> regards,
> -mike
>
>

[Mike Voytovich-2]

My question is in regards to anonymous purchases on the eCommerce store (i.e., checkout without login).

Regardless, it doesn't seem like one should need to change a user's security permissions to perform authorization+capture during checkout.  Furthermore, giving ACCTG_ATX_CREATE or ACCTG_ATX_ADMIN permissions to a user sounds like it could be a potential security issue?

thanks,
-mike


On Feb 4, 2010, at 10:14 AM, Patrick wrote:

> Security permissions are set in partymgr they are associated with the
> user login. Party manager is at  /partymgr/control/main
>
> On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich <[hidden email]> wrote:
>> Hi,
>>
>> I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".
>>
>> However, now I hit the following error when the order is submitted:
>>
>> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))
>>
>>
>> I have 2 questions:
>>
>> 1) Is it reasonable to set up authorization + capture in this way?
>> 2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?
>>
>>
>> Thanks for your help!
>>
>> regards,
>> -mike
>>
>>

[Amit Sharma-10]

Hello Mike,

In process of capture payment, OFBiz create accounting transaction
entries. If you really want to process capture payment you need to
comment out secas_ledger.xml and secas_olap.xml files in accounting
component so that user can process capture payment without accounting
entries.

Anonymous user can't do payment capture process along with authorization
of payment and also it should not happen because It means you are giving
the authority of accounting transaction to anonymous user, a part from
this anonymous user has not permission of accounting transaction.
Actually in the process of  payment  capture behind the seen you are
creating accounting transaction entries.

Thanks and Regards,

Amit Sharma

Mike Voytovich wrote:

> My question is in regards to anonymous purchases on the eCommerce store (i.e., checkout without login).
>
> Regardless, it doesn't seem like one should need to change a user's security permissions to perform authorization+capture during checkout.  Furthermore, giving ACCTG_ATX_CREATE or ACCTG_ATX_ADMIN permissions to a user sounds like it could be a potential security issue?
>
> thanks,
> -mike
>
>
> On Feb 4, 2010, at 10:14 AM, Patrick wrote:
>
>  
>> Security permissions are set in partymgr they are associated with the
>> user login. Party manager is at  /partymgr/control/main
>>
>> On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich <[hidden email]> wrote:
>>    
>>> Hi,
>>>
>>> I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".
>>>
>>> However, now I hit the following error when the order is submitted:
>>>
>>> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))
>>>
>>>
>>> I have 2 questions:
>>>
>>> 1) Is it reasonable to set up authorization + capture in this way?
>>> 2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?
>>>
>>>
>>> Thanks for your help!
>>>
>>> regards,
>>> -mike
>>>
>>>
>>>      
>
>  

[Mike Voytovich-2]

Thanks for the explanation Amit.

It seems like an anonymous checkout would not unusual for an ecommerce site; and, I would think that credit card authorize + capture is not an uncommon method when collecting payments from anonymous customers.  I understand that within OFBiz it's an accounting transaction; but, it seems like anonymous authorize + capture should be supported without having to comment out the accounting entries.

Thanks again for the advice though, I'll look into alternative methods for performing automated capture other than setting it up to be the default credit card payment method.

regards,
-mike


On Feb 5, 2010, at 9:11 PM, Amit Sharma wrote:

> Hello Mike,
>
> In process of capture payment, OFBiz create accounting transaction
> entries. If you really want to process capture payment you need to
> comment out secas_ledger.xml and secas_olap.xml files in accounting
> component so that user can process capture payment without accounting
> entries.
>
> Anonymous user can't do payment capture process along with authorization
> of payment and also it should not happen because It means you are giving
> the authority of accounting transaction to anonymous user, a part from
> this anonymous user has not permission of accounting transaction.
> Actually in the process of  payment  capture behind the seen you are
> creating accounting transaction entries.
>
> Thanks and Regards,
>
> Amit Sharma
>
> Mike Voytovich wrote:
>> My question is in regards to anonymous purchases on the eCommerce store (i.e., checkout without login).
>>
>> Regardless, it doesn't seem like one should need to change a user's security permissions to perform authorization+capture during checkout.  Furthermore, giving ACCTG_ATX_CREATE or ACCTG_ATX_ADMIN permissions to a user sounds like it could be a potential security issue?
>>
>> thanks,
>> -mike
>>
>>
>> On Feb 4, 2010, at 10:14 AM, Patrick wrote:
>>
>>
>>> Security permissions are set in partymgr they are associated with the
>>> user login. Party manager is at  /partymgr/control/main
>>>
>>> On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich <[hidden email]> wrote:
>>>
>>>> Hi,
>>>>
>>>> I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".
>>>>
>>>> However, now I hit the following error when the order is submitted:
>>>>
>>>> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))
>>>>
>>>>
>>>> I have 2 questions:
>>>>
>>>> 1) Is it reasonable to set up authorization + capture in this way?
>>>> 2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?
>>>>
>>>>
>>>> Thanks for your help!
>>>>
>>>> regards,
>>>> -mike
>>>>
>>>>
>>>>
>>
>>
>
>

[Vivek Mishra-2]

Hi Mike,

Its true when authorize + capture is performed in OFBiz an accounting
transaction gets created. Now for performing any accounting transaction
a user must be authorized to do so. In short user must be having that
permission. As order has been placed from front end or we can say by the
end user of the site so it will not be feasible that we give accounting
transaction permission to this user who is just visiting your site for
purchasing the product.

Though I agree with the fact is that authorize + capture can be
performed without commenting any eca of accounting.

Thanks and Regards,
-- Vivek Mishra

Mike Voytovich wrote:

> Thanks for the explanation Amit.
>
> It seems like an anonymous checkout would not unusual for an ecommerce site; and, I would think that credit card authorize + capture is not an uncommon method when collecting payments from anonymous customers.  I understand that within OFBiz it's an accounting transaction; but, it seems like anonymous authorize + capture should be supported without having to comment out the accounting entries.
>
> Thanks again for the advice though, I'll look into alternative methods for performing automated capture other than setting it up to be the default credit card payment method.
>
> regards,
> -mike
>
>
> On Feb 5, 2010, at 9:11 PM, Amit Sharma wrote:
>
>  
>> Hello Mike,
>>
>> In process of capture payment, OFBiz create accounting transaction
>> entries. If you really want to process capture payment you need to
>> comment out secas_ledger.xml and secas_olap.xml files in accounting
>> component so that user can process capture payment without accounting
>> entries.
>>
>> Anonymous user can't do payment capture process along with authorization
>> of payment and also it should not happen because It means you are giving
>> the authority of accounting transaction to anonymous user, a part from
>> this anonymous user has not permission of accounting transaction.
>> Actually in the process of  payment  capture behind the seen you are
>> creating accounting transaction entries.
>>
>> Thanks and Regards,
>>
>> Amit Sharma
>>
>> Mike Voytovich wrote:
>>    
>>> My question is in regards to anonymous purchases on the eCommerce store (i.e., checkout without login).
>>>
>>> Regardless, it doesn't seem like one should need to change a user's security permissions to perform authorization+capture during checkout.  Furthermore, giving ACCTG_ATX_CREATE or ACCTG_ATX_ADMIN permissions to a user sounds like it could be a potential security issue?
>>>
>>> thanks,
>>> -mike
>>>
>>>
>>> On Feb 4, 2010, at 10:14 AM, Patrick wrote:
>>>
>>>
>>>      
>>>> Security permissions are set in partymgr they are associated with the
>>>> user login. Party manager is at  /partymgr/control/main
>>>>
>>>> On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich <[hidden email]> wrote:
>>>>
>>>>        
>>>>> Hi,
>>>>>
>>>>> I wanted to test out Authorization and Capture using the OOTB demo eCommerce site.  I went into: Catalog Manager => Stores => Payments, and changed the Credit Card Payment Authorization Service from "alwaysApproveCCProcessor" to "alwaysApproveWithCaptureCCProcessor".
>>>>>
>>>>> However, now I hit the following error when the order is submitted:
>>>>>
>>>>> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [     RequestHandler.java:412:ERROR] Request processpayment caused an error with the following message: Error in authOrderPayments service: org.ofbiz.service.GenericServiceException: Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction for service [authOrderPayments] call: Roll back error, could not commit transaction, was rolled back instead because of: Service [createAcctgTransAndEntries] threw an unexpected exception/errororg.ofbiz.service.ServiceAuthException: Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries you must have the one of the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN))
>>>>>
>>>>>
>>>>> I have 2 questions:
>>>>>
>>>>> 1) Is it reasonable to set up authorization + capture in this way?
>>>>> 2) If so, what is the proper way to fix the permissions issue - is it something along the lines of adding accounting permissions to the "system" party?
>>>>>
>>>>>
>>>>> Thanks for your help!
>>>>>
>>>>> regards,
>>>>> -mike
>>>>>
>>>>>
>>>>>
>>>>>          
>>>      
>>    
>
>  

[BJ Freeman]

wasn't there a discussion about making Authorize capture to run under
system login.

Vivek Mishra sent the following on 2/10/2010 3:22 AM:

> Hi Mike,
>
> Its true when authorize + capture is performed in OFBiz an accounting
> transaction gets created. Now for performing any accounting transaction
> a user must be authorized to do so. In short user must be having that
> permission. As order has been placed from front end or we can say by the
> end user of the site so it will not be feasible that we give accounting
> transaction permission to this user who is just visiting your site for
> purchasing the product.
>
> Though I agree with the fact is that authorize + capture can be
> performed without commenting any eca of accounting.
>
> Thanks and Regards,
> -- Vivek Mishra
>
> Mike Voytovich wrote:
>> Thanks for the explanation Amit.
>>
>> It seems like an anonymous checkout would not unusual for an ecommerce
>> site; and, I would think that credit card authorize + capture is not
>> an uncommon method when collecting payments from anonymous customers.
>> I understand that within OFBiz it's an accounting transaction; but, it
>> seems like anonymous authorize + capture should be supported without
>> having to comment out the accounting entries.
>>
>> Thanks again for the advice though, I'll look into alternative methods
>> for performing automated capture other than setting it up to be the
>> default credit card payment method.
>>
>> regards,
>> -mike
>>
>>
>> On Feb 5, 2010, at 9:11 PM, Amit Sharma wrote:
>>
>>  
>>> Hello Mike,
>>>
>>> In process of capture payment, OFBiz create accounting transaction
>>> entries. If you really want to process capture payment you need to
>>> comment out secas_ledger.xml and secas_olap.xml files in accounting
>>> component so that user can process capture payment without accounting
>>> entries.
>>>
>>> Anonymous user can't do payment capture process along with
>>> authorization of payment and also it should not happen because It
>>> means you are giving the authority of accounting transaction to
>>> anonymous user, a part from this anonymous user has not permission of
>>> accounting transaction. Actually in the process of  payment  capture
>>> behind the seen you are creating accounting transaction entries.
>>>
>>> Thanks and Regards,
>>>
>>> Amit Sharma
>>>
>>> Mike Voytovich wrote:
>>>    
>>>> My question is in regards to anonymous purchases on the eCommerce
>>>> store (i.e., checkout without login).
>>>> Regardless, it doesn't seem like one should need to change a user's
>>>> security permissions to perform authorization+capture during
>>>> checkout.  Furthermore, giving ACCTG_ATX_CREATE or ACCTG_ATX_ADMIN
>>>> permissions to a user sounds like it could be a potential security
>>>> issue?
>>>>
>>>> thanks,
>>>> -mike
>>>>
>>>>
>>>> On Feb 4, 2010, at 10:14 AM, Patrick wrote:
>>>>
>>>>
>>>>      
>>>>> Security permissions are set in partymgr they are associated with the
>>>>> user login. Party manager is at  /partymgr/control/main
>>>>>
>>>>> On Thu, Feb 4, 2010 at 11:26 AM, Mike Voytovich
>>>>> <[hidden email]> wrote:
>>>>>
>>>>>        
>>>>>> Hi,
>>>>>>
>>>>>> I wanted to test out Authorization and Capture using the OOTB demo
>>>>>> eCommerce site.  I went into: Catalog Manager => Stores =>
>>>>>> Payments, and changed the Credit Card Payment Authorization
>>>>>> Service from "alwaysApproveCCProcessor" to
>>>>>> "alwaysApproveWithCaptureCCProcessor".
>>>>>>
>>>>>> However, now I hit the following error when the order is submitted:
>>>>>>
>>>>>> 2010-02-04 08:19:46,643 (http-0.0.0.0-8443-4) [    
>>>>>> RequestHandler.java:412:ERROR] Request processpayment caused an
>>>>>> error with the following message: Error in authOrderPayments
>>>>>> service: org.ofbiz.service.GenericServiceException: Could not
>>>>>> commit transaction for service [authOrderPayments] call: Roll back
>>>>>> error, could not commit transaction, was rolled back instead
>>>>>> because of: Service [createAcctgTransAndEntries] threw an
>>>>>> unexpected exception/errororg.ofbiz.service.ServiceAuthException:
>>>>>> Security Error: To run createAcctgTransAndEntries you must have
>>>>>> the one of the following permissions: ACCTG_ATX_CREATE,
>>>>>> ACCTG_ATX_ADMIN (Security Error: To run createAcctgTransAndEntries
>>>>>> you must have the one of the following permissions:
>>>>>> ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN) (Could not commit transaction
>>>>>> for service [authOrderPayments] call: Roll back error, could not
>>>>>> commit transaction, was rolled back instead because of: Service
>>>>>> [createAcctgTransAndEntries] threw an unexpected
>>>>>> exception/errororg.ofbiz.service.ServiceAuthException: Security
>>>>>> Error: To run createAcctgTransAndEntries you must have the one of
>>>>>> the following permissions: ACCTG_ATX_CREATE, ACCTG_ATX_ADMIN
>>>>>> (Security Error: To run createAcctgTransAndEntries you must have
>>>>>> the one of the following permissions: ACCTG_ATX_CREATE,
>>>>>> ACCTG_ATX_ADMIN))
>>>>>>
>>>>>>
>>>>>> I have 2 questions:
>>>>>>
>>>>>> 1) Is it reasonable to set up authorization + capture in this way?
>>>>>> 2) If so, what is the proper way to fix the permissions issue - is
>>>>>> it something along the lines of adding accounting permissions to
>>>>>> the "system" party?
>>>>>>
>>>>>>
>>>>>> Thanks for your help!
>>>>>>
>>>>>> regards,
>>>>>> -mike
>>>>>>
>>>>>>
>>>>>>
>>>>>>          
>>>>      
>>>    
>>
>>  
>
>