Paypal App, API credentials and retrieve v manual setup

[BrockleyJohn]

I have installed the Paypal App integration with responsive osC taken from the github branch ...

 

I failed to find anywhere to retrieve pp credentials. I did hit a constant not defined error when using start, which may have stopped it appearing, but the start page just showed a link to manual entry of the credentials.

 

Anyway, putting in the credentials manually seems to work fine for the live environment in that the balance of the live account is retrieved happily.

 

However, the test/sandbox balance fails.

[First issue]

"Error: The PayPal balance could not be retrieved. Please try again."

The log for this shows no response at all from pp while all the credentials look fine.

I have double-checked that the api credentials in the signed-in sandbox account and in the pp developer site sandbox user are the same as each other and as those in the app.

 

If it's a glitch at the pp end then it's been consistent for several hours. I'm wondering if there's something that could have got messed up in the intial setup that would affect the url being called. Any ideas?

 

Next...

Login with Paypal.

I have created an app for the REST api in the pp developer site, with the full set of features for Payments and Login with Paypal options. I have set all these up on both the sandbox tab and the live tabs for the app.

The return urls are set to catalog/ext/modules/payment/paypal/login.php

Privacy and user agreement urls set to catalog/privacy.php

 

[second issue]

Whether the Login app module is set to live or test, I get the following error:

Relying Party Validation error: client_id provided in the request does not match any of the registered clients. Please check the request.

 

I have, of course, checked all the credentials and features for each environment. I have copied and pasted via notepad to clean up the characters.

I don't get any logging of this in osc paypal app admin - is that expected?

Whether the login module is set to test or live, this response comes from

https://www.paypal.com/webapps/auth/ph/error

 

The secrets are enabled for both sandbox and live. There isn't a setting hidden away somewhere to enable the whole app is there?

 

Is there an easy way to get more debugging info on this, short of sticking something before the curls myself?

 

Any pointers appreciated.

[douglaswalker]

You may know already but the Sandbox recently upgraded around the 20th  to a new SSL protocol and it is no longer possible to send un-encrypted info to it anymore.

The live site is not upgrading until June this year.

This could explain why it worked on the live side but not the sandbox side?

Not sure if it is anything to do with it.

I currently have PayPal standard that works on a live site but not in the sandbox since the change.

[BrockleyJohn]

You may know already but the Sandbox recently upgraded around the 20th  to a new SSL protocol and it is no longer possible to send un-encrypted info to it anymore.

The live site is not upgrading until June this year.

This could explain why it worked on the live side but not the sandbox side?

Not sure if it is anything to do with it.

I currently have PayPal standard that works on a live site but not in the sandbox since the change.

 

Thanks for the suggestion - it's an avenue I've not gone down yet. I had the opposite to you last week on a site going live on a 2.2 to BS migration. We'd done all the testing against sandbox and when I brought the new shop up and pointed paypal_standard to pp live, it wouldn't work. (The return to checkout_process bit that is, ipn was fine). Ended up reverting to the 2.2 payment module so they can still take pp payments while I find a solution; the driver for why I'm looking at the app now.

[BrockleyJohn]

First debugging step:

@@raiwa the raw format can be retrieved with:
 

// live
http://your-server/path-to-catalog/admin/paypal.php?action=balance&subaction=retrieve&type=live

// sandbox
http://your-server/path-to-catalog/admin/paypal.php?action=balance&subaction=retrieve&type=sandbox

gives for the live environment

{"rpcStatus":1,"balance":{"GBP":"\u00a359.76"}}

but for sandbox

{"rpcStatus":-1}

...so I guess that means it's getting an error response (as opposed to no response)

[douglaswalker]

As far as i am aware sandbox will no longer accept non encrypted calls

 

 

 

// sandbox
http://your-server/path-to-catalog/admin/paypal.php?action=balance&subaction=retrieve&type=sandbox

 

and then only accept them if your ssl is up to scratch.

[BrockleyJohn]

OK - I now know a bit more, it's related to an upgrade in the security protocols. There's a microsite about it https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766

 

It means that our calls are getting a curl error, which I managed to output:

error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

So far I have tried a couple of solutions from the paypal stackoverflow forum without resolving it:

			curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

and

			curl_setopt($curl, CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

It's not yet getting far enough to care what the parameters are that we're sending to it.

When I know more, so will you.

 

Next thing to try - a new root certificate

[BrockleyJohn]

Eureka! A step forward...

 

I have found that the curl library version needs to be at least 7.40 or you'll get this error.

 

On the hosting where I've been trying to resolve these, this means that you need to be running at least php 5.5

 

Having changed that, I'm now getting the following from the balance call to the sandbox:

{"rpcStatus":1,"balance":{"GBP":"\u00a31,005.00"}}

Next thing is to take out all the debugging again and see how much works.

 

This is not great news for folks still on osc2.2

[douglaswalker]

The plot thickens

[BrockleyJohn]

I'm afraid you're not going to care @@douglaswalker, but I've solved the lack of 'retrieve credentials'.

 

It's a bug in the paypal app affecting uk stores - the app is comparing UK in a config file with GB in the countries table and not getting a match.

 

Solution: edit includes/apps/paypal/req_api_countries.txt

 

I don't suppose you care any more either @@oldcelt but it's the solution to one of the problems you had a while back

[burt]

@@BrockleyJohn good find

 

 

@@Harald Ponce de Leon

[douglaswalker]

I care... well found sir

[BrockleyJohn]

Status update: although the retrieve buttons are available, I can't get the retrieve to go all the way through.

 

If I choose the proper country (United Kingdom) at the app authorisation login that appears, from that I get forwarded to paypal UK login, which then just takes me into the paypal account.

 

For sandbox, if I choose United States instead, it logs in ok and goes through the authorisation. However, when it comes back towards the osc store, it sticks in the retrieve app on ssl.oscommerce.com with

rpcStatus=-100

...at least that's where I believe it is, as the url is showing

https://ssl.oscommerce.com/index.php?RPC&Website&Index&PayPalStart&secret=[snip]&merchantId=[snip]&merchantIdInPayPal=[snip]&permissionsGranted=false&accountStatus=BUSINESS_ACCOUNT&consentStatus=true&productIntentID=addipmt&isEmailConfirmed=true

[aside: seems odd that the above includes permissionsGranted=false]

the preceding screen was this:

https://www.dropbox.com/s/9d9zcxb56714xpl/Screenshot%202016-01-31%2009.57.43.png?dl=0

 

I'm aware I'm not the first to get this error http://www.oscommerce.com/forums/topic/408097-error-when-returning-to-osc-admin-gives-rpcstatus-100-error/?p=1732082

[BrockleyJohn]

Curiouser and curiouser...

 

rerunning the retrieve sandbox credentials gets the same return of -100 each time, but checking the values in the url:

- merchantIdInPayPal is the same each time (corresponds to the secure merchant id in paypal account) but

- secret and merchantId are different on every retrieve

 

Trying a live retrieve doesn't work even with choosing US as the country - possibly since I get forwarded for additional authorisation via paypal uk (to send a pin by text). It just ends up signed into the paypal account.

[BrockleyJohn]

OK, I noticed that the success screen of paypal authorisation (screenshot above) differed from the one in the pp app documentation in that it's got a message talking about the email needing confirmation. This extra message also gets fed through the return url to ssl.oscommerce.com

 

This turned out to be because the paypal sandbox account I used had an additional email added to it which was unconfirmed. Removing this extra address gets rid of the extra message in the success screen and url, but I'm still getting the response

rpcStatus: -100

[BrockleyJohn]

Since this seems to have turned into a catalogue of problems you might run into setting up the paypal app, I'll add another. If on accessing admin/orders.php you get this warning:

Warning: Invalid argument supplied for foreach() in [fs catalog]/includes/classes/hooks.php on line 56

check that you've properly uploaded this file:

 

catalog/includes/hooks/admin/orders/paypal.php

[cybernanga]

Eureka! A step forward...

 

I have found that the curl library version needs to be at least 7.40 or you'll get this error.

 

On the hosting where I've been trying to resolve these, this means that you need to be running at least php 5.5

 

Having changed that, I'm now getting the following from the balance call to the sandbox:

{"rpcStatus":1,"balance":{"GBP":"\u00a31,005.00"}}

Next thing is to take out all the debugging again and see how much works.

 

This is not great news for folks still on osc2.2

 

 

I’m running Bootstrap OSC and have the PayPal App installed. All of a sudden i got the following error in Sandbox: “Error: The PayPal balance could not be retrieved. Please try again.”, but not in Live.

 

Also my “Checkout with PayPal” Button stopped taking me to PayPal, instead it took me to "http://mysite.com/shopping_cart.php?error_message=“with an empty value for the error message.

 

Everything worked when using PayPal Live, but Sandbox was broken.

 

After reading this thread, I checked and my CURL version is 7.18.7 on PHP 5.4 (I don’t have an SSL Certificate)

 

I contacted my host, as according to the CURL version history, this is from 4th Nov 2009! My host said they “backport" security updates (I had to read up about this) and that there shouldn’t be any issues.

 

Anyway, further investigations, and trials (thanks to this thread for clues) lead me to discover that all that is needed is to force CURL to connect with “TLS” instead of the default “SSLV3”.

 

SOLUTION

I managed to do this by adding the following line to the PayPal App’s code:

 

File: catalog/includes/apps/paypal/OSCOM_PayPal.php

 

Line: 424,  or thereabouts ;-)

curl_setopt($curl, CURLOPT_SSLVERSION, 6); //Force CURL to use TSL v1.2

This goes just after the first 6 (six) curl_setopt’s, just before 

if ( isset($parameters) ) {

After this single line change, everything works as expected.

 

I hope this helps someone.

 

 

N.B: The “6” value above is the “short” version, the same line could also be written as:

curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2); //Force CURL to use TSL v1.2

Of the six possible values http://php.net/manual/en/function.curl-setopt.php, I found that ONLY TLSv1 (1) & TLSv1_2 (6) will work.

The Default, SSL v2 and v3, and TSL v1_0 & v1_1 will not work.

 

N.B2: Instead of changing the “OSCOM_PayPal.php” file, one could place the following line, somewhere that it will be called BEFORE any PayPal code runs. I suggest “application_top.php”.

PPHttpConfig::$DEFAULT_CURL_OPTS[CURLOPT_SSL_CIPHER_LIST] = 'TLSv1';

[BrockleyJohn]

Thanks for detailing the fix @@cybernanga

 

If you find that the paypal app has stopped retrieving the sandbox balance, it's because of paypal protocol upgrades. If you don't sort it out, the live environment will stop working later this year.

 

Suggested approach to fixing, starting with what's going to work for more people first:

1. Try doing exactly what James said above

2. If that doesn't help, try this setting this option:

curl_setopt($curl, CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

3. Check with your hosting what you need to do to be running a version of curl/php that will support the right protocol. If you're running a very old version of oscommerce you may find that upgrading php version produces errors, so plan to avoid breaking your store!

[burt]

Thanks @@cybernanga

 

After this single line change, everything works as expected.

@@Harald Ponce de Leon

[douglaswalker]

Hi there

I have just tested the 2 fixes above with the PayPal App | PayPal  Standard Using IPN and Payment Data Transfer in the sandbox.

Unfortunately it failed. This is with a full SSL certificate. So now I am  not sure if my SSL  is not upto scratch or if something needs to be changed in the APP or a setting at PayPal in my account needs to change.

Way in over my head here

Doug (w00t)

[BrockleyJohn]

Hi there

I have just tested the 2 fixes above with the PayPal App | PayPal  Standard Using IPN and Payment Data Transfer in the sandbox.

Unfortunately it failed. This is with a full SSL certificate. So now I am  not sure if my SSL  is not upto scratch or if something needs to be changed in the APP or a setting at PayPal in my account needs to change.

Way in over my head here

Doug (w00t)

 

@@douglaswalker does the sandbox balance retrieve work? That only uses the main settings and doesn't use your ssl settings or certificate or even PDT. If we make sure that's working first, we can go from there.

[douglaswalker]

ok first question

 

I am in Australia (where it is 7000deg today) and the retrieve by auto does not work in AU as far as I am aware so I need to do it manually.

Do I use the same API details in the sandbox as the live credentials from my Paypal account?

Doug

[auzStar]

@@douglaswalker

 

Ah, the heat wave. Enjoy! :D

 

Doug, you need test account credentials from the paypal developer site: https://developer.paypal.com.

Sign in to developer with your normal paypal login and click on dashboard at top, then click accounts under Sandbox on left. Can't remember if there are defaults account already there, if not create new ones. Should be least one business acc and at least one personal account for testing.

 

cheers

[auzStar]

Just to add you use the business acc credentials for filling in the paypal app details.

 

example api username is username-facilitator_api1.optusnet.com.au example paypal e-mail address is [email protected]

then fill in the api password and api signature for this business acc.

 

you get all this information by clicking on an account, then clicking profile underneath.

[BrockleyJohn]

...and then once we've got the balance retrieve working, when it comes to testing a purchase you'll need to use the buyer account created in the same way to pay for the order

[douglaswalker]

many thanks will get backshortly