Avoid select TAN mode

[lindstrom79]

Hello,

I am using the script for connection to VR-banks which require only every 90 days a TAN. My problem: Ever time the user has to select his TAN method - even when no TAN is needed since he is within the 90 days. I would like to avoid this step. When I get a message like "Response: Starke Kundenauthentifizierung nicht notwendig." I would like to skip the TAN mode choice and just go ahead. A while ago I tested a python script and there this was possible. How can I achieve this here?

Thanks a lot.

[Philipp91]

Which Python script? And how long a while ago (perhaps before PSD2)?

Can't you just store the choice that the user made (alongside their username and PIN)?

[lukas-staab]

You have to transmit a tan mode to the bank, otherwise you get server-side errors as far as I remember. Best for your case might be to save the last picked tan mode, as Philipp mentioned. Maybe the python script did the same internal.

[lindstrom79]

Thanks a lot for your replies. The Python script I meant is: https://github.com/raphaelm/python-fints

As far as I can see the Python script logs in first, checks whether TAN is needed and if yes, shows the methods. I am running it this way successfully way on my server, but for another project I needed PHP.

The PHP script here works great. But it is asking for TAN method before login. Storing the TAN method could be an option but what if the user changes his method 🧐.

Is there any way, to skip the TAN selector before login?

P.S. In my banking app MoneyMoney I also do not need to enter a TAN method every time.

[Philipp91]

At least as of Dec 2019, that Python library will also ask you for the preferred TAN mode (unless there is only one, which it would auto-pick): https://github.com/raphaelm/python-fints/blob/bc1c81e0a42be245c6af24bb0885ce1b2407bd2a/fints/utils.py#L312

There it also says "If the client was created with cached data, ..." which indicates that there's a way to persist state with that library too -- not sure if it's done automatically or has to be done explicitly by the application using the library, like it's the case with phpFinTS.

And as per the documentation this happens before login, and it needs to because the login itself might require a TAN.

So that library should be equivalent to phpFinTS if you (1) auto-select the TAN mode if there is only one and (2) persist the user's choice.

In my banking app MoneyMoney I also do not need to enter a TAN method every time.

Because it persists the selection.

[lindstrom79]

Thanks a lot Philipp. I really appreciate that you took the time and checked in Python script.

As mentioned, we use this python script already and we found out that the code you quoted is only needed when you are required to enter a TAN, otherwise you can skip it completely. We made a snippet for it and it works like a charm. We are able to fetch transactions within 90 days there without storing a TAN method. It works completely automated. Therefore, my hope was we can do this in phpFinTS too 🤷‍♂️

[Philipp91]

Looks like PyFinTS uses security_method_version=1 in that case. That reminds me of NoPsd2TanMode -- please try that: $fints->selectTanMode(new Fhp\Model\NoPsd2TanMode());. It's not exactly the same (it ends up sending no HTKAN at all) but it might work.

If it doesn't work, please post a log of the messages that PyFinTS exchanges with the bank (make sure you get the output from this and scrub out any personal information, especially username and PIN). Then we can put that into a unit test and see how we can make phpFinTS behave the same way.

[lukas-staab]

The PHP script here works great. But it is asking for TAN method before login. Storing the TAN method could be an option but what if the user changes his method monocle_face.

Is there any way, to skip the TAN selector before login?

I am not sure if we are talking about the same thing, but I do it like that at the first time a user registers with my application: (may that does help or clarify something for you)

• pickup user credentials (save them e.g. in session or more persistent depending on your usecase)
• fetch tan modes and let user pick one and save them persistent e.g. in database
• login (might needs a TAN)
• do stuff (might needs TAN as well)
• logout

The persistent string from FinTS Object can either be saved e.g. in Session or the Database. Next time the user tries to login, it skips the first two steps, due to the known (saved) TAN Mode. In a different place in the UI (before the login) i give the opportunity to change the saved default tan mode (note that the Login Credentials have to be known to get the user specific allowed and configured tan modes, but the ->login() method does not need to be called yet, but can)

[lindstrom79]

Looks like PyFinTS uses security_method_version=1 in that case. That reminds me of NoPsd2TanMode -- please try that: $fints->selectTanMode(new Fhp\Model\NoPsd2TanMode());. It's not exactly the same (it ends up sending no HTKAN at all) but it might work.

If it doesn't work, please post a log of the messages that PyFinTS exchanges with the bank (make sure you get the output from this and scrub out any personal information, especially username and PIN). Then we can put that into a unit test and see how we can make phpFinTS behave the same way.

Sorry, it took a while, but we tried now and received the following messages:

[lindstrom79]

Dear Lukas, thanks a lot. This is definitely also a solution and I also considered this, but my concern is that user might change their credentials in online banking and next time they use my app this might cause problems. Therfore, I am would like to skip fetching the tan modes ans use always the "real time" user credentials.

[lindstrom79]

We have chosen a method where we ask one time for TAN method and store it.