Question in regard to OFX 1.0.2 or 1.0.3

[David Reiser]

gnucash 2.4.11 with aqbanking 5.0.23 sends "VERSION:102" in the request header. I believe version 1.0.2 has been the one used by aqbanking since the first time OFX was included.

 There is a Client UID field in the OFX DirectConnect setup in aqbanking. If there were an out-of-band way for a customer to establish a unique Client UID and then enter it in the aqbanking setup, it should work. I believe that if a value is entered in the aqbanking Client UID field, that value and its tag are sent at the appropriate place in the OFX connection initiation.

As Martin hinted, there is precious little (nothing?) in the way of documentation for the in-band establishment of Client UID as is done in Quicken via some OFX connection dialog. If I'm understanding the description of ClientUID, that field is used to recognize a given instance of software which can be paired with user authentication to further guard against fraud. I don't think ClientUID is intended as user authentication on its own. But the OFX standard is frequently  hard for me to understand, and especially so for the ClientUID addition.

Dave
--
Dave Reiser
dbreiser at me.com



On Dec 8, 2012, at 2:52 PM, Christian Stimming <christian at cstimming.de> wrote:

> Dear Lisa,
> 
> thanks for sending this question directly to us, the developers of the gnucash 
> software and their main development discussion mailing list.
> 
> Did I understand your question correctly: Your bank is about to change the 
> implementation of the DirectConnect OFX server, and your concern is whether 
> this might cause problems with customers who are using the GnuCash software 
> for connecting to your DirectConnect server?
> 
> In that case the question is perfectly fine and we will have to think about 
> this for a short time. In particular, the developer of the DirectConnect 
> client software implementation needs to answer here, which is Martin Preuss of 
> the included helper library, called "aqbanking". I've forwarded your question 
> to him and we'll see what he knows about this issue from the client 
> implementation point of view.
> 
> To the other gnucash developers here: Does someone know whether the current 
> gnucash with aqbanking sends a DirectConnect request with OFX format version 
> 1.0.2 and/or without ClientUID? (I don't use that feature so I don't know 
> myself.)
> 
> Best Regards,
> 
> Christian
> 
> 
> Am Donnerstag, 6. Dezember 2012, 12:25:28 schrieb Medlin, Lisa:
>> We will be requiring ClientUID or versions 1.0.3 to connect to Capital One
>> for DirectConnect.
>> 
>> We have a large population of users using GNUCash, is there anything that
>> needs to be changed on the data file or in the sever config?
>> 
>> The change will take place on December 15th to reject all users sending a
>> 1.0.2 and/or ClientUID not included in data file.
>> 
>> Can you assist me with understanding the impact to these users or is there
>> something we can adjust for?
>> 
>> 
>> 
>> Lisa Medlin
>> Digital Customer Protection
>> Tel: (804)855-6155 (tie 434)
>> Cell: (804)305-9476
>> Lisa.Medlin at capitalone.com<mailto:FirstName.LastName at capitalone.com>
>> 
>> [cid:image001.gif at 01CDD3AC.C35BC760]
>> 
>> The information contained in this e-mail is confidential and/or
>> 
>> proprietary to Capital One and/or its affiliates. The information
>> 
>> transmitted herewith is intended only for use by the individual
>> 
>> or entity to which it is addressed.  If the reader of this
>> 
>> message is not the intended recipient, you are hereby notified
>> 
>> that any review, retransmission, dissemination, distribution,
>> 
>> copying or other use of, or taking of any action in reliance upon
>> 
>> this information is strictly prohibited. If you have received
>> 
>> this communication in error, please contact the sender and delete
>> 
>> the material from your computer.
> _______________________________________________
> gnucash-devel mailing list
> gnucash-devel at gnucash.org
> https://lists.gnucash.org/mailman/listinfo/gnucash-devel