>

Cybersource Security Update - SOAP API Authentication

Answered
Amy Durbin

A customer forwarded me the following email which they received from CyberSource.  Is there any action needed by us or the customer?   

 

Dear Valued Customers,

 As part of our ongoing Security Enhancements, we are planning to upgrade the SOAP API Authentication to P12 Authentication.

Starting February 13, 2025, we will be allowing only P12 Authentication for SOAP APIs.

 Please plan to make changes at your end before February 13, 2025 using the following information:

1. Upgrade the SOAP Authentication to use P12 using Java SOAP Toolkit that has been published on GitHub and can be found at the below link:

 https://github.com/CyberSource/cybersource-soap-toolkit that has been published on GitHub.

 2.       Detailed instructions can be found at the below link:

https://developer.cybersource.com/docs/cybs/en-us/platform/relnote/all/na/rn-2024-11-26/rn-announce.html

 3.       If you use the C/C++ Soap toolkit, we will share more information in the coming weeks to help with your migration.

 Please do not hesitate to contact the Cybersource support team if you have any questions or concerns. Cybersource Support Center.

 Thank You,

CyberSource Customer Support

 

Related to

Comments

16 comments

Date Votes
  • Amy Durbin

    Ryan Ungerboeck 

  • Cathy Herrick

    Ryan Ungerboeck  - Venetian and Dallas CC have requested more information about this as well.

  • Mike Schepker

    Add NIU to this list as well. 

  • Cathy Herrick

    There was a Jira issue entered for the changes needed: https://ungerboeck.atlassian.net/issues/FIN-4994

  • Amy Durbin

    Cathy Herrick  - do you know if there will be any changes needed on the customer's end or just on our side?  

  • Cathy Herrick

    Amy Durbin  - My understanding is the ‘what' on how this will be handled is still being figured out so that is TBD.
    Also not sure yet what versions it will be changed on either, it is likely an upgrade would be needed if the customer is on something before 24.2 though, other later versions TBD.

  • Seth Halvaksz

    Confirmed this is being handled in FIN-4994.  Ryan Ungerboeck said we're working on a plan and expect to have something this week.

    Expectation is that customers will need to upgrade to at least version 24.X (version TBD) and apply a patch and make some configuration changes to support this cybersource required update.

    Customers on earlier versions may have to consider a custom Cybersource gateway or an alternative gateway if an upgrade is not feasible.

  • Barbara Key

    Hello, just checking in on this. This might become a pretty big deal so we want to think about communication. Cybersource is pretty popular and this impacts some really large customers. 

  • Seth Halvaksz

    Providing an update here.

    The team is working on a patch that will be availble for 24.3 and 24.4 customers mid-late January.

    In addition, customers will need to make make a config change in their Cybersource gateway. I don't think we have all of the details on this yet.

    Ryan was able to pull a a list of customers so we will plan a communication to those specific customers.  We're also asking for a general post in case we missed a customer from this list.

  • Amy Durbin

    Hi Seth Halvaksz  - Just checking on status of this.  I've got a few customers who are planning their 24.4 upgrades in the next two weeks and are hoping to avoid multiple patches. 

     

  • Ryan Ungerboeck

    The Momentus development team has made the appropriate updates to the standard CyberSource payment integrations in versions 24.2 and above.  These updates will be made available in the coming weeks: 
     
    24.2 – Jan 24, 2025  
    24.3 – Jan 31, 2025 
    24.4 – Jan 24, 2025 
     
    Momentus customers using a CyberSource Payment gateway will be required to apply these security updates by February 13.  Failure to do so may result in online payments being rejected by CyberSource. 

     
    After applying these updates to the production environment, there is an update guide that will be available to make the appropriate adjustments to the configurations.

    Alternatives for customers on earlier versions is likely to consider another standard gateway such as PayPal on a temporary or permanent basis - as the updates were only required by Cybersource.

  • Dusty Hassler

    Seth Halvaksz when will the communication be sent out to customers as well as the general post will be made?  I have a couple of customers I would like to reference the official post, so they don't have any issues.  

  • Barbara Key

    Dusty Hassler  i am drafting something for the CSMs as well but waiting for the KB post to make sure we are all aligned. 

  • Brianna Taylor

    Joining this conversation as the CSM for Harvard University who also uses CyberSource and are planning their 24.4 upgrade.

  • Katie Eisenbath

    Hopping into this for following, also.

  • James Blackburn

    CyberSource has pushed back the required date to May 13th, 2025

    https://developer.cybersource.com/docs/cybs/en-us/platform/relnote/all/na/rn-2025-01-03/rn-announce.html

Please sign in to leave a comment.

Didn't find what you were looking for?

New post