Error fetching accounts in v2.0.0

[elohmeier]

There is a regression in version 2.0.0.
When using "comdirect bank", URL: https://fints.comdirect.de/fints, I'm getting the following output:

client.py 327 ERROR Dialog response: 9050 - Die Nachricht enthaelt Fehler. client.py 327 ERROR Dialog response: 9800 - Dialog abgebrochen client.py 327 ERROR Dialog response: 9010 - Die angegebene Bankreferenz ist nicht gueltig. client.py 327 ERROR Dialog response: 9110 - Ungueltige Auftragsnachricht: Unbekannter Aufbau.

I've just tested it with version 1.0.1, that version works.
I was also able to successfully fetch accounts for DKB bank using v2.0.0.

[raphaelm]

Hmm meh, that is bad. Probably, we'd need more debug output to look into it, unless @henryk has an idea immediately.

[elohmeier]

@raphaelm is there a way to anonymize the debug output? I could provide the output for 1.0.1 and 2.0.0 then.

[henryk]

The only private data in the debug output should be the username and account number. (PIN shouldn't be output in the first place.) Also you can/should remove the entire HIUPD and HIUPA segments.

Because currently I've no idea what could be the cause. The HKSPA message we send for account listing doesn't have any special parameters and should be impossible to get wrong. Much more likely they don't like something in our security framing. The error message points to the BankIdentifier, or maybe SecurityIdentificationDetails.

[raphaelm]

I always thought comdirect/commerzbank doesn't support PIN/TAN authentication at all, but if it worked with 1.0.1 it should…

[henryk]

Ok, I found my comdirect account data.
Their implementation is .. interesting.
First up #46 they only allow iTAN for me, which is not in one of the HITANS# segments I currently claim to support (IMPLEMENTED_HKTAN_VERSIONS in client.py).
There are some unexpected control flows, and I'm not entirely sure they're not separate bugs.

Code:

with f:
  f.get_sepa_accounts()

Exception:

Traceback (most recent call last):
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/dialog.py", line 72, in init
    retval = self.send(*segments, internal_send=True)
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/dialog.py", line 133, in send
    self.client.process_response_message(self, response, internal_send=internal_send)
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/client.py", line 224, in process_response_message
    self._process_response(dialog, segment, response)
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/client.py", line 1137, in _process_response
    self.set_tan_mechanism('999')
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/client.py", line 1172, in set_tan_mechanism
    raise Exception("Cannot change TAN mechanism with a standing dialog")
Exception: Cannot change TAN mechanism with a standing dialog

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "test_comdirect.py", line 17, in <module>
    with f:
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/client.py", line 234, in __enter__
    self._standing_dialog.__enter__()
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/dialog.py", line 37, in __enter__
    self.init()
  File "/mnt/c/Users/Henryk/prog/python-fints/fints/dialog.py", line 80, in init
    raise FinTSDialogInitError("Couldn't establish dialog with bank, Authentication data wrong?") from e
fints.exceptions.FinTSDialogInitError: Couldn't establish dialog with bank, Authentication data wrong?

[henryk]

However, the cause of the present report is slightly different (but related). As per Sicherheitsverfahren PIN/TAN B.4.3.1. they only allow one-step TAN mechanisms for synchronization, not for the actual dialog. The library would normally automatically select the first two-step TAN mechanism, but cannot find any here and thus falls back to security_function='999'. Which is then rejected. We carry on while the bank aborts the dialogue.

Issue n+1: Maybe an abnormal dialog termination should cause an exception?

Code:

f.get_sepa_accounts()

init:
Send (with security_function=998): HKIDN, HKVVB, HKSYN
Receive: HIRMS(3920: ['900']), HIBPA, HIBPD, HITANS2 (['900', '901']]), HITANS5 (['902']),
Auto-select security_function to be 999 (since we didn't find a common subset between ['900'] and ['902'])
Send (with security_function=999): HKEND
Receive: HIRMG

actual get accounts, with implicit establish dialogue:
Send (security_function=999): HKIDN, HKVVB
Receive:

                        fints.segments.dialog.HIRMG2( # Rückmeldungen zur Gesamtnachricht
                            header = fints.formals.SegmentHeader('HIRMG', 3, 2), # Segmentkopf
                            responses = [ # Rückmeldung
                                        fints.formals.Response( # Rückmeldung
                                            code = '9050',
                                            reference_element = None,
                                            text = 'Die Nachricht enthaelt Fehler.',
                                        ),
                                        fints.formals.Response( # Rückmeldung
                                            code = '9800',
                                            reference_element = None,
                                            text = 'Dialog abgebrochen',
                                        ),
                                ],
                        ),
                        fints.segments.dialog.HIRMS2( # Rückmeldungen zu Segmenten
                            header = fints.formals.SegmentHeader('HIRMS', 4, 2, 4), # Segmentkopf
                            responses = [ # Rückmeldung
                                        fints.formals.Response( # Rückmeldung
                                            code = '9955',
                                            reference_element = None,
                                            text = 'Unzulässiges TAN-Verfahren.',
                                        ),
                                        fints.formals.Response( # Rückmeldung
                                            code = '3920',
                                            reference_element = None,
                                            text = 'Verfügbare TAN-Verfahren: iTAN.',
                                            parameters = [
                                                    '900',
                                                ],
                                        ),
                                ],
                        ),

Send (security_function=999) HKSPA1
Receive:

                        fints.segments.dialog.HIRMG2( # Rückmeldungen zur Gesamtnachricht
                            header = fints.formals.SegmentHeader('HIRMG', 3, 2), # Segmentkopf
                            responses = [ # Rückmeldung
                                        fints.formals.Response( # Rückmeldung
                                            code = '9050',
                                            reference_element = None,
                                            text = 'Die Nachricht enthaelt Fehler.',
                                        ),
                                        fints.formals.Response( # Rückmeldung
                                            code = '9800',
                                            reference_element = None,
                                            text = 'Dialog abgebrochen',
                                        ),
                                        fints.formals.Response( # Rückmeldung
                                            code = '9010',
                                            reference_element = None,
                                            text = 'Die angegebene Bankreferenz ist nicht gueltig.',
                                        ),
                                ],
                        ),
                        fints.segments.dialog.HIRMS2( # Rückmeldungen zu Segmenten
                            header = fints.formals.SegmentHeader('HIRMS', 4, 2, 3), # Segmentkopf
                            responses = [ # Rückmeldung
                                        fints.formals.Response( # Rückmeldung
                                            code = '9110',
                                            reference_element = None,
                                            text = 'Ungueltige Auftragsnachricht: Unbekannter Aufbau.',
                                        ),
                                ],
                        ),

[henryk]

Workaround: For now you can restore pre-2.0 read-only capability with a manual set_tan_mechanism call:

f = FinTS3PinTanClient(....)
f.set_tan_mechanism('900')
with f:
 accounts = f.get_sepa_accounts()
 print(f.get_balance(accounts[0]))
 print(f.get_transactions(accounts[0]))

[elohmeier]

@henryk thanks for that workaround! I've switched to 2.0.0 now.

[mdriesch]

@elohmeier Sorry for contacting you on this issue via GitHub, but I tried to connect to DKB using FinTs (Version 2.0.1) and I just can't seem to make it. You mentioned in your first comment, that you were able to connect to DKB. I just wanted to know, whether you have used some special settings to connect ?

Many thanks in advance.

[henryk]

@mdriesch DKB is part of my test cases and worksforme. I am still on iTAN though, so there might be unexercised behaviour with other TAN methods.
Following is my test code:

import getpass, logging, pprint
from fints.client import FinTS3PinTanClient

logging.basicConfig(level=logging.DEBUG)

f = FinTS3PinTanClient(
    '12030000',  # Your bank's BLZ
    'ACCOUNTNUMBERGOESHERE',  # Your login name
    getpass.getpass('PIN:'),  # Your banking PIN
    'https://banking-dkb.s-fints-pt-dkb.de/fints30'
)

with f:
    accounts = f.get_sepa_accounts()
    txns = f.get_transactions(accounts[0])

pprint.pprint(txns)

Please post exceptions if there are any. If there's a problem with the TAN mechanisms we also need "Zugelassene Zwei-Schritt-Verfahren für den Benutzer" parameters, and all the HITANS segments for diagnosis.

[elohmeier]

@mdriesch
I'm using the following code:

url = "https://banking-dkb.s-fints-pt-dkb.de/fints30"
blz = "12030000"

with FinTS3PinTanClient(blz, username, password, url) as client:
    accounts = client.get_sepa_accounts()
    account = accounts[0]  # always use first account

    balance = client.get_balance(account)
    statement = client.get_transactions(account, begin, end)

I login using my username and password, I don't use any two-factor-auth.
I'm using this package to fetch the transactions and balance.

[mdriesch]

Thank you both for your swift response. I'm sorry for having bothered you, but everything works fine for me now (I was missing a digit on my blz 😁 (and in return getting the error message ValueError: Could not find system_id, which seems obvious now, but unfortunately not during my search for problem resolution)).

[elohmeier]

@mdriesch don't worry, cool that it works now :-)