ARC-IB Administration Guide
ARC-IB Administration Guide
User Guide
No part of this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written permission of TEMENOS Holdings NV.
Table of Contents
Overview.................................................................................................................................................. 4
Concept of AA module ......................................................................................................................... 4
Setup ....................................................................................................................................................... 4
T24 Arrangement Architecture module (AA)........................................................................................ 4
HELPTEXT.MENU ............................................................................................................................. 12
EB.COMPOSITE.SCREEN................................................................................................................ 13
PROPERTY CLASSES...................................................................................................................... 15
Create AA.PROPERTY RECORDS ............................................................................................... 16
ARRANGEMENT.PREFERENCES (Property Class) .................................................................. 18
Overview of each Class ..................................................................................................................... 20
Create CONDITIONS for each PROPERTIES DEFINED.............................................................. 21
Item 1 Create condition for ARRANGEMENT.PREFERENCES (Property Class) ........................ 21
Item 2 create a condition for CUSTOMER (Property Class) .......................................................... 22
Item 3 create a condition for USER.RIGHTS (Property Class) ..................................................... 24
Item 4 create a condition for PRODUCT.ACCESS (Property Class) ............................................. 24
Item 5 create a condition for PROTECTION.LIMIT (Property Class) ............................................ 25
Item 6 create a condition for UI.APPEARANCE (Property Class) ................................................. 25
Item 7 create a condition for UI.BEHAVIOUR (Property Class)..................................................... 26
Setup GROUP Using COS AA.PRODUCT.DESIGNER-PRODUCTS .............................................. 27
Setup the PRODUCTS in the DB.TEST defined. .............................................................................. 30
Proof and publishing .......................................................................................................................... 32
Generate Arrangement ID.................................................................................................................. 35
Create user with EB.EXTERNAL.USER ............................................................................................ 39
Login To ARC-IB URL........................................................................................................................ 41
Additional Set up ................................................................................................................................ 42
Logging in methods for users ......................................................................................................... 42
Transaction signing using challenge response .............................................................................. 51
Set up secure messages ................................................................................................................ 55
Creation of Account Mandates ....................................................................................................... 59
Intermediary Services/Proxy Permissions...................................................................................... 75
Enquiries................................................................................................................................................ 95
!EXT.Variables ................................................................................................................................... 95
EB.External.User ............................................................................................................................ 95
!VARIABLEs in SMS ...................................................................................................................... 95
!EXT.SMS.EXTERNAL.CUSTOMER ............................................................................................. 96
Overview
The ARC Internet Banking (ARC-IB) product is aimed at providing the bank’s customers and approved
intermediaries with access to their account through the internet using secure authentication methods
and security..
Concept of AA module
The Concept of the AA modules setup building block is provided in a document called T24
Arrangement Architecture Product Summary. Please refer to guide for more information.
• ARC-IB.war file can be obtained from [email protected]
• ARC-IB war file needs to be deployed as per standard T24 BrowserWeb.war file into the
Webserver.
• To deploy, copy the ARC-IB.war file into Webserver directory.
• If the Webserver does not auto extract the “war” file into a directory called ARC-IB, then you need
to stop and start the Webserver e.g. shutdown.sh and startup.sh in the bin directory.
• The standard settings like browser name, TCP port number and host IP Address needs to match
the T24 Area configured in TCServer Listener and TCP port number. Please refer to the following
document for details setup option.
• T24 Arrangement Architecture module AA and AI is used to setup internet user access
Useful documents.
• Browser Installation & Configuration user guide
• Browser Security guide
You can have one ARC-IB URL for internet users and one BrowserWeb URL for intranet internal users
connecting to the same T24 system as shown below
Setup
ALL THE FOLLOWING SET UP IS DONE IN INTERNAL BROWSER.
Also check the COMPANY record has the application AA and AI defined.
2. USER.SMS.GROUP record AI.PERS (this can be called anything you want, here we call it
AI.PERS for demonstration purposes). The created record allows or restricts user action depending on
what functions are selected. This record will be used in our setup example.
Note the functions set here are dependent on the client usage of your ARC-IB system.
3. The USER record which you will create next, is used for the external users, so can be heavily
restricted.
Check that the created user ARCUSER is valid and log into T24. If log in fails then check the start and
end date or the attempts are valid.
The ARC-IB. parameter files need to be edited to match server details. They are located within the
ARC-IB directory.
channels.xml - Edit the server, port and name details to match local information
An ARC adapter and listener must be created as below. The ARC adapter must be the same name
created in the OFS.SOURCE earlier (ARC is the easiest)
OFS.SOURCE ID
HELPTEXT.MENU
The next stage is to create what the external user will see when they log in. The first part of set up is
to create a record in HELPTEXT.MENU with the version or enquiry you wish to attach eg FT like
below with a relevant record name eg AI.PAYMENTS. Any application attached must have the “I F3” so
a new deal can be entered and the version must be a self authorising one so there is no need for a
secondary authoriser.
Then create a new record called AI.MAIN in HELPTEXT.MENU and link to the above.
Note the AI.PAYMENTS has been entered into the AI.MAIN record
EB.COMPOSITE.SCREEN
Then you must create EB.COMPOSITE.SCREEN for AI.MAIN.HEADER which also forms part of
the external user log in screen
Note all the URL listed in this screen will be found in the ARC-IB directory
PROPERTY CLASSES
The setup we will be showing uses pre-defined screens created for AA. Our set up here is for an
internet banking system only.
The AA.PROPERTY “name” can be anything but there is a maximum character of 15.
The Product Conditions “name” can be anything as per the AA.PROPERTY.CLASS with maximum
character of 60.
b. After creating Properties and Conditions, next step is to create a Group and a Product using AA
Menu, Product Builder, Products application.
Now click on “Product Builder” and then the “Property Classes” and Properties” menu items.
You should get a new pop-up window as shown below.
Once open input the GB Description and Full Description and check the Property Class is
ARRANGEMENT.PREFERENCES, you can then COMMIT
After commit you will see the screen shown below and the property definition name created
Then commit .
Next click on negotiation rules tab and select default negotiation as yes then commit .
Next click on negotiation rules tab and select default negotiation as yes then commit .
Next click on negotiation rules tab and select default negotiation as yes then commit .
Next click on negotiation rules tab and select default negotiation as yes then commit .
The flow type is a generic field specifying the type of action flow to be performed.
FIRST.LOGIN is used on initial login for customers to accept the terms and conditions. EVERY.LOGIN
is used for normal day to day use. Once the terms and conditions are accepted by the customer then
the ACCEPT TC field in EB.EXTERNAL.USER is updated to YES.
Note- the terms and condition page must be set up separately, please see your account manager for
local requirements of initial login procedures.
The flow type is linked to the flow value and shows what to display at this point in the workflow. This
should be either an EB.COMPOSITE.SCREEN record Id or a URL to a static page.
Property Class ARRANGEMENT PREFERENCES with the property defined earlier e.g. DB.TEST.
Do the same for all 7 properties defined by using the add multi-value field
Button.
After inputting all 7 properties click on Mandatory check box for CUSTOMER and USER.RIGHTS
properties.
Click on validate a deal icon to check no error message. Then commit the deal.
You will get a read only view of the defined properties after commit.
Click on the blue play button at INTERNET.SERVICES within Product lines and again at
INTERNET.CLASS.OF.SERVICE within Product groups
Click on the manage icon (gear & spanner). You will get a screen like below.
Input a GB DESCRIPTION and select PROOF for ACTION Field plus T24 date for AVAILABLE DATE
field. Then validate and commit.
Generate Arrangement ID
From the Menu Tab AA, click on the front office sub tab and then the product catalogue composite.
Next to generate a new Arrangement ID click on the new page icon for DB.TEST
This will pop-up another window as shown on the next page.
Now you need to Logout and login as a different user to authorize the new record, by clicking on AA
Menu, Front Office and the Manage Arrangement option.
This will launch an enquiry selection window, where you can enter several different forms of data to
bring up your arrangement.
Take note of the Arrangement number as this will be needed in the EB.EXTERNAL.USER
application.
Now after creating the EXTERNAL.USER, you can launch the ARC-IB URL e.g.
http://localhost:8080/ARC-IB/servlet/BrowserServlet
Enter the User ID 111222333 and a password e.g. 123456 and click Login or Enter.
When you successfully login the screen layout and menu designs created earlier will appear.
Additional Set up
Logging in methods for users
Below is the set up for using different login methods.
EB.CHANNEL
New channel records are created in EB.CHANNEL.
EB.EXTERNAL.USER
INTERNET.OTP-PIN
When logging in using the OTP-PIN credential, the corresponding arrangement is displayed to the
user. The Auth Type is selected accordingly.
INTERNET.OTP
When logging in using the OTP credential, the corresponding arrangement is displayed to the user.
The Auth Type is selected accordingly.
INTERNET.PW
When logging in using the PW credential, the corresponding arrangement is displayed to the user. The
Auth Type is selected accordingly.
INTERNET.PW-MW
When logging in using the PW-MW credential, the corresponding arrangement is displayed to the user.
The Auth Type is selected accordingly.
Binding to 4TRESS
On clicking the “Please Register here” link, the user will be redirected to the Registration page for
binding OTP and PIN to 4TRESS.
OTP and PIN need to be bound to 4TRESS first and only after successful binding can the user use
these credentials for logging into ARC.
VERSION: New field has been added to version to link Challenge Response Table and. ID of the
EB.CHALLENGE.RESPONSE table should be mentioned in the “Chall Resp” field of the CONFIRM
version.
OVERRIDE: The following records have been added to OVERRIDE table and the attribute
“CHALLENGE RESPONSE” has been added to the “Approve method” field.
Enquiry for external customer to read their messages from the bank.
Above is a basic created enquiry which can be linked to the external user screen.
The PREDEFINED.SELECTION in the record above is populated with “TO STATUS EQ UNREAD“.
This will filter out all the read messages, and only display the unread messages.
EB.MANDATE.
The above EB.SIGNATORY.GROUPS is then linked into the EB.MANDATE record. This is keyed on
the customer record with a given sequence number. This contains information on the signatory groups
required for authorisation of transactions within a given range. This also specifies the minimum
signatories required for a particular transaction involving the same customer.
EB.MANDATE.PARAMETER
This table is keyed based on a valid T24 application. This contains information on the location of
amount field, customer field to be looked up for every application. This controls the application allowed
to be accessed by the external user.
The mandate record field is populated with the EB.MANDATE records set up for this customer and
associated account.
EB.EXTERNAL.SIGNATURE
Based on the previous tables two ARC user Julie and Richard are established. This means that for
transactions less than 50,000 either two department heads or one manager have to sign.
This gives explicit permission for a Proxy (Intermediary) (defined by his Customer number) to access a
Customer’s specific accounts, arrangements, contracts and portfolios. Several Proxies may act on
behalf of a single Customer.
All Customers who have Proxies acting for them must have an AA arrangement which consists of the
AA property classes: CUSTOMER and PROXY.PERMISSIONS. This should be an AA Product in a
new AA Product Line called PROXY.SERVICES.
AA.PROXY.PERMISSIONS
There is a PROXY.SERVICES
Arrangement for each Internet
user who has access to the
Corporate CUSTOMER Corporate’s accounts
CUSTOMER PROXY.SERVICES
ARRANGEMENT
~~~~~~~~~
~~~~~~~~~ CUSTOMER Corporate employee user 1
~~~~~~~~~ PROXY.PERMISSIONS
~~~~~~~~~ PROXY 1
~~~~~~~~~ ACCOUNT 1
~~~~~~~~~ ACCOUNT 7 Every user has their own
ACCOUNT 9 arrangement. There are
PROXY.SERVICES different classes of service for
ARRANGEMENT corporate users e.g. inputter,
CUSTOMER
view only, inputter and
PROXY.PERMISSIONS authoriser, administrator.
PROXY 2
ACCOUNT 1 Generally these do not need to
ACCOUNT 7
ACCOUNT 9
be specific to a single corporate.
PROXY.SERVICES INTERNET.SERVICES CUSTOMER
ARRANGEMENT ARRANGEMENT
~~~~~~~~~
CUSTOMER CUSTOMER ~~~~~~~~~
PROXY.PERMISSIONS ~~~~~~~~~ ~~~~~~~~~
PROXY 3 ~~~~~~~~~ ~~~~~~~~~
ACCOUNT 1 ~~~~~~~~~ ~~~~~~~~~
ACCOUNT 3 ~~~~~~~~~ ~~~~~~~~~
ACCOUNT 5 ~~~~~~~~~
ACCOUNT 7 USER.RIGHTS
ALLOWED CUSTOMER 1
PROXY ARRANGEMENT 1
Customer record so
bank knows details of
Normally for corporate users user
there will only be one allowed
customer. However, employees
of a parent company may have EB.EXTERNAL.USER
access to accounts of CUSTOMER
subsiduaries, so there would ~~~~~~~~~~
ARRANGEMENT
then be an entry for the parent ~~~~~~~~~
~~~~~~~~~
and each subsidiary ~~~~~~~~~
~~~~~~~~~
To create a proxy permission the following files need to be created in AA, for a more detailed
explanation of the relevance of these files please refer to the AA user guide.
Example of an AA.PROPRTY
Example of an AA.PRODUCT.GROUP
Example of AA.PRODUCT.DESIGNER
An example AA.PRD.DES.CUSTOMER
Example of AA.PRODUCT.MANAGER
Once all the above records have been created you need to proof and publish the records to check all
conditions are correct. If you have done something wrong you will receive an error on the above
application AA.PRODUCT.MANAGER.
Once this has been accepted and published then the product will be created.
The above shows a record of what has been done to the new product.
Next create the actual AA.ARRANGEMENT.
To create the access for the ARC user you need to set up the following:
First create a SMS group that will restrict/allow access to the applications in T24, this can be a group
rather than creating one for each customer:
Product line called INTERNET.SERVICES within the product are property classes, we need to update
the AA.PRODUCT.CONDITION for user rights.
So in the classes USER.RIGHTS we have several Product Conditions, we would then create a
condition called INTERMIDIARY and add the SMS user group AI.INTERMIDIARY to this condition in
the field SMS group.
So now the PRODUCT called INTERMIDIARY has been updated with these SMS conditions which
are linked to the USER RIGHTS.
When creating the AA.ARRNAGEMENT for the external user we will use the Product name
INTERMIDIARY in the field Product for this example.
The user rights is updated with the link to the AA.ARRANGEMENT for DELL under AA00335HVYNH.
The UI behaviour shows the link to the composite screen used for the user.
Then you must create an EB.EXTERNAL.USER record for the proxy user like below
We can see the arrangement ID used AA00335SGRN is taken from the AA intermediary arrangement
set up in the previous screen.
You will know be able to log in as en external proxy user in ARC
Proxy arrangements can be made once the set up as detailed above is complete. The person allowing
their account, portfolio etc to be viewed by an external person (intermediary) must set up the proxy
arrangement.
Enquiries
!EXT.Variables
An enquiry can be run to display information for the !EXT customer, account or any selection criteria
you define. To define a !EXT selection you must first run an ENQUIRY called !EXT.XXX where XXX is
the name you will give to the !EXT selection item. The data you enter in the first selection will then
become the !EXT selection criteria. You can then reference this value in another enquiry selection by
entering !!EXT.XXX in the selection criteria column.
Browser will support setting these !EXT.XXX variables either with values from another field or with a
literal value (such as “123”).
So not only can the variables be set in one Enquiry and used in others but the content can be set from
a field value or a literal as well as from selection data.
The variables can also then be used in context based workflows such as pre-filling fields on a Version
from the Enquiry output and populated variables..
These variables can be used in a version in the AUTOM.NEW.CONTENT field.
Literal values can also be set too. It can be a single literal eg “ACCOUNT” or a string literal with
spaces eg “NEW !EXT ACCOUNT” or , “100069”, “My Customer”, as long as the literal is in speech
marks.
A list of values can also be displayed as long as the values are surrounded by [ ] e.g. [A] [B] [C]
The ENQUIRY called USER.VARIABLES allows the user to list the !EXT content of any !!EXT
variables
EB.External.User
With EB.EXTERNAL.USER, when an external user logs in the following variables are set
automatically.
!EXT.CUSTOMER (Customer number)
!EXT.EXTERNAL.USER (Mnemonic)
!EXT.ARRANGEMENT (Arrangement number)
!VARIABLEs in SMS
The following variables get initialised when the user logs in based on the data and access rights
provided:
• !EXT.SMS.CUSTOMERS
• !EXT.SMS.ACCOUNTS
• !EXT.SMS.ARRANGEMENTS
• !EXT.SMS.CONTRACTS
• !EXT.SMS.PORTFOLIOS
• !EXT.SMS.EXTERNAL.CUSTOMER
!EXT.SMS.EXTERNAL.CUSTOMER
There is a !EXT variable called !EXT.CUSTOMER which is set to the CUSTOMER in the
EB.EXTERNAL.USER. The value in !EXT.CUSTOMER is also assigned
to !EXT.SMS.EXTERNAL.CUSTOMER.
!EXT.SMS.CUSTOMERS
This is to be set to the multi value list of Customer in field ALLOWED.CUSTOMERS in the property class
USER.RIGHTS.
THE customer number entered in the ALLOWED.CUSTOMER field enables access and input of
contracts on behalf of this CUSTOMER.
!EXT.SMS.ACCOUNTS
This will be set as follows:
A. For Direct User (!EXT.SMS.EXTERNAL.CUSTOMER same as Allowed Customer)
Select all ACCOUNT Id’s whose CONDITION.GROUP is that of value specified in AC.GRP.ALLOW
(Note: AC.GRP.ALLOW is a m/v field.)
If no value is specified in AC.GRP.ALLOW or PRODUCT.ACCESS then ACCOUNT Id’s would be
NULL.
B. For Proxy User:
For all the Customers in !EXT.SMS.CUSTOMERS:
The arrangement record (use the AA API AA.GET.ARRANGEMENT) specified in the associated
PROXY.ARRANGEMENT field is read. Then, the list of Accounts specified in the field Account in the
associated PROXY.PERMISSIONS property class (use AA API AA.GET.PROPERTY.CONDITIONS)
is arrived at. If ALL is specified, then the concat file CUSTOMER.ACCOUNT is read to get the list of
Accounts. Now the list of Accounts is scanned and the Account’s whose CONDITION.GROUP is that
of value specified in AC.GRP.ALLOW is taken as the value for this variable(Note: AC.GRP.ALLOW is
a multi value field.)
!EXT.SMS.ARRANGEMENTS
A. Direct User:
The AA.ARRAGEMENT file with Customer same as !EXT.SMS.EXTERNAL.CUSTOMER is selected
and is added to the value of the variable
B. Proxy User:
For all the Customers in !EXT.SMS.CUSTOMERS:
The arrangement record (use the AA API AA.GET.ARRANGEMENT) specified in the associated
PROXY.ARRANGEMENT field) is read. Then, the list of Arrangement specified in the field
Arrangement in the associated PROXY.PERMISSIONS property class (use AA API
AA.GET.PROPERTY.CONDITIONS) is arrived at. If ALL is specified, then the file
AA.ARRANGEMENT is selected with CUSTOMER EQ !EXT.SMS.CUSTOMERS and is added to the
value of the variable.
!EXT.SMS.CONTRACTS:
A. Direct User:
For the moment we do not have the logic to populate this variable for a Direct User.
B. For Proxy User:
For all the Customers in !EXT.SMS.CUSTOMERS:
The arrangement record (use the AA API AA.GET.ARRANGEMENT) specified in the associated
PROXY.ARRANGEMENT field) is read. The list of Contracts specified in the field Account in the
associated PROXY.PERMISSIONS property class (use AA API AA.GET.PROPERTY.CONDITIONS)
is arrived at and produced as the value for this variable.
!EXT.SMS.PORTFOLIOS
A. For Direct User
The file SEC.ACC.CUST with ID as !EXT.SMS.EXTERNAL.CUSTOMER is read and the list of
portfolio’s of that Customer is arrived at. Now, the portfolio’s which have the MANAGED.ACCOUNT
same as the values specified in PORT.ALLOW is filtered and is added as the value to this variable.
Deal/Transaction processing
Payments
Payments can be made to the customers other accounts with bank, to a loan, credit card or mortgage,
as long as all products are from the same bank the customer is logging into. The displayed data is
editable by the bank using version and enquiries and context workflow within the version.
Note- we did not set up the same menu as above in our set up, they were created earlier.
Confirmation of transaction
Secure messaging
The functionality for EB.SECURE.MESSAGE is for banks to communicate with their customers and
vice versa with classified secure information, such as overdraft results, loans application outcomes,
promotions and offers.
Working process
Our illustration above shows the client new messages when they log in.
Note- We can filter the messages base on the client and message status.
Reading message as external customer, once commit button (green arrow) is pressed, status will
change to read.
Above shows the message status has changed to read as the customer has read the message.
The DAO is defaulted in due to VERSION content, and reply is typed and sent, note the PARENT
MESSAGE ID, as this enables the external customer to follow the message string back to the start.
The message from the bank or customer can be sent from the application EB.SECURE.MESSAGE
and by setting up different enquiries and versions, the sender or recipients can view, reply and delete
messages. The DAO has to have the ACCEPT.MESSAGES field set to yes in the DAO record.
The functionality is dependent on how the user configures the VERSIONS and ENQUIRIES
Account Mandates
Account mandates within T24 can be linked to individual accounts so that there can be more
signatories, a range of signatory levels, and a dependency on the transaction value. These mandates
are available for bank staff to view. Transactions subject to mandate carried out by internal bank
users have the signatories manually entered onto a transaction and then checked by T24 against the
mandate. For ARC Internet Banking the signatories are checked automatically.
Introduction
For ARC IB External Users (e.g. corporate employees) -
1. Who is allowed to enquire on an account
2. Who is allowed to input debit transactions on an account (Funds Transfer, Standing Order,
Bulk Standing Order)
3. The number of signatories and level of signatory and debit amount for a debit transaction on
an account – see example below:
Up to $4,000,000 Y
Up to $200,000 YY
Up to $100,000 YY Y
Up to $50,000 YY Y
Up to $25,000 Y
0-n 1
0-n 0-n EB.MANDATE
0-n
0-n
0-n
1-n People (e.g. Corporate
0-n employees)
ACCOUNT / 0-n EB.SIGNATORY.GROUP CUSTOMER
PORTFOLIO
ACCOUNT
ACCOUNT/ EB.SIGNATORY.GROUP CUSTOMER
PORTFOLIO
0-n 1-n
ACCOUNT
ACCOUNT/ EB.SIGNATORY.GROUP CUSTOMER
PORTFOLIO
ACCOUNT / EB.SIGNATORY.GROUP CUSTOMER
PORTFOLIO
CUSTOMER
The diagram above shows the relationship between the new tables and the existing CUSTOMER
and ACCOUNT tables. Note that:
• An Account, Customer or Portfolio can have zero or more Mandates, which applies to all
applications, different mandates for each application or even different mandates for different
circumstances within the same application. Mandates can be shared by
accounts/customers/portfolios. Note, the mandates would only be shared on customers
where the concept of a ‘Container Customer’ is used.
• A Mandate must have one or more Signatory Groups OR Customers (Corporate employees)
associated with it.
• A Mandate has a single Customer (normally a corporate) associated with it. A corporate
Customer can have several Mandates (maximum is the number of accounts held).
• A corporate Customer, for these purposes, must have one or more Customers (Corporate
employees) associated with it.
EB.SIGNATORY.GROUP:
This table contains the internal organisation structure of a corporate customer. Various groups of
employees (to be stored as T24 customers) of the corporate organization will be grouped together as
an identifiable group. The same group can be linked to the mandate such that appropriate rights can
be provided. For a mandate, the signatories have to be within the group.
Below are examples of an EB.SIGNATORY.GROUP set up for a corporate customer Dell with the
various levels from Director to Section Head.
EB.MANDATE.
The above EB.SIGNATORY.GROUPS is then linked into the EB.MANDATE record. This is keyed on
the customer record with a given sequence number. This contains information on the signatory groups
required for authorisation of transactions within a given range. This also specifies the minimum
signatories required for a particular transaction involving the same customer.
EB.MANADATE.PARAMETER
This table is keyed based on a valid T24 application. This contains information on the location of
amount field, customer field to be looked up for every application. This controls the application allowed
to be accessed by the external user.
The mandate record field is populated with the EB.MANDATE records set up for this customer and
associated account.
EB.EXTERNAL.SIGNATURE
Based on the previous tables two ARC user Julie and Richard are established. This means that for
transactions less than 50,000 either two department heads or one manager have to sign.
For details on implementation of ARC-IB browser on web sphere ,please refer to the user guide on
“Browser Security Guide”