Getting started with konfipay

Note: illustrations for this article will be added.

Once the setup wizard has been completed, the client is created and konfipay can be used. Before the first payments are transferred or account transactions are retrieved, a few settings still have to be made. This article summarises these steps – first for a new, empty client and then for a client whose data was migrated from windata professional 9.

Most of the steps described require administration rights in the client.

New client without data migration

For an empty client, the bank connection is set up from scratch. The recommended order:

1. Set up an EBICS contact: Under Master data → EBICS, the EBICS wizard is started via Add. Detailed instructions can be found under EBICS.

2. Check bank accounts: Under Master data → Bank accounts, accounts are created or the accounts synchronised via EBICS are checked (see Bank accounts).

3. Create and invite users: see Creating a new user.

4. Define permissions: see User groups and Permissions.

5. Set up automation: see Automation.

After the data migration from windata professional 9

The migration wizard transfers bank accounts, payment partners, payments, account transactions, EBICS contacts and keys as well as users and user groups. Which data is transferred and which is not is described in the article Datenübernahme aus windata professional 9 (German).

Some settings cannot be transferred automatically for technical or security reasons. They have to be made once by hand after the migration:

1. Import signature keys

In windata professional, the signature key of an EBICS subscriber is stored as a separate file, often on a network drive or an external storage medium such as a USB stick. This file is not part of the backup and is therefore not transferred. Without a signature key, payments cannot be transferred or signed. konfipay points this out in the notification area with the message Missing signature keys.

The import is carried out individually for each affected key:

1. Under Master data → EBICS, EBICS Keys is opened in the toolbar. Above the list, konfipay shows for how many keys there is no signature key yet.

2. The affected key is selected and the key import is opened via Import key.

3. The dialog shows the last known storage location of the key file from windata professional. The key file is selected there (file formats .sign, .p12 or .pfx) and the associated password is entered.

4. The import is completed with Save.

The password of the key is the EBICS password previously used in windata professional. A signature key stored on a chip card cannot be imported. In this case, a new EBICS key is required, which must be initialised again with the bank.

Further information: EBICS keys.

2. Check the user assignment of the EBICS keys

An EBICS key belongs to a specific person who is registered with the bank as a subscriber. In konfipay, the user assignment determines which users may use a key – and thus the linked EBICS contacts. If no user is assigned to a key, all users of the client can use it.

During the data migration, each EBICS key is automatically assigned to the users who worked with this key in windata professional. If no migrated user can be found – for example because the user concerned was not transferred for lack of an e-mail address – the key remains without a user assignment and can therefore be used by all users of the client. The user assignment of each key should therefore be checked and completed if necessary:

1. Under Master data → EBICS, EBICS Keys is opened in the toolbar.

2. The key is selected and opened via Edit.

3. In the User assignment field, the users who may use the key are selected – as a rule, only the key holder.

It is recommended to restrict each key to its holder. Users to whom no key is assigned receive a corresponding notice in konfipay.

3. Enable EBICS contacts for transfer, retrieval and automation

Migrated EBICS contacts are already initialised with the bank and do not have to be set up again. For security reasons, however, all automatic processes are switched off after the migration, and the EBICS password is requested for every transfer and every retrieval. As long as this is not changed, konfipay does not retrieve account transactions, logs or open orders on its own.

For each EBICS contact that is to work automatically:

1. Save the EBICS password: In the EBICS Keys window, the key is selected and the password is stored via Save / delete password. Automation is not possible without a saved password.

2. Activate automation: The EBICS contact is edited. In the Automation (API) section, Send, Retrieve and Synchronize bank accounts are activated as required.

3. Retrieve business cases: The business cases or order types enabled at the bank are not transferred from windata professional. They can be retrieved from the bank via Business cases in the toolbar of the EBICS contact.

Under Automation, it can then be specified how often konfipay carries out the individual tasks (see Automation and EBICS).

4. Check the bank accesses of the bank accounts

The bank access of a bank account determines the route via which payments are transferred (Upload channel) and account transactions are retrieved (Download channel). During the migration, the bank access is only set automatically if a bank account was assigned to exactly one EBICS contact in windata professional. For accounts with several EBICS contacts or none, the bank access remains empty.

Under Master data → Bank accounts, Bank accesses is used to check whether the desired upload and download channel is entered for each account. Further information: Bank accounts and EBICS or SRZ?.

5. Check and invite users

The users from windata professional are created as konfipay users. The following applies:

• Only users with an e-mail address are transferred, because users log in to konfipay with their e-mail address. Users without an e-mail address and users whose e-mail address already belongs to a konfipay user are missing after the migration and have to be created again if required.

• First name and last name are derived from the windata user name and should be checked.

• No invitation is sent. Migrated users are marked with Invitation pending in the user list and can only log in after accepting the invitation.

To invite a user, the user is selected under User management → Users and User → Invite is chosen in the toolbar. With Send invitation, the user receives an e-mail with the activation link. At the first login, the user sets a password and sets up two-factor authentication.

It is advisable to send the invitations only after the permissions have been checked (see next step). Further information: Users.

6. Check user groups and permissions

The user groups from windata professional are transferred as konfipay user groups, and their rights are converted into the konfipay permission model. Since the two models differ fundamentally, a 1:1 transfer is not possible. The conversion is deliberately strict:

• If one of several related rights is blocked in windata professional, the corresponding konfipay function is blocked completely.

• Functions that have no counterpart in windata professional are always blocked in migrated groups. These include User management, User groups, API, Settings, Client, SFTP, Push services and Automation.

• Individual sub-functions without a windata counterpart may also be blocked, for example creating or importing EBICS contacts or viewing transaction details.

• If a migrated group has the same name as a konfipay standard group, the suffix _wd9migration is added.

• Users who did not belong to any user group in windata professional had unrestricted rights there. They are therefore assigned to the standard group Full Access and thus also have access to user management and API keys.

• Accounts marked as private in windata professional are currently not migrated as private and are visible to all users who may view bank accounts. Their visibility can be restricted via content restrictions; details in the article Datenübernahme aus windata professional 9 (German).

Before the invitations are sent, each group should therefore be checked under User management → User groups to see whether its permissions meet the requirements. Missing rights are granted via Edit. The members of the Full Access group need particular attention. Content restrictions, for example for salary payments, are also transferred and should be checked.

Further information: User groups, Permissions and Permission management.

7. Check open payments before the first transfer

Payments from windata professional are transferred with their last known status (see Datenübernahme aus windata professional 9, section Zahlungen und Zahlungsstatus, German). Individual payments that are marked as executed in windata professional are never shown as open in konfipay. Under Submit payments, however, individual payments appear as open if they were still open in windata professional, as well as the individual payments of payments that were created in windata professional but never transferred successfully.

Before the first transfer, all open individual payments under Payments → Submit payments are therefore compared with the status at the bank or with the account transactions – for example because a payment has been transferred by other means in the meantime. Payments that have already been executed must not be transferred again, otherwise they will be executed twice.

For the same reason, parallel operation should be avoided: after the switch, payments should only be transferred via konfipay.

8. Set up data that was not transferred

The following data is currently not transferred and has to be set up again in konfipay if required:

A complete overview of the transferred and non-transferred data can be found in the article Datenübernahme aus windata professional 9 (German).

Further help

The article Navigation in konfipay provides an overview of the user interface. For further questions, the konfipay customer service is available via the question mark symbol in the page header.