Step B: Set up a Face Biometric authenticator

To use Face Biometrics with IDaaS for either registration or authentication, you need to create a workflow in Onfido and copy the Workflow ID into IDaaS. Depending on your infrastructure, you create a workflow based on the following requirements:

• Local storage. Face biometrics are stored on the user's device. In this configuration, the user data is not stored in Onfido and can be deleted after registration.
  • Recommended for environments that prioritize user control and privacy by limiting data storage to devices.
  • Works well for mobile-first scenarios.
• IDaaS storage. Similar to local storage except the Face biometrics are stored in IDaaS instead of on the user's device. In this configuration, the user data is stored in IDaaS and can be deleted after registration.
  • This option provides more flexibility for users to use their Face Biometric across multiple devices.

Step 1: Create the required Workflows in Onfido

The following table lists the Onfido registration and authentication templates required for each storage solution. Use the Onfido documentation to help you build the Workflows and copy the Workflow ID, which you will need in Step 2: Configure the Face Biometric authenticator policies in IDaaS.

Table: Workflow templates

Storage Type	Registration Template	Authentication Template
Local storage	Document and Motion with On-device storage	Authentication with On-device storage
IDaaS storage	Document and Motion with Customer Infrastructure storage	Authentication with Customer Infrastructure storage

Create the required Workflows

1. Open the Onfido help for reference.
2. Log into Onfido Workflow Builder.
3. Using the provided Workflow Summary Table, create the required workflows.
4. Open a text editor, such as Notepad. Copy and save the Workflow ID for each workflow template, and note the template name that matches each workflow ID. You will use these workflow IDs in Step 2: Configure the Face Biometric authenticator policies in IDaaS.
5. In the text file, record the Property name of the Authentication Workflow.

Step 2: Configure the Face Biometric authenticator policies in IDaaS

1. Click > Policies > Authenticators. The Authenticators page appears.

2. Click Face Biometric. The Face Biometric page appears.

3. In the Registration Workflow ID field, paste the registration Workflow ID you created in Onfido in Step 1: Create the required Workflows in Onfido.

4. In the Authentication Workflow ID field, paste the authentication Workflow ID you created in Onfido in Step 1: Create the required Workflows in Onfido.

5. Confirm that the Authentication Input Name matches the Onfido workflow input Property name that you noted in Step 1: Create the required Workflows in Onfido.

   note

   The Authentication Input Name is not required for local storage of user biometrics.

6. Set the Renewal Time to the number of days before a user must re-register a Face Biometric.

7. Select the Default First Name Attribute from the drop-down list. This is the first name attribute sent to Onfido for matching verification.

8. Select the Default Last Name Attribute from the drop-down list. This is the last name attribute sent to Onfido for matching verification.

9. Select the device that users will use during registration and authentication:

   • Web to use a Web browser to run identity verification.
   • Mobile to use a mobile device to run identity verification.

10. If you select Mobile for registration and authentication, do the following:

    1. Leave the default setting for Application Launch Scheme.
    2. Enter the Activation Lifetime to set the amount of time in seconds that a user has to activate their Face Biometric.
    3. Select Allow Unsecure Device to allow the Face Biometric to run on an unsecured device (such as custom ROM Androids or jail-broken iOS devices).
    4. Select Enable Mutual Challenge to require users to respond to a mutual push authentication challenge. When enabled, users must match the challenge that appears on the IDaaS page with the mutual challenge shown in their Entrust Identity soft token app.
    5. Select Require Identity Verification to require users to perform face biometric authentication during registration of the selected authenticator.
    info

    Currently, only Entrust Soft Token is available for Identity Verification, and only with mobile devices.

11. Click Save.

Step 3: Create a custom authentication flow and resource rule

Create a custom authentication flow and a resource rule to allow Face Biometric as a second-factor authenticator.

1. Create a custom authentication flow and enable Face Biometric for second-factor authentication. See Create authentication flows.
2. Create a resource rule that uses the custom authentication flow that allows Face Biometric for second-factor authentication. See Create resource rules.

Step 4: Optional. Enable Face Biometric in the Registration policy

To include Face Biometric in the user registration flow, go to the Registration Authenticators list in the Registration policy and set Face Biometric to Required or Optional. See Configure user registration.