Skip to main content

Entrust Identity Verification

Entrust Identity Verification lets you verify user identity during onboarding using government-issued ID scanning and face biometrics. For Entrust IDV documentation, see Entrust Identity Verification documentation. This guide explains the problem that Entrust Identity Verification solves, how it compares to Identity Provider verification, and when to use it.

Overview​

Organizations that use Entrust Identity as a Service (IDaaS) often need to verify the identity of new users before granting access to applications and resources. Traditionally, this verification relies on an external SAML or OIDC Identity Provider: the user authenticates with the Identity Provider, and IDaaS confirms the returned claims match the expected user attributes.

While Identity Provider verification works well when an established Identity Provider is already in place, it has limitations:

  • Not all organizations have an external Identity Provider available for user verification.
  • Identity Provider verification confirms that a user can authenticate with the Identity Provider, but it does not confirm that the person behind the screen matches a physical identity document.
  • Organizations in regulated industries may require stronger identity assurance than a federated login can provide.

Entrust Identity Verification addresses these gaps by offering document-based identity verification combined with face biometrics. Users scan a government-issued ID and complete a facial recognition check. On successful verification, IDaaS sets the user status to Verified and automatically provisions a Face Authenticator that the user can use for future authentication.

How it works​

Entrust Identity Verification uses the Entrust Identity Verification SDK to guide users through a document and biometric verification flow. The high-level process is as follows:

  1. An administrator enables Entrust Identity Verification in the user verification policy settings.
  2. When a user signs in for the first time (or when verification is required), the verification page presents the option to verify with Entrust Identity Verification.
  3. The user scans a government-issued ID document (for example, a passport or driver license) using the Entrust Identity Verification SDK in the browser or on a mobile device.
  4. The user completes a facial recognition check to confirm they match the ID document.
  5. Entrust Identity Verification processes the verification and returns a result to IDaaS.
  6. If the verification succeeds, IDaaS sets the user status to Verified and automatically creates a Face Authenticator associated with the user.

The auto-provisioned Face Authenticator is immediately available for future authentication. Administrators can configure it as a second-factor authenticator for scenarios such as password recovery, enabling users to reset a forgotten password with a face scan instead of relying on email or SMS.

Verification options compared​

IDaaS supports two approaches to user verification. You can enable one or both, depending on your requirements.

AspectIdentity Provider verificationEntrust Identity Verification
Verification methodSAML or OIDC Identity Provider authenticationGovernment-issued ID scan and face biometrics
Requires an external Identity ProviderYesNo
Identity assurance levelDepends on the Identity ProviderHigh: combines document verification with biometric matching
Auto-provisions an authenticatorNoYes: creates a Face Authenticator on success
Supports web and mobileYesYes
Can be combined with the other optionYesYes

When both options are enabled, users can choose their preferred verification method during onboarding.

When to use Entrust Identity Verification​

Consider enabling Entrust Identity Verification in the following scenarios:

  • No external Identity Provider available: Your organization does not have a SAML or OIDC Identity Provider to use for verification, or you do not want to depend on one for onboarding.
  • High-assurance identity verification: Regulatory or compliance requirements demand that users prove their identity with a government-issued document and a biometric check, not just a federated login.
  • Defense in depth: You want to offer both Identity Provider verification and Entrust Identity Verification so that users have a fallback option if one method is unavailable.
  • Passwordless recovery: You want to auto-provision Face Authenticators during onboarding so that users can use face biometrics for password recovery and second-factor authentication without a separate enrollment step.

Best practices​

Follow these recommendations when deploying Entrust Identity Verification:

  • Configure Face Biometrics first. Entrust Identity Verification requires a fully configured Entrust Identity Verification account and Face Biometric authenticator with valid registration and authentication workflow IDs. Complete the account setup before enabling the feature. See Manage Face Biometrics with Entrust Identity Verification.
  • Offer multiple verification methods. When possible, enable both Identity Provider verification and Entrust Identity Verification. This provides a fallback if one method is temporarily unavailable and gives users flexibility during onboarding.
  • Leverage the auto-provisioned Face Authenticator. After verification, the Face Authenticator is available for password recovery and second-factor authentication. Configure password reset to accept Face Biometric as a second factor to improve the user experience.
  • Test before a broad rollout. Verify the end-to-end flow, including the Entrust Identity Verification SDK experience on web and mobile, with a small group of users before enabling Entrust Identity Verification for your entire organization.

Next steps​