Skip to main content

User verification

User verification prompts a user to verify their identity before registration or authentication. You can configure verification using external SAML or OIDC Identity Providers, Entrust Identity Verification (Face Biometrics powered by Onfido), or both.

When you enable verification, at least one Identity Provider or Entrust Identity Verification must be selected.

Identity Provider verification​

If you enable user verification for SAML or OIDC Identity Providers, the following applies:

  • Users must verify against an external SAML or OIDC Identity Provider before using an IDaaS application.
  • The user verification process includes first authenticating to IDaaS and then completing the SAML or OIDC Identity Provider authentication.
  • The registration period can be used to authenticate to IDaaS before performing user verification.
  • Authentication includes ensuring that the returned Identity Provider token claims match the expected claims of the user as configured by the administrator.
  • If a user verification message has been configured, users must approve the verification message to complete verification. Verification messages can be customized. See Customize login page text and messages.

See Manage Identity Providers for more information.

Entrust Identity Verification​

If you enable Entrust Identity Verification:

  • Users verify their identity by scanning a government-issued ID and completing a facial recognition check using the Entrust Identity Verification SDK.
  • On successful verification, the user status is set to Verified and a Face Authenticator is automatically created and associated with the user.
  • The auto-provisioned Face Authenticator can be used for future authentication, including password recovery.
info

Before you can enable Entrust Identity Verification, you must configure Face Biometric settings, including your Entrust Identity Verification account and workflow IDs. See Manage Face Biometrics with Entrust Identity Verification.

For an overview of what problem Entrust Identity Verification solves and when to use it, see Entrust Identity Verification. For a complete setup guide including prerequisites, user flow, and use cases, see Set up Entrust Identity Verification.

Configure verification settings​

  1. Click > Policies > Registration. The Registration pages appear.
  2. Click User Verification. The User Verification page appears.
  3. Select Verification Enabled to require users to complete verification the first time they sign in.
  4. Under Identity Providers, select the Identity Providers that can be used for verification. You must select at least one Identity Provider or enable Entrust Identity Verification.
  5. Under Entrust Identity Verification, select the Entrust Identity Verification checkbox to enable Face Biometric verification. This option is only available when Face Biometric settings are configured.
  6. Click Save.
warning

If Face Biometric settings are not configured, the Entrust Identity Verification option displays a warning with a link to the Face Biometric authenticator settings page. Configure Face Biometric settings before enabling this option. See Manage Face Biometrics with Entrust Identity Verification for more information.