Skip to main content

Set up Entrust Identity Verification

Entrust Identity Verification uses Face Biometrics to verify user identity during onboarding. When enabled, users complete a government-issued ID scan and a facial recognition check. On successful verification, the user status is set to Verified and a Face Authenticator is automatically created and associated with the user.

This feature works on both web and mobile. You can use Entrust Identity Verification with SAML or OIDC Identity Provider verification, or use Entrust Identity Verification by itself.

Prerequisites​

Before you enable Entrust Identity Verification, complete the following:

warning

If Face Biometric settings are not fully configured (missing the registration or authentication workflow ID), the Entrust Identity Verification option is not available on the User Verification page. A warning with a link to the Face Biometric settings page appears instead.

Enable Entrust Identity Verification​

Administrators enable Entrust Identity Verification from the User Verification page.

To enable Entrust Identity Verification:

  1. Click > Policies > Registration. The Registration pages appear.
  2. Click User Verification. The User Verification page appears.
  3. Select Verification Enabled.
  4. Under Entrust Identity Verification, select the Entrust Identity Verification checkbox.
  5. Click Save.
info

You must select at least one Identity Provider or enable Entrust Identity Verification when verification is enabled. You can enable both options to give users a choice during verification.

How users complete verification​

When a user signs in for the first time (or when verification is required), the Verification page appears. If Entrust Identity Verification is enabled, users see a Continue with Entrust Verification button.

Web verification flow​

To complete verification on the web:

  1. On the Verification page, click Continue with Entrust Verification.
  2. The Entrust Identity Verification SDK launches in the browser.
  3. Follow the on-screen instructions to scan a government-issued ID document.
  4. Complete the facial recognition check by following the prompts.
  5. After the SDK completes, finalize the verification.

Mobile verification flow​

To complete verification on a mobile device:

  1. On the Verification page, tap Continue with Entrust Verification.
  2. The Entrust Identity Verification flow launches on the mobile device or through a QR code linking to the Entrust Identity app.
  3. Follow the on-screen instructions to scan a government-issued ID document.
  4. Complete the facial recognition check by following the prompts.
  5. After the verification completes, the result is returned to IDaaS.

Verification results​

After the user completes the Entrust Identity Verification workflow, the verification result determines the next steps.

ResultDescription
VerifiedThe user is verified. Their status is updated to Verified and a Face Authenticator is automatically created. The user can proceed to use the application.
Under reviewThe verification requires manual review. The user is notified and must use a different verification method to proceed.
FailedThe verification did not pass. The user can retry or use a different verification method.

Post-verification behavior​

After successful verification, the following occurs:

  • The user status is set to Verified.
  • A Face Authenticator is automatically created and associated with the user. The user does not need to separately register a Face Biometric authenticator.
  • The Face Authenticator is immediately available for future authentication, including password recovery and second-factor authentication.

Use case: Password recovery with Face Authenticator​

After Entrust Identity Verification creates a Face Authenticator for a user, administrators can configure password reset to accept Face Biometric as a second-factor authenticator. This enables users to verify their identity with a face scan when resetting a forgotten password to provide a seamless and secure recovery experience.

To configure this use case:

  1. Enable Entrust Identity Verification to automatically create Face Authenticators for users during onboarding (described in this guide).
  2. Enable password reset and add Face Biometric as an allowed second-factor authenticator for password recovery. See Reset a password and Enable password reset.

When a user forgets their password, they can use the Forgot your password? link and authenticate with their face to complete the password reset.

Next steps​