PingOne

Introduction to PingOne Verify

PingOne Verify service is a part of the PingOne Neo decentralized identity solution that enables secure user verification based on a government-issued document, live face capture (a selfie), and voice biometrics, ensuring users are who they claim to be. Learn more in PingOne Neo.

Diagram of a PingOne Verify flow

  1. The user ID information is captured on a user’s iOS or Android device using the customer-created Verify app or using a user’s mobile web browser. User ID information can also be captured through the top 5 desktop browsers with an integrated camera or external web camera. After it has been captured, the user ID information is then sent to the PingOne ID Verification service.

    Mobile and desktop web verification does not require a user to download the Verify app.

  2. The PingOne ID Verification service interacts with a SP that verifies the submitted user ID information.

  3. When a user’s ID information is successfully verified, the PingOne ID Verification service approves the user authentication, and the verification status is available through the PingOne Verify APIs and the PingOne admin console.

Learn more in Verify dashboard.

Only the ID verification status is retained by PingOne. Any personally identifiable information (PII data) passed to PingOne is deleted by the ID Verification service.

Identity document verification uses two methods to extract personally identifiable information (PII): barcodes and optical character recognition (OCR). Learn more in A note extracted on data in the Verified Data API doc.

To set up and configure PingOne Verify, you’ll use:

  • The PingFederate admin console to configure the PingOne Verify Integration Kit

  • A mobile or desktop web browser or the PingOne Verify mobile SDKs

  • The PingOne admin console or the PingOne Verify REST APIs

PingOne Verify transactions flow

An authentication policy for PingOne Verify is configured in the PingFederate Integration Kit for PingOne Verify. The authentication policy can enable ID verification for all users in a PingOne environment. Learn more in the PingOne Verify Integration Kit.

  1. When ID Verification is enabled for a user, the user’s first attempts to sign on or register triggers the display of instructions from the mobile or desktop web browser or the customer Verify app created for the iOS or Android device.

  2. The user is instructed to scan a QR code. This code links to an ID Verification transaction ID assigned to the user by the ID Verification service. The ID Verification service then sends the transaction ID to the mobile or desktop web browser or the customer Verify app on the user’s device.

  3. The customer Verify app then instructs the user to submit one of the following:

    • A photo of their driver license or a photo of their passport information page (the page containing their passport photo)

    • A live face photo (selfie)

    • A live sample of their voice

      A live sample of the user’s voice can also be recorded through a support call center and collected by the PingOne Verify APIs.

      If the ID verification fails more than three times in a 1-hour period, the user must wait an hour before trying again.

  4. The mobile or desktop web browser or the customer Verify app sends the collected data to the ID Verification service with the transaction ID received from the ID Verification service.

  5. The ID Verification service then verifies the user information with the SP used for verification. When the ID Verification service receives the results from the SP:

    • The user’s ID verification status is stored in PingOne. Only the ID verification status is retained. Any PII passed to PingOne is deleted by the ID Verification service.

    • For voice verification, PingOne removes identifying features from the user’s raw voice sample to create a voice template. The voice template, or voiceprint, is stored in PingOne for future verifications.

    • If the ID verification wasn’t successful, depending on the policies set in the PingOne Verify Integration Kit, a message and another QR code to scan are displayed in the customer Verify app or the mobile web browser. There is a limit of three attempts per user per hour.

  6. For all subsequent attempts to SSO to PingOne, the authentication policy uses the ID Verification service to check the user’s ID verification status stored in PingOne.

Custom domains

Because PingOne Verify supports custom domains, your domain name can appear in any browser-based user interface that’s presented to end users. PingOne routes your domain name to the relevant PingOne services. Learn more in Domains.

Branding and themes

PingOne Verify supports branding and themes to easily change the look of your registration pages, sign-on pages, and verification pages for a particular environment. Learn more in Branding and themes.

Email and phone notifications templates

PingOne Verify supports email and phone notifications templates so that you can create a notification for end users to verify their email address or phone number. Learn more in Notification templates.

Metrics collection and messaging

PingOne Verify supports metrics collection and messaging for admin users to collect and audit PingOne Verify transaction events, such as the Verify App event. Learn more in Webhooks.

Language localization

PingOne Verify supports language localization so end users can interact with PingOne Verify in their preferred language. Learn more in Configuring PingOne Verify language localization.