Verification Enrollment

Passwordless authentication of cidaas (Touch ID, Face Recognition, etc.) will help you seamlessly log in to your desired application without worrying about the authenticity of the actor, which will in turn save you time with our quick, secure, and dependable service.

In this section, we will tell you about passwordless authentication (MFA) with their:

• technical integration
• end-users enrollment process

When client-side encryption is enabled, finish-enrolment may accept encrypted pass_code (for example Pattern / Backup Code). See Client-side encryption.

Technical Integration

API	Description	Link
Enrollment Initiation	The enrollment of a user via authenticator app will provide the URL that is shown e.g as a QR Code in the default user profile.	Link to API
Enrollment Status	This will allow to verify the enrollment status in the User Profile, to determine when to continue the enrollment completion.	Link to API
Enrollment Completion	After successfully authenticating via e.g. the authenticator app, the enrollment completion will finally enroll the user.	Link to API
Add friendly Device Name	In case of using device authentication methods like FIDO2, you can add a user-friendly name.	Link to API
List configured methods	Profile list for display and for delete ids. For FIDO2, each mediums[] entry includes passkey_type (synced | device-bound | unknown).	Link to API
Remove a method	Unenroll TOTP, FIDO2, Pattern, or (as step 2) EMAIL/SMS.	Link to API

Enrollment in the Default User Profile

Configuring the MFA is pretty easy, and these configurations can be done using the following methods.

1. Configure by QR code.
2. Configure by mobile number.

This depends upon the MFA you are configuring.

Note: For Backup code and FIDO these methods do not apply; we have explained those in a different section.

Configure by QR-code

In this method, you just need to scan the QR code and follow the instructions displayed on your phone. This method is used for the following MFAs:

• Touch ID
• Face recognition
• Pattern
• TOTP
• Push

Navigate to the desired MFA

On the user profile dashboard,

1. Go to Login & Security.

2. Scroll down to MFA, and click on Generate QR-code.

   A unique QR code is generated to assist you in configuring MFA on your mobile device.

   Here two APIs will be used one for initiation and one is for the status.

   API	Description	Link
   Enrollment Initiation	The Enrollment of a user via authenticator app, will provide the URL that is shown e.g as a QR Code in the default user profile	Link to API

   Retrieve the Authentication Enrollment Status in the User Profile

   API	Description	Link
   Enrollment Status	This will allow you to verify the enrollment status in the User Profile, to determine when to continue the enrollment completion	Link to API

Scan the QR code

1. Open your phone's cidaas app and select Scan QR Code.

2. Click on SCAN, and scan the unique QR-code on the cidaas website.

Integrate the Authentication Method

Follow the instructions given on the phone to initiate the authentication.

This can vary depending on the enrollment method.

Add a User-Friendly Name

After configuring some of the authentications, such as pattern, push, face recognition, and Touch ID, they need a friendly name to avoid confusion if two people are using the same account on different devices.

API	Description	Link
Add Device Name	In case of using device authentication methods like FIDO2, you can add a user-friendly name	Link to API

The whole flow is as shown below.

You generate the QR code , scan it using the authenticator app, and give a friendly name it.

Configure by Mobile Number

In this method, you just need to enter the mobile number and follow the instructions displayed on the phone. This method is used for the following MFAs, which include

• IVR
• Text message

Note : Email and text message MFA's are by default configured if you have registered using a mobile number and email. Removing them needs two APIs (identity first, then the verification method). See Remove EMAIL and SMS below.

Navigate to the desired MFA

On the user profile dashboard,

1. Go to Login & Security.

2. Scroll down to MFA, and click on Configure.

Enter the Verification code

1. Enter the mobile number.

   A unique verification code is sent via phone call, text message, or email (depending on the MFA you're configuring) to your mobile number or email.

2. Enter the verification code.

Configuring Backup Code

In this method you just need to

1. Navigate to Backup Code.

2. Click configure, you will get the codes displayed as shown below.

3. Note down the codes.

Configuring FIDO

In this method you just need to:

1. Navigate to FIDO.
2. Click on the configure, you will get a popup of the private key.
3. Accept the key, you will get a popup message to place your finger on the fingerprint sensor.
4. Add a friendly name to the FIDO.

API	Description	Link
Enrollment Initiation	The Enrollment of a user via authenticator app, will provide the URL that is shown e.g as a QR Code in the default user profile	Link to API
Enrollment Status	This will allow to verify the enrollment status in the User Profile, to determine when to continue the enrollment completion	Link to API
Add Device Name	When using device authentication methods like FIDO2, you can add a user-friendly name	Link to API

Configuration Success

To confirm that you have successfully configured the MFAs, you can find the configured MFAs on the home screen of your cidaas mobile app as well as on the cidaas website.

Remove configured methods

List enrollments on a self-service profile with a user access token. This is not the public login picker (POST /verification-srv/public/graph/user/setup).

API	Description	Link
List configured methods	Returns configured_list for display and for delete ids.	Link to API
Remove one method	DELETE /verification-actions-srv/users/configurations/{method}	Link to API
Remove one device or passkey	DELETE /verification-actions-srv/users/configurations/devices/{method}/{deviceId}	Link to API

Admin equivalents use {sub} in the path, for example GET /verification-actions-srv/configurations/{sub}.

PUT /user-srv/users/{sub} with mfa_enabled: false only turns off “force MFA”. Enrollments stay and still apply at login.

TOTP, Pattern, FIDO2

Method	Delete
TOTP	DELETE …/users/configurations/TOTP (no id)
One passkey	List first; DELETE …/users/configurations/devices/FIDO2/{id} (mediums[].id)
All passkeys	DELETE …/users/configurations/FIDO2
One Pattern/Push device	DELETE …/users/configurations/devices/PATTERN/{device_id}

Remove EMAIL and SMS

EMAIL and SMS are not device secrets. The address and number live on the user identity. The verification DELETE does not change the user. Call two APIs, in this order:

1. Remove (or unverify) email / mobile_number on the user.
2. Remove EMAIL / SMS as a verification method.

If you skip step 1, the method is seeded as configured again after the next medium verification. If you skip step 2, the enrollment can stay in the configured list.

EMAIL — step 1 (identity)

Self-service (Update user profile): PUT /users-srv/user/profile/{sub} with "email": "". Keep another login identifier (for example username).

Admin: Update user by sub — PUT /user-srv/users/{sub} with "email": "".

To unverify without clearing the value: Change communication medium by admin — POST /user-srv/communication/medium with "medium": "email", "value": "<current-email>", "verified": false.

EMAIL — step 2 (verification method)

curl --request DELETE \
  --url '{base_url}/verification-actions-srv/users/configurations/EMAIL' \
  --header 'Authorization: Bearer {user_access_token}'

Admin: DELETE /verification-actions-srv/configurations/EMAIL/{sub}.

To keep the address for login and only stop EMAIL as a second factor, skip step 1 and omit EMAIL from the application's allowed MFA methods.

SMS is the same pattern: step 1 clear or unverify mobile_number (PUT …/profile/{sub} with "mobile_number": "", or POST /user-srv/communication/medium with "verified": false), then step 2 DELETE …/users/configurations/SMS.

DELETE …/users/configurations (remove all) does not drop SMS or EMAIL. Always use the method-specific DELETE in step 2.

info

Need Support?

Please contact us directly on our support page or reach out to cidaas support at [email protected].