Onfido support was added to CAS in version 20210427.

Onfido helps companies see real identity – the humans behind the screens – using world-leading AI and identity experts. Your customers can prove their identities, wherever they are, with just an ID and their face.

- from https://onfido.com/

Architecture

Before setting up the Onfido it is important to understand key components that the solution consists of following components:.

Components

1. User - a customer using ATM and later his mobile to perform the verification.

2. BATM server - operator’s CAS server that contains all identity data and server that communicates with our terminals.

3. Verification site - an opensource web server application that runs on a separate server than CAS is. This is the website to which are customers redirected by ATM and which they open on their mobiles at the beginning of the verification process.

4. Onfido cloud service - Onfido paid identity verification service. CAS server uses its Onfido Verification Provider to talk and listen to Onfido service calls.

Interaction

1. User (End Customer) visits ATM and requests a registration.

2. BATM Server obtains an unique applicant’s id and pairs it with an identity (i.e. phone number)

3. BATM Server calls verification site and tells to Verification site to expect the visit of an applicant XYZ.

4. BATM Server sends SMS to a User with a link to a Verification site to start verification.

5. User visits verification site. Verification site contains JS+IFRAME to website with Onfido verification service.

6. User goes trough complete verification.

7. Verification site calls BATM Server and informs it that applicant has finished the verification.

8. Onfido is performing background checks on a User.

9. BATM Server is informed by Onfido services that verification is finished with particular result. CAS also downloads identity information such as ID card photo from Onfido service.

10. BATM Server informs the User by SMS that their registration is finished with particular result.

11. User is now registered and revisits the ATM and performs the purchase.

12. Alternatively you can use Open Extension to change the automatic registration for example not to autoregister older people or kids.

Process described above is described bellow in the diagram

Open

Configuration

To use Onfido identity verification in your Operation, you must modify your CAS configuration as described in this article.

Your services behind SSL

• Onfido service needs to be able to call your CAS via webhook. Onfido service requires you to be able to receive its webhook calls via HTTPS using valid SSL certificate.

• Users need to open Verification-site on their mobiles also via HTTPS that has valid SSL certificate.

Hide your services behind HTTPS by our recommended procedure:

Activate Onfido in your Organization settings:

Open

Api Key: Setup your account with them to acquire the necessary API key.

Verification Site URL: guidelines found here on our Github page.

Onfido region: EU, US, or CA (default = “EU”)

Change your AML/KYC settings

Set your Registration requirements to “Nothing. Direct customer to identity verification service via SMS”:

• Set your Authentication methods & limits as you normally would.

• A phone number is (the minimum) required for Authentication.

Choose the Autoregister type:

After Onfido processes your customer at the BATM, any newly proven Identity will be added to one of these two categories: Registered, or Not Registered.

• Click the edit icon on the “Nothing….” button to view this option.

Disabled

• the customer Identity will be added to “Not Registered”

Enabled

• the customer Identity will be added to “Registered”:

Save the AML/KYC setting!

How Onfido works at the BATM:

1. Your customer chooses Registration during a transaction.

2. Their (required) phone number is collected.

3. Your customer will be sent further instructions via SMS (from Onfido). The link expires in 90 minutes.

4. They click through and submit the requested documents.

5. They’re notified of the results via SMS.

Registration procedure on CAS:

• If the Autoregister option is enabled, and the customer is approved, then a new Registered Identity is automagically created.

• If Autoregister is disabled, or Onfido has trouble with any of the submitted documents, then a new “Awaiting Registration” Identity is created.

  • Footnotes at the bottom of the Identity page will show what (if any) documents failed inspection.

Messages to your customers can be set in your Terminal’s Custom Strings:

See https://generalbytes.atlassian.net/l/c/FmAMHNPM for more details about Custom Strings.

Troubleshooting:

If the SMS link steers you to a blank page, please check your hostname file.

See: hostname

Notes: