Onfido Identity Verification

Onfido support was added to CAS in version 20210427.

Onfido helps companies see real identity – the humans behind the screens – using world-leading AI and identity experts. Your customers can prove their identities, wherever they are, with just an ID and their face.
- from https://onfido.com/

Part 1: CAS CLI Configuration

Onfido needs to communicate with CAS. You’ll need to make a few changes to enable that to happen. Modify your server configuration to expose a subdomain or port for the following required endpoints.

Do not expose these endpoints directly!

You’ll use NGINX or a Cloudflare tunnel for that to reduce any security issue exposure.

Onfido must be able to contact CAS at:
1. https://[master IP]:7743/serverapi/apiv1/identity-check/onfidowh
2. https://[master IP]:7743/serverapi/apiv1/identity-check/submit
You must build a Verification Site, which will be exposed to the public. It must also contact CAS at:
1. https://[master IP]:7743/serverapi/apiv1/identity-check/submit
The endpoints must all be presented/secured as TLS/SSL.
1. Unencrypted/unprotected endpoints will fail!

Choose a method to serve the TLS/SSL endpoints:

Use free NGINX and Let’s Encrypt: https://generalbytes.atlassian.net/l/cp/nfb1x7Xd
- A detailed NGINX server block is described below, click here.
Use a non-free Cloudflared tunnel: https://generalbytes.atlassian.net/l/cp/V4Me1X2b
- Configure the tunnel as HTTPS pointing to [master IP]:7743

Onfido Webhooks

The file /batm/config/onfido is normally used to steer the callback and webhook URLs.

The 2 settings are both optional. Each URL can include a port, but not a path.
CAS will use the contents of /batm/config/hostname unless the following overrides are present:
- webhook.onfidofor the URL for Onfido to contact CAS.
- webhook.verificationSite is the URL for the Verification SIte to contact CAS.
  - Do not confuse this setting with the CAS Organization Verification Site URL (it's different).

webhook.onfido=https://onfido.yourcasdomain.com
webhook.verificationSite=https://yourcasdomain.com:8743

webhook.onfido=https://onfido.yourcasdomain.com demonstrates a Cloudflare tunnel entry.
webhook.verificationSite=https://yourcasdomain.com:8743 demonstrates an NGINX port (no tunnel).

Part 2: Onfido Configuration

Navigate to: https://www.entrust.com/products/identity-verification

Generate an API token to use in the next stage of configuration (“Api Key”).

Register the webhook you created (above) in Part 1: Onfido Webhooks

Part 3: CAS GUI Configuration

Shared instructions: Configuring an Identity Verification Provider

Onfido Specific Organization Settings

Api Key: Use the API token found in Part 2 (above): Part 2: Onfido Configuration

Verification Site URL

: guidelines found here on our Github page.

Onfido region: EU, US, or CA (default = “EU”)

Troubleshooting

Architecture

These key Onfido components are used in the Verification Flow Chart.

User - a customer using ATM and later his mobile to perform the verification.
BATM server - operator’s CAS server that contains all identity data and server that communicates with our terminals.
Verification site - an opensource web server application that runs on a separate server than CAS is. This is the website to which are customers redirected by ATM and which they open on their mobiles at the beginning of the verification process.
1. Links (to your Verification Site) expire in 90 minutes.
Onfido cloud service - Onfido paid identity verification service. CAS server uses its Onfido Verification Provider to talk and listen to Onfido service calls.

Interaction

User (End Customer) visits ATM and requests a registration.
BATM Server obtains an unique applicant’s id and pairs it with an identity (i.e. phone number)
BATM Server calls verification site and tells to Verification Site to expect the visit of an applicant XYZ.
BATM Server sends SMS to a User with a link to a Verification Site to start verification.
User visits the Verification Site, which contains JS+IFRAME to the Onfido verification service.
User goes through complete verification.
Verification site calls CAS and informs it that the applicant has finished the verification.
Onfido performs a background check on the User.
CAS is informed by Onfido that the verification is finished (including the particular result). CAS also downloads the Identity information (e.g. ID card photo) from Onfido service.
BATM Server informs the User by SMS that their registration is finished, and the result.
User is now registered and revisits the ATM and performs the purchase.
Alternatively you can use Open Extension to change the automatic registration for example not to autoregister older people or kids.

Verification Flow Chart:

Notes:

	Onfido results	CAS status of Identity

Onfido results

CAS status of Identity

1

CLEAR

Registered when auto-registration is enabled.

When auto-registration is disabled, the Identity becomes: Awaiting Registration

1	Onfido results	CAS status of Identity
2	SUSPECTED_COMPROMISED_DOCUMENT	Identity rejected
3	SUSPECTED_DATA_CONSISTENCY
4	SUSPECTED_POLICE_RECORD
5	SUSPECTED_VISUAL_CONSISTENCY
6	SUSPECTED_DATA_VALIDATION
7	SUSPECTED_FACE_COMPARISON

	Onfido results	CAS status of Identity

Onfido results

CAS status of Identity

1

REJECTED_AGE_VALIDATION

Rejected.

The customer will need to retry the registration process again.

2

REJECTED_IMAGE_INTEGRITY

	Onfido results	CAS status of Identity

	Onfido results	CAS status of Identity
1	CAUTION_VISUAL_CONSISTENCY	Awaiting registration. Demands manual verification, even if auto registration set up.
2	CAUTION_IMAGE_INTEGRITY
3	CAUTION_DATA_COMPARISO
4	CAUTION_FACIAL_COMPARISON
5	CAUTION_DATA_VALIDATION
6	CAUTION_DATA_CONSISTENCY

NGINX Server Block

This demonstration NGINX server block contains typical settings.

server {
  server_name onfido.yourcasdomain.com;

  access_log /var/log/nginx/onfido_access.log;
  error_log /var/log/nginx/onfido_error.log;

  listen 8743 ssl;
  
  ssl_certificate /etc/letsencrypt/live/yourcasdomain.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/yourcasdomain.com/privkey.pem;
  
   location /serverapi/apiv1/identity-check/onfidowh {
        proxy_pass https://10.3.2.1:7743/serverapi/apiv1/identity-check/onfidowh;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /serverapi/apiv1/identity-check/submit {
        proxy_pass https://10.3.2.1:7743/serverapi/apiv1/identity-check/submit;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}