Integration of User Registration and Authenticator Activation Using Orchestration

Before the user can use Intelligent Adaptive Authentication, they must complete the registration process and activate their authenticator. Once the device is activated, it can be used for login, event, and transaction data signing operations.

User registration and authenticator activation

Prerequisites for the registration operation

• The mobile application must be integrated with the Orchestration SDK.

• (Optional) Define a static password for users.

Activation status check

Two methods are available to poll the activation status following the register request—synchronous or asynchronous activation.

Synchronous activation—check status

The client application sends the check-status request that is processed after register only once.

The user application server invokes the POST /registrations/check-status endpoint with the following data:

• { "login": " SomeUserID ", "timeoutSeconds": 60 }

  This statement waits for the activation to start. If the user activates the authenticator in 30 seconds, the customer web application will receive the activated response after 30 seconds. If the user does not activate the authenticator within the timeout parameter (60 seconds in this example), the Check Status service will return the following status:

• { "activationStatus": "timeout" }

  The customer web application can then decide to retry with a timeout. In this scenario you should retry later without a timeout and restart the activation process. If the user does not activate the authenticator within the session expiration time (10 minutes), the Check Status service will return the following status:

• { "activationStatus": "unknown" }

Asynchronous activation—check status

The client application pools at a certain interval to get the last status information via the POST /registrations/check-status endpoint, with the following data:

• { "login": "SomeUserID" }

  When the activation is still pending, the Check Status service will return the following status:

• { "activationStatus": "pending" }

  When the activation is successful, the Check Status service will return the following status:

• { "activationStatus": "activated" }

  As soon as this is the case, the pending activation status is reset and the Check Status service will return the following status:

• { "activationStatus": "unknown" }

User deregistration and removal of the authenticator assignment

Sequence of a user deregistration and removal of the authenticator assignment

1. The user starts the deregistration process. The web server forwards the request to the OneSpan Trusted Identity platform API with a call to the POST /users/{userID@domain}/unregister endpoint.

2. The OneSpan Trusted Identity platform API communicates with the Provisioning service to unassign the authenticator license.

3. The TID user is deleted from the OneSpan Trusted Identity platform.

4. The OneSpan Trusted Identity platform API verifies the deregister event data with the Risk Management component.

To deregister the OneSpan Trusted Identity platform user account

• Issue a deregistration request with the POST /users/{userID@domain}/unregister endpoint:

  • Payload:

    • objectType: "AdaptiveUnregisterUserInput"

    • (Optional) cddc:

      • browserCDDC

        • fingerprintRaw

        • fingerprintHash

    • clientIP

    • relationshipRef

    • sessionID

Next Steps

The next step for a full integration of Intelligent Adaptive Authentication is the Integration of User Login and Event Validation via Notification.