User Onboarding and Authentication

Digital Identity Management provides a flexible and easy user onboarding and authentication experience, allowing your users to self-onboard and authenticate into your system according to your configuration. Organizations can use Digital Identity Management as their user management system to manage the identity of every user who purchases and accesses their applications and services, whether they are communications services like mobile plans, or digital services like streaming content. When a merchant owns the identity of any user, the following are the most integral parts:

Authentication (authN): A user management system verifies that a user is who they say they are. For example, in a typical username/password authentication process, a user tells the system who they are with their username (email address, mobile number, alias), and proves who they are with their password.
Authorization (authZ): A user management system grants a user the right to access a resource or service, after that user has been authenticated. For example, a parent that owns the account for a streaming service is authorized to create and manage the household user group (for example add or remove members, and grant service entitlements). Conversely, a child is authorized to only view content relevant to their age group. The system authorizes each user to access content differently when they sign in to the service.

Key User Capabilities

In addition to verifiable email addresses and mobile numbers, Digital Identity Management also supports the ability for users to register aliases to their User identity as an authentication (authN) ID. An alias is an authN ID with the following characteristics: - It is an alphanumeric string. - It has a minimum of 6, and maximum of 16, character limit. - Its pattern must be distinct from an email address or mobile number pattern. - It has no entity `status` because it cannot be verified like an email address or mobile number. - It is unique across all user authN IDs in Digital Identity Managementand no two users can register the exact same alias. If a user registers an alias, they can use that alias to sign in (with a registered password) instead of their email address or mobile number.

Authenticate with Remember Me cookie for session-based authentication when the user navigates away from a service and then returns back to the service.
Authenticate with Refresh Token for OIDC-based authentication when the user navigates away from a service and then returns back to the service.
Authenticate with a reCAPTCHA (v2/v3/enterprise) Invisible Badge. If a behavior is deemed suspicious, a user needs to answer a challenge (for example, select all images with a fire hydrant) to prove their identity.
Authenticate with Multi-factor Authentication (MFA). A user can register an external channel, or factor, for added security. MFA uses the user’s registered, verified authentication IDs (for example, their email address or mobile), or an RFC-6238 compliant third-party authentication app (for example, Google Authenticator, LastPass, 1Password). MFA is triggered if the user has at least one MFA option set on their User ID, and the user is attempting to authenticate from a new or unknown device.
Onboard and Authenticate with Social Media Account
Magic Link Authentication
One-Time Password Authentication

Parent topic:User Functionalities

Home

Guides

APIs

Key User Capabilities

​Key User Capabilities

Key User Capabilities