Licensing

Clients must ensure they are appropriately licenses in order to use this package. Organisations who wish to use this package are required to establish a commercial relationship with the 3rd party directly.

Compatibility

This package has the following compatibility requirements:

Installation Instructions

To install this package please walk through the following proceedure:

1. Unzip the package to a directory on your computer
2. Import each zip archive found in the services folder to Transact Manager under the Services >> All Services menu item.
3. Review the Help Doc tab for each of the imported services and make any required adjustments to service parameters.
4. Configure any required Service Connections. These requirements can be found at the bottom of this document or in the Help Doc for each of the imported services.

   Service Connections can be configured in Transact Manager under the Services >> Service Connections menu item.

5. Import each archive found in the libraries folder to Maestro.

   Importing these into the Organisation level libraries folder is recommended as this will make the components available to all projects, however they can be imported at the Project level if required.

Legal Considerations

Clients using electronic identity verification are required to understand the legal considerations of doing so and ensure their legal obligations are being met, such as ensuring the capture of an individuals agreement to the T&Cs prior to running the check.

When using this service you are required to accept Trulioo terms and conditions. Business Users are required to obtain consent from individuals to verify the identifying information they provide. Including a consent provision on application forms is recommended.

This package does not deal with these legal obligations which must be considered in the overall flow of the data capture experience.

Usage Instructions

Use the following procedure to configure Trulioo GlobalGateway in your form:

• Add the Trulioo GlobalGateway Verify component onto your page.
• Select the Trulioo GlobalGateway Verify component and on the Properties tab select the Input Data section. In Global Gateway Input Fields, map all required fields into the input data maps.
• In the Rules section, add any processing rules to handle On GlobalGateway Verified and On GlobalGateway Verify Failed events.

Multiple Verification Sessions

If you need to perform id verifications on multiple individuals in a single transaction you will need to add an instance of the Trulioo GlobalGateway Verify component for each individual and specify a Role Identifier (found under Options on the Properties panel) for each instance. For example, if your form supports 2 applicants you would specify a Role Identifier of Applicant1 and Applicant2 respectively. This will ensure that the sessions do not interfere with each other.

Triggering the Checks

Typically you would trigger the GlobalGateway ID checks before the applicant is presented with the identity verification section of the form. This way, if the applicant is verified successfully on the checks alone, then the identity verification section can be excluded from the applicant experience.

You can add the following call to a rule in your form to trigger the checks automatically at an appropriate time:

Form.fireRule("click" ,"verifyButton" , data);

HTTP Audit Logging

For audit purposes the package provides a HTTP Audit feature that records information about each HTTP request call made in the execution of a service. If this feature is enabled at the service level, HTTP request and response information will be logged to a submission property on the transaction for which the request was made. The name of this submission property can be customized to suit your needs.

The audit information will be stored in the submission property as a JSON array with a structure as follows:

[
    {
        "serviceName": "TruliooIdv",
        "executionTimestamp": "2017-08-16 17:43:58 AEST",
        "durationMillis": 147,
        "request": {
            // Request Details
        }
        "reseponse": {
            // Response Details
        }
    },
    {
        "serviceName": "TruliooIdv",
        // Etc...
    }
]

See the documentation for the Trulioo GlobalGateway - Identity Verification service for information on how to enable this feature.

Tamper Proofing

To help combat fraudulent applications this package includes Trulioo GlobalGateway - Tamper Check Groovy service that checks for data tampering to ensure that the data provided at submission time exactly matches the data used to complete the identity verification. To enable this capability you must add a call to the Trulioo GlobalGateway - Tamper Check groovy service, passing in key identity information attributes at the time of submission. If all provided data exactly matches the original identity this service will return a successful result (true), otherwise a failure will result (false).

Configuration

1. Double check the identity data request parameters you want this service to check in Trulioo GlobalGateway - Identity Verification Service parameter: truliooTamperCheckRequestParams. For example, firstName,middleName,lastName,dateOfBirth,buildingNumber,buildingName,unitNumber,streetName,streetType,city,suburb,county,stateProvinceCode,addressCountryCode,postcode,poBox,addressLine1. The name must match the request parameter name that Trulioo GlobalGateway - Identity Verification service accepts.
2. Write a Submission Completed Processor to call the Trulioo GlobalGateway - Tamper Check Groovy service to check the submission data. Below is an example on how to call the service.

   import com.avoka.core.groovy.GroovyLogger as logger
   import com.avoka.tm.svc.*
   import com.avoka.tm.vo.*
   import com.avoka.tm.util.Path
   import javax.servlet.http.*
   
   
   class FluentSubmissionCompletedProcessor {
   
   
       // change this value to match role defined in your form
       final static String ROLE_KEY = ''
       // change to your client code
       final static String CLIENT_CODE = 'exchange'
   
       /**
        * Perform submission completed processor service
        */
       void invoke(SvcDef svcDef, Txn txn, HttpServletRequest request, User user) {
   
           String verifyStatusTxnPropertyName = ROLE_KEY ? "TruliooIdv.${ROLE_KEY}.verifyStatus" : "TruliooIdv.verifyStatus"
           String verifyStatus = txn?.propertyMap?.get(verifyStatusTxnPropertyName)
   
           List identityData = []
           // get identity data and add to identityData list.
   
           if (verifyStatus) {
               // call Tamper Check to verify identity data not modified in any way
               // we don't give identityData on purpse cos we want to use xpath defined in form data extract
               Map params = [
                           "task": "check",
                           "roleKey": ROLE_KEY,
                           "identityData": identityData,
                           "txn": txn
                   ]
   
                   // calling tamper check groovy service
                   boolean success = new GroovyServiceInvoker()
                           .setServiceName('Trulioo GlobalGateway - Tamper Check')
                           .setClientCode(CLIENT_CODE)
                           .setVersionNumber(1)
                           .invoke(params)
   
               logger.info "Tamper Check result=$success"
               if (success==false) {
                   throw new Exception("Tamper Check failed. Identity data has been tampered!")
               }
           } else {
               logger.info "Identity data is not verified by third party service yet. Skip tamper check."
           }
   
   
       }
   }
   

3. In "Form Version" - "Services" section in published form, select the "Submission Completed Processor" above.
4. At runtime, Tamper check will be performed after form submitted. And result will be recorded as a submission property "TruliooIdv.roleName.identityDataTamperCheck" with possible values [passed | failed] to indicate the check result.

Note: you need to manually add this call to your post submit processing functions in order to utilise this feature.

Release Notes

Version 1.0 Sep , 2017

• Baseline release.