Verification types in the base system

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Verification types in the base system

    Verification types in the base system serve as templates to design custom verifications for user identity confirmation, especially in password reset processes. These types vary in method and support across applications like the Password Reset and Password Reset Windows Application.

    Show full answer Show less

    Verification Types and Their Use Cases

    • Personal Data Confirmation: Allows a service desk agent to verify user identity by reviewing data from the User [sysuser] table. No user enrollment required. Recommended for agent-assisted verification. Not supported in the Password Reset Windows Application.
    • Personal Data: Requires users to answer identity questions based on data from the User [sysuser] table without enrollment. The Password Reset Windows Application supports multiple verifications of this type.
    • Email Code: Sends a verification code to the user's registered or authorized email during password reset. Users confirm their identity by submitting this code. Multiple verifications of this type are supported in the Password Reset Windows Application.
    • Google Authenticator: Uses a time-based code from the user's paired Google Authenticator app for verification during password reset. Only one SMS Code verification is supported in Password Reset and its Windows Application.
    • Security Questions: Users verify identity by correctly answering personal security questions. Both Password Reset applications support only one Security Questions verification. Custom questions can be added.
    • SMS Code: Sends a code to an authorized SMS-capable device during password reset for user verification. Only one SMS Code verification is supported in Password Reset and its Windows Application.
    • Mock: A non-functional verification type used for demonstration purposes in Password Reset processes. Not supported in the Password Reset Windows Application. It allows capturing user input during enrollment and verification phases but does not verify identity.

    Practical Considerations for ServiceNow Customers

    • Choose verification types based on whether the process is agent-assisted or user self-service.
    • Note limitations on the number of verifications supported per type in Password Reset applications.
    • Use Personal Data Confirmation for service desk scenarios; use Personal Data or Email Code for user self-service workflows.
    • Customize verification questions and types as needed to enhance security and user experience.
    • Understand that some verification types, like Mock, are for demonstration and not for production use.

    Use a verification type in the base system as a template to design a custom verification.

    Table 1. Verification types in the base system
    Verification type Description
    Personal Data Confirmation Verifies user identity using data from the User [sys_user] table. The user data is displayed to a service desk agent. The agent verifies the data.

    Enrollment is not required for this type.

    Recommended for service desk-assisted processes.
    Note:
    The Password Reset Windows Application does not support the Personal Data Confirmation Verification type.

    See Personal data identification types and confirmation type verifications.
    Personal Data Verifies user identity using data from the User [sys_user] table. The user is required to answer questions.

    Enrollment is not required for this type.

    Note:
    The Password Reset Windows Application allows you to define and use multiple verifications of the Personal Data type.
    See Personal data identification types and confirmation type verifications.
    Email Code When a user requests password reset, the system sends a verification code to the email address in the user profile or to an email address that the user authorized during enrollment. To verify identity, the user then submits the code on the Password Reset Verify page.
    Note:
    The Password Reset Windows Application allows you to define and use multiple verifications of the Email Code type.
    See Personal data identification types and confirmation type verifications.
    Google Authenticator While requesting password reset, the user reads a code from the Google Authenticator app on a device that the user has paired. To verify identity, the user then submits the code on the Password Reset Verify page.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the SMS Code type.
    Security Questions Verifies user identity by presenting personal security questions that the user must answer correctly.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the Security Questions type.

    See Add a custom question to the Security Questions verification.
    SMS Code When a user requests password reset, the system sends a code to an SMS-capable device that the user has authorized. To verify identity, the user then enters the code on the Password Reset web page.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the SMS Code type.
    See SMS Code Verification type for Password Reset.
    Mock Not a functional identity verification. Demonstrates how to add a verification type in a Password Reset process.
    Note:
    The Password Reset Windows Application does not support the Mock verification type.
    • The enrollment UI macro for this verification gets the user input and returns the entered value in the enrollment processor.
    • The Password Reset UI macro for this verification gets input from the user and returns the entered value through the verification processor.