Claims

Claim name

Claim name Description Comments
veracityId Veracity Id
  • Shall be used as the unique user identifier for all services on the Veracity platform
  • All lower case
sub Veracity Id/internal Auth0 identifier
  • Was previously the recommended claim that contained the Veracity Id, however, this claim will no longer be able to store the Veracity Id when a service is migrated to the new Identity Provider (Auth0). Therefore, for new services, use veracityId
  • All lower case
aud The identifier (client id) of the app that this token is issued for
  • For id tokens, the value is the client id of the app making the login request
  • For access tokens, the value matches the client id of the app for which you requested an access token (defined in the "scope" value of the login request)
mfa_required Has the value "true" if multi-factor authentication (MFA) was requested for the login
given_name First Name
family_name Surname
name Display Name
email E-mail address
upn Sign in name
  • Will be same as email address for all standard users (some legacy users may have a different value)
mfa
Indicates whether multi-factor authentication (MFA) was part of the logon process (true/false)
mfaMethod
Indicates what type of multi-factor authentication (MFA) was done:
  • none – No MFA
  • totp – MFA was completed using Veracity's MFA solution with verification by code from user's authenticator app
  • phone – MFA was completed using Veracity's MFA solution with verification by SMS or call to user's phone
  • federatedIdp - Only relevant for SSO-based users that log in to Veracity with an account in their own company. This value means that MFA is invoked in the user's own company and Veracity will by design not prompt for MFA again.
authenticatedBy Indicates which organization's Identity Provider authenticated the user.

Obsolete claims - To be deprecated

Claim name Description Comments
mfaType
Legacy - indicates whether multi-factor authentication (MFA) was part of the logon process:
  • none – No MFA
  • phone – MFA was completed using Veracity's MFA solution (either TOTP or SMS/Call)
  • federatedIdp - Only relevant for SSO-based users that log in to Veracity with an account in their own company. This value means that MFA is invoked in the user's own company and Veracity will by design not prompt for MFA again.
  • This claims supports implementations of MFA that was done before TOTP was introduced.
  • Do not use, use "mfa" and "mfaMethod" instead.
  • Will be deprecated at some point, but information will be provided to services well in advance.
myDnvglGuid Veracity Id
  • Do not use, use "veracityId" instead.
  • Will be deprecated at some point, but information will be provided to services well in advance.
userId Veracity Id
  • Do not use, use "veracityId" instead.
  • Will be deprecated at some point, but information will be provided to services well in advance.
dnvglAccountName sAMAccountName/short username
  • Do not use - will be deprecated.
  • Lacks a value for federated users.
myDnvglGuid Veracity Id
  • Do not use, use "veracityId" instead.
  • Will be deprecated at some point, but information will be provided to services well in advance.
oid Object ID
  • Do not use.
  • "veracityId" claim shall be used as unique user identifier.