Oracle Cloud Infrastructure Documentation

Configuring Fingerprint Biometrics

Use fingerprint biometrics to verify users before sensitive operations in applications integrated with Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM).

How Fingerprint Biometrics Works

Fingerprint biometrics provides on-demand, step-up verification for high-value transactions. An application captures a fingerprint template using a compatible reader and submits a request through supported on-demand authentication APIs. coordinates the verification and returns the outcome to the application.

The application presents the fingerprint prompt, obtains the necessary consent, and decide whether to continue the requested operation. doesn't control the fingerprint reader or make the application's business authorization decision.

Assurance Role

Fingerprint biometrics is a step-up factor for an application that has already identified the user. It isn't a primary sign-in method or an account recovery method. Enabling the factor in an identity domain doesn't add a fingerprint prompt to OCI Console sign-in.

Privacy Boundaries

Before fingerprint enrollment, the application must show the applicable biometric notice and obtain the user's consent. The biometric service handles fingerprint matching and biometric record storage. associates the enrolled biometric record reference with the user.

Enable Fingerprint Biometrics

Configure the fingerprint biometric store and enable the factor in the identity domain used by the application.

Configure Fingerprint Biometrics in the OCI Console

Before you begin

Before you begin, complete these prerequisites:

  • Sign in to the OCI Console as an administrator who can configure the required identity domain.
  • Confirm that the fingerprint biometric service is available in the region you intend to use.
  • Create a biometric store for the fingerprint modality in the supported region and note its Oracle Cloud Identifier (OCID).
  • Configure the required IAM permissions for the identity domain to use the biometric store.
  • Prepare the biometric consent text that users must accept before enrollment.
  • For an application integration, prepare a compatible fingerprint reader and an authorized client configured for the supported on-demand authentication APIs and certificate-based authentication.

Fingerprint Biometric Lifecycle

Applications can register, verify, and remove a user's fingerprint factor through supported workflows.

Register a Fingerprint

After obtaining consent, the application collects a fingerprint template and compatible reader metadata. It submits a registration request through . When registration succeeds, the user's fingerprint factor is associated with the enrolled biometric record.

Verify a Fingerprint

For a sensitive operation, the application prompts for another fingerprint capture and requests comparison with the user's enrolled record. The application uses the returned verification outcome to decide whether the operation can continue.

Remove a Fingerprint

The user can remove the enrolled fingerprint factor through a supported factor-management workflow. Removing the factor also removes the associated biometric record.

Fingerprint Assurance Flows

Use the application-managed fingerprint prompt to enroll users and request step-up verification.

Enroll a User's Fingerprint

  1. The user signs in to the application using its supported authentication method.
  2. The application checks whether the user has enrolled a fingerprint factor.
  3. If enrollment is needed, the application displays the consent notice and obtains consent.
  4. The application prompts the user to use a compatible fingerprint reader and captures the required template and reader metadata.
  5. The application submits the enrollment request through and displays the result.

Verify an Administrator's Fingerprint Before a Sensitive Operation

An administrator signs in to a customer application using its configured sign-in method. When the administrator try a sensitive operation, the application can request fingerprint step-up verification. This flow doesn't change OCI Console sign-in.

  1. The administrator signs in to the application.
  2. The administrator requests an operation that requires extra verification.
  3. The application displays a fingerprint prompt and captures the fingerprint using a supported reader.
  4. The application submits the fingerprint template and reader metadata through the on-demand authentication API.
  5. returns the verification outcome to the application, which allows or denies the operation according to its authorization rules.

Fingerprint Verification Workflow

  1. Capture fingerprint: The application prompts for a fingerprint and collects the biometric input.
  2. Send verification request: The application submits a verification request through IAM.
  3. Request biometric comparison: IAM forwards the verification request to the biometric service.
  4. Compare fingerprint: The biometric service compares the submitted data with the enrolled record.
  5. Return verification result: The biometric service returns the comparison outcome to IAM.
  6. Deliver result to application: IAM returns the outcome to the application for its authorization decision.