VeridiumID 3.9 extends server-managed passkey authentication with authentication, device, location, and user behavioural context.
This allows passkey authentication events to be enriched with additional information about the authentication environment and submitted to ILP for risk analysis.
The feature complements the cryptographic security provided by passkeys with additional contextual visibility that can be used for auditing, investigation, and authentication policy evaluation.
The capability applies to Veridium server-managed passkeys and supports context collection through the Veridium mobile SDKs on Android and iOS.
Supported scenarios
VeridiumID supports contextual reporting for two primary passkey authentication scenarios.
Veridium FIDO Server
When a Veridium passkey is used with the Veridium FIDO Server, the passkey authentication takes place within an existing VeridiumID authentication context.
Context collected by the mobile device can therefore be associated with the corresponding Veridium authentication event.
Microsoft Entra passkeys
When a passkey is used for Microsoft Entra authentication, VeridiumID does not control the Microsoft Entra authentication ceremony itself.
The Veridium mobile client therefore collects the authentication context required to identify and correlate the passkey operation, such as relying-party and authentication information.
This enables contextual and behavioural information to be associated with Microsoft Entra passkey authentication even though the relying-party authentication is performed outside the VeridiumID Server.
Context collected during authentication
Context is collected by the Veridium mobile client and associated with the corresponding passkey authentication.
Authentication context
Authentication context identifies where and how the authentication took place.
It can include:
-
Relying Party ID;
-
authentication type;
-
authentication identifier;
-
service identifier and friendly name;
-
authentication start and completion information.
This information is used to correlate the contextual data with the corresponding passkey authentication event.
Device context
Device information available to the Veridium mobile SDK can be associated with the authentication event.
Examples include:
-
operating system;
-
device model;
-
device manufacturer;
-
client information associated with the authentication.
Location context
Location information can be collected from the mobile operating system during authentication.
Location collection is best effort and depends on:
-
device capabilities;
-
operating-system restrictions;
-
location services;
-
permissions granted to the Veridium application.
Location policies configured for the VeridiumID environment continue to apply where applicable.
Behavioural context
Supported behavioural sensor data can also be collected by the mobile SDK and submitted to ILP.
This provides ILP with additional information that can be evaluated together with authentication, device, and location context.
ILP processing
Contextual and behavioural data associated with the passkey authentication can be submitted to ILP for analysis.
The VeridiumID Server associates the resulting ILP information with the relevant passkey authentication record.
The server retains the relevant:
-
authentication context;
-
device context;
-
location metadata;
-
ILP processing result.
Raw behavioural sensor data is forwarded for ILP processing and is not retained as part of the server-side passkey authentication record.
VeridiumID 3.9 contextual passkey reporting should not be interpreted as automatic real-time rejection based solely on an ILP risk score. Authentication behavior remains controlled by the authentication policies configured for the environment.
Synchronous and asynchronous reporting
Passkey contextual data can be delivered according to the reporting policy applicable to the authentication scenario.
Asynchronous reporting
With asynchronous reporting, passkey authentication is not required to wait for contextual data delivery.
If the mobile client cannot immediately submit the collected information, it retains the pending context locally and retries the submission when delivery becomes possible.
This is useful where temporary loss of connectivity or service availability should not prevent contextual information from being reported later.
Synchronous reporting
Where synchronous reporting is configured, contextual information is submitted as part of the active passkey authentication workflow.
This mode can be used for scenarios where the server-side authentication policy must be evaluated before the passkey authentication process is allowed to continue.
The appropriate reporting mode can depend on the relying-party integration and authentication scenario.
Resilient context delivery
Context is persisted locally on the mobile device before successful submission.
This allows pending reporting information to survive conditions such as:
-
temporary network loss;
-
temporary service unavailability;
-
application restarts.
After successful submission, the locally retained reporting data can be removed.
This mechanism allows VeridiumID to preserve the relationship between the passkey event and its contextual information even when immediate network delivery is not available.
Passkey reporting policies
The 3.9 passkey contextual-data design includes policies controlling how reporting is performed.
These include:
Is Passkey Session Report Enabled
Controls whether passkey authentication session context reporting is enabled.
Is Passkey Reporting Async
Controls whether reporting for the applicable passkey scenario is asynchronous.
The reporting mode can be determined according to the relying party and authentication context.
Enforce Location Policies On Passkey
Controls whether the configured VeridiumID location requirements are applied to passkey contextual-data collection.
For example, an organization may require location services or precise location according to its existing location policy.
Authentication policy evaluation remains managed by the VeridiumID policy layer.
Supported passkey use cases
The contextual-data capability is designed for server-managed passkey authentication involving the Veridium mobile application, including scenarios such as:
-
Veridium passkey authentication using hybrid/cross-device authentication;
-
Microsoft Entra passkey authentication using hybrid/cross-device authentication;
-
Veridium passkey authentication using supported BLE transport;
-
Veridium passkey authentication using supported mobile passkey integrations.
Transport availability depends on the mobile platform and the passkey integration being used.
Privacy considerations
Contextual passkey reporting can involve device, location, and behavioural information.
Organizations should configure collection, location requirements, reporting, and retention according to their security requirements and applicable privacy policies.
Location data remains dependent on permissions granted by the device user and restrictions imposed by the mobile operating system.
Passkeys continue to provide their standard FIDO/WebAuthn authentication properties, while VeridiumID 3.9 adds additional context around the authentication event for risk analysis and audit.