A regular OIDC claims request just asks Persona to return attributes like given_name or email. A verified claim goes further: the relying party sends Persona values it already believes are true and asks Persona to confirm them against the identity it verifies, then report back whether they matched. This is the OpenID Connect for Identity Assurance extension to the flow described in Understanding OpenID Connect (OIDC) for Persona Authentications.
Okta uses this extension for its custom Identity Verification (IDV) integration; see How to trigger Persona identity verification within Okta using the Persona IDV integration for the concrete Dashboard and Okta setup steps. This article covers the underlying concepts that integration builds on.
What a verified claim request contains
Where a plain claims request just lists claim names, a verified claim request specifies three things:
- A trust framework, the type of verification being requested. Any relying party can define its own; Okta’s is
IDV-DELEGATED, meaning Okta has no opinion of its own and delegates trust entirely to Persona. - An assurance level, how rigorously the trust framework expects the claim to be checked. Okta only has two:
VERIFIEDandFAILED. - The claim values to verify against, the base truth data the relying party wants Persona to confirm (for example, a specific
given_nameandbirthdate).
Because this payload carries PII and is larger than a typical claims request, relying parties send it through a pushed authorization request (PAR) rather than as /authorize query parameters.
How Persona resolves a verified claim
- Persona writes the claim values from the request onto the Account tied to the authentication, as the base truth to check against.
- Your Inquiry template runs its normal verification steps, then uses an account comparison check (or equivalent custom logic) to confirm the data it collected matches those base truth values.
- When a claim is actually confirmed, your Inquiry template sets a tracking field you’ve configured for that purpose, using an Update Object action. Persona reads that field to decide whether to report the claim as verified in the returned
id_token. - If the Inquiry never sets the tracking field for a requested claim, Persona reports that claim as unverified rather than guessing.
Your Inquiry template should never write values back onto Account fields that a verified claim request maps to (for example, with an Update Account from Inquiry action). The relying party checks the returned claim against the base truth value it originally sent; if your Inquiry overwrites that value on the Account first, the check fails even though the person verified successfully.
Where to go from here
Okta’s custom IDV integration is the one verified claims integration Persona supports today. How to trigger Persona identity verification within Okta using the Persona IDV integration covers mapping claims in the Dashboard, capturing Okta’s user identifier, and troubleshooting a failed Account Management Policy check end to end.