Skip to main content

UAE PASS

UAE PASS is the UAE's official digital identity platform. It allows UAE nationals, residents, and visitors to authenticate using their UAE digital identity. Ory supports both web and mobile authentication flows for UAE PASS.

Follow these steps to add UAE PASS as a social sign-in provider for your project, using the Ory Console.

  1. Go to Authentication → Social Sign-In (OIDC) in the Ory Console.
  2. Enable the Enable OpenID Connect toggle, then click Add new OpenID Connect provider.
  3. Click the UAE PASS logo to open the Configure UAE PASS screen. You may need to click Show more providers to see the full list of providers.
  4. Copy the Redirect URI and save it for later use.
  5. Register your application on the UAE PASS partner portal. You will receive a Client ID and Client Secret.
  6. Paste the Client ID and Client Secret into the corresponding fields in the Ory Console's Configure UAE PASS screen.
  7. Set the Issuer URL based on your environment:
    • Production: https://id.uaepass.ae
    • Staging: https://stg-id.uaepass.ae
  8. Select the Authentication Channel:
    • Web: For browser-based authentication.
    • Mobile: For mobile app-to-app integration.
  9. In the Ory Console, click Save Configuration to enable UAE PASS as a social sign-in provider.
  10. In the UAE PASS application configuration, paste the Redirect URI you copied from Ory into the allowed redirect URIs.

Data mapping​

In the Data mapping field, you can map the data returned by the sign-in provider to traits as defined in the identity schema.

To define the mapping, create a Jsonnet code snippet. Read this document to learn more about Jsonnet data mapping.

In this sample Jsonnet snippet, the user's email and fullnameEN are mapped to the identity schema.

local claims = std.extVar('claims');

{
  identity: {
    traits: {
      [if 'sub' in claims then 'subject' else null]: claims.sub,
      [if 'email' in claims then 'email' else null]: claims.email,
      [if 'fullnameEN' in claims then 'name' else null]: claims.fullnameEN,
    },
  },
}

Configuration​

Environments​

UAE PASS provides two environments. Set the issuer_url accordingly:

EnvironmentIssuer URL
Productionhttps://id.uaepass.ae
Staginghttps://stg-id.uaepass.ae

Authentication flows​

UAE PASS supports two authentication flows configured through the uaepass_auth_flow parameter:

FlowDescriptionUse case
webBrowser-based authentication (default)Web applications
mobileMobile app-to-app integrationNative mobile applications

Scopes​

UAE PASS uses custom scopes to control which user data is returned. The available scopes depend on the user type.

For UAE nationals and residents:

ScopeDescription
urn:uae:digitalid:profile:generalGeneral profile info
urn:uae:digitalid:profile:general:profileTypeProfile type
urn:uae:digitalid:profile:general:unifiedIdUnified ID

For visitors:

ScopeDescription
urn:uae:digitalid:profileBasic profile

For more information on scopes and endpoints, refer to the UAE PASS documentation.

User claims​

UAE PASS returns the following claims. Use these in your Jsonnet data mapping to populate identity traits.

ClaimDescription
subSubject identifier (unique ID)
emailEmail address
fullnameENFull name (English)
firstnameENFirst name (English)
lastnameENLast name (English)
fullnameARFull name (Arabic)
firstnameARFirst name (Arabic)
lastnameARLast name (Arabic)
uuidUUID identifier
unifiedIDUAE unified identifier
idnIdentity number
userTypeProfile type (SOP1/SOP2/SOP3)
nationalityENNationality
genderGender
dobDate of birth
mobileMobile number

User types:

  • SOP1: UAE National
  • SOP2: Resident
  • SOP3: Visitor

Advanced data mapping​

To map additional UAE PASS claims to your identity schema, use a more comprehensive Jsonnet snippet:

local claims = std.extVar('claims');

{
  identity: {
    traits: {
      [if 'sub' in claims then 'subject' else null]: claims.sub,
      [if 'email' in claims then 'email' else null]: claims.email,
      [if 'fullnameEN' in claims then 'name' else null]: {
        full: claims.fullnameEN,
        [if 'firstnameEN' in claims then 'first' else null]: claims.firstnameEN,
        [if 'lastnameEN' in claims then 'last' else null]: claims.lastnameEN,
      },
      [if 'fullnameAR' in claims then 'name_ar' else null]: {
        full: claims.fullnameAR,
        [if 'firstnameAR' in claims then 'first' else null]: claims.firstnameAR,
        [if 'lastnameAR' in claims then 'last' else null]: claims.lastnameAR,
      },
      [if 'unifiedID' in claims then 'unified_id' else null]: claims.unifiedID,
      [if 'userType' in claims then 'user_type' else null]: claims.userType,
      [if 'nationalityEN' in claims then 'nationality' else null]: claims.nationalityEN,
      [if 'gender' in claims then 'gender' else null]: claims.gender,
      [if 'dob' in claims then 'date_of_birth' else null]: claims.dob,
      [if 'mobile' in claims then 'phone' else null]: claims.mobile,
    },
  },
}
note

Your Ory Identity schema must include the corresponding fields for any claims you map. Update your identity schema to include the fields you need before configuring the data mapping.

Troubleshooting​

When you add a social sign-in provider, you can encounter common problems such as:

  • Redirect URI mismatch
  • Redirect loops during registration
  • Domain verification issues

To troubleshoot those issues, read Social sign-in troubleshooting.