Unified Identity Service
Unified Identity Service (UIS) is a cloud-hosted and OAuth 2.1 compliant identity provider and authentication system for authenticating consumer users within the Jack Henry ecosystem. It’s designed to ensure that only authorized individuals can access sensitive data and systems and replace the need for applications to store or manage passwords and multifactor authentication (MFA), enhancing security and reducing credential-based data breaches.
UIS utilizes the Authorization Code flow, documented more generally in Concepts.
Key Capabilities & Benefits
Product documentation is available here.
Outsources Authentication Complexities
Allows products to outsource functionality such as password resets, rate limiting, and user credential management.
Single Sign-On (SSO) with Two-Factor Authentication (2FA)
Provides a unified login experience for consumer users across all Jack Henry products, and standardizes the options for 2FA requirements based on the user’s required security level (Standard, Enhanced, or High). Supported 2FA methods include SMS, phone call, authenticator apps, FIDO security keys, and passkeys. Symantec tokens are also supported for financial institutions who have contracted and are configured for it.
Rate Limiting
Rate limiting occurs if an IP address appears to be suspicious. IP’s that have high failure rates and a high percentage of failures are blocked until such a time as they quit attempting to login for some time. As a standard security practice, the exact specifics of this criteria are not shared publicly and are adjusted over time.
Secure Credential Handling
Does not use API keys, and ensures that user login credentials are never shared with third-party applications. Instead, access is granted via secure tokens.
Tokens
Provides Access Tokens for authorized access to resources and Identity Tokens for authenticated user information. Access Tokens typically expire quickly (around 10 minutes), while Refresh Tokens (obtained via Authorization Code Flow) are good for 90 days.
Claims and Scopes
Uses Claims to provide authenticated information about the user (e.g., name, email) within the Identity Token or from the UserInfo endpoint. Scopes define the categories of data and operations an application can access, ensuring limited and precise authorization.
Centralized Administration of Consumer Identities
The Identity app for finanicial institution employees supports editing identity profiles and managing user security settings.
Topics in this section
- Have a how-to question? Seeing a weird error? Get help on StackOverflow.
- Register for the Developer Office Hours where we answer technical Q&A from the audience.