Disclaimer
The integration was either created by Saviynt or by Saviynt community users and verified by Saviynt. The integration is available “as is” and falls under standard connectors support for REST, SOAP, JDBC, LDAP, PowerShell, Jar, and Saviynt Connector Framework.
Contents
- 1 Preface
- 2 Audience
- 3 Introduction
- 4 Understanding the Integration between EIC and Jack Henry
- 4.1 Integration Architecture
- 4.2 Setting Up the Integration
- 4.2.1 Prerequisites
- 4.2.2 Creating a Connection
- 4.2.2.1 Understanding the Configuration Parameters
- 4.2.2.1.1 Configuration Parameters for Account and Access Import
- 4.2.2.1.1.1 Connection Parameters
- 4.2.2.1.1.2 Import Parameters
- 4.2.2.1.2 Configuration Parameter for Provisioning
- 4.2.2.1.1 Configuration Parameters for Account and Access Import
- 4.2.2.1 Understanding the Configuration Parameters
- 4.2.3 Importing Connection Package
- 4.2.4 Creating a Security System
- 4.2.5 Creating an Endpoint for the Security System
- 5 Using the Jack Henry Integration
- 6 Troubleshooting
Preface
This guide describes the integration between Saviynt Enterprise Identity Cloud (EIC) and Jack Henry.
Audience
This guide is intended for administrators and target application integration teams responsible for implementing a secure integration service with Jack Henry.
Introduction
Jack Henry & Associates Inc (JHA) is a provider of technology solutions and payment processing services. The company offers transaction processing, business process automation, and information management solutions and services.
The SOAP connector enables you to seamlessly integrate with Jack Henry to manage user lifecycle and govern access to their Groups.
For more information about different connectors in EIC, see Saviynt Enterprise Identity Cloud Connectors.
Note: This guide provides information about using the Jack Henry(SOAP) connector for performing operations listed in the Supported Features.
The Jack Henry integration supports the following features:
Jack Henry Object | EIC Object | Import | Provisioning | ||
Users | Accounts | Yes | No | Support for creating, updating,enabling,disabling and removing accounts | Not applicable |
Groups | Groups | Yes | No | Not applicable | Support for adding group members and removing group members |
Supported Software Versions
Software | Version |
EIC | Release v4.5 and later |
Understanding the Integration between EIC and Jack Henry
You must create an integration between EIC and the collaboration platform hosted by the target application to perform the import, and deprovisioning tasks. The following components are involved in the integration:
Jack Henry is the target application for which EIC manages the identity lifecycle. Jack Henry integrates with EIC through the connector to manage accounts and access.
Objects are imported as entitlement types into EIC.
Security System represents the connection between EIC and the target application.
It comprises an endpoint, which is the target application for which you want EIC to manage the identity repository.
It provides application instance abstraction from connectivity including high-level metadata. For more information about creating a security system, see Creating a Security System.
Endpoint is an instance of an application within the context of a security system.
It is the target application or application from which the connector performs provisioning or deprovisioning of identity objects, such as users, accounts, and entitlements.
It is mandatory to create an endpoint after creating the security system.
You can associate a single security system with multiple endpoints if the deployment involves modelling of multiple isolated virtual applications (based on sets of specific entitlements according to certain categories) within a single application instance. For more information about creating an endpoint, see Creating an Endpoint for the Security System.
Connector is a software component that enables the communication between EIC and the target application. It provides a simplified integration mechanism where in some instances you only need to create a connection with minimal connectivity information for your target application. The (SOAP-based) Connector is used for provisioning accounts and access through the SOAP APIs. For more information about creating a connection, see Creating a Connection.
Job Scheduler is a software component that executes a job based on the configured schedule to perform provisioning operations from EIC.
When a provisioning job is triggered, it creates provisioning tasks in EIC. When these tasks are completed, the provisioning action is performed on the target application through the configured connector. If you want to instantly provision requests for completing the tasks without running the provisioning job, you must enable Instant Provisioning at the security system level and the Instant Provisioning Tasks global configuration. For more information about the jobs used by the connectors in the Jack Henry integration.
Integration Architecture
EIC uses a SOAP connection for integrating with Jack Henry for importing data and for performing provisioning and de-provisioning tasks. The SOAP connection uses the SOAP protocol to communicate with the SOAP interface of Jack Henry.
The following diagram illustrates the integration architecture and communication with the target application.
Figure: Jack Henry Integration Architecture
Setting Up the Integration
Prerequisites
Ensure that the following prerequisites are met:
SOAP API credentials are provided.
The SOAP APIs are validated and checked in an API tool such as SOAPUI before the WSDLs are configured.
For more information about the application, See the Jack Henry Documentation.
Creating a Connection
Connection refers to the configuration setup for connecting EIC to target applications. For more information about the procedure to create a connection, see Creating Connections.
Understanding the Configuration Parameters
While creating a connection, you must specify connection parameters that the connector uses to connect with the target application, define the type of operations to perform, the target application objects against which those operations are performed, and the frequency of performing them. In addition, you can view and edit attribute mappings between EIC and the target application, predefined correlation rules, and provisioning jobs and import jobs.
Configuration Parameters for Account and Access Import
The connector uses the following parameters for creating a connection and for importing account and access from the target application:
Connection Parameters
Parameter | Description | Example Configuration | Mandatory? |
Connection Name | Specify the name to identify the connection. | - | Yes |
Connection Description | Specify the description for the connection. | - | No |
Connection Type | Select the connection type as SOAP. | - | Yes |
Default SAV Role | Specify this parameter to assign the SAV role for the connection. The SAV role is a role in EIC that assigns specific access to users. This parameter is valid only for importing users. Sample value: User assigned with the ROLE_ADMIN role, has access to all the sections of EIC. | - | No |
Email Template | Specify this parameter to select an email template for sending notifications. Email templates provide immediate trigger of emails to a user based on actions performed. Email informs user about the action performed and if critical, needs immediate action from the user. | - | No |
SOAP_ENDPOINT | Specify this parameter to create a connection.
| https://<<instancename>>/SymXchange/2020.01/user | Yes |
Username | Specify this parameter to create a connection. | <API USERNAME> | Yes |
Password | Specify this parameter to create a connection. | <PASSWORD> | Yes |
SOAP_OR_XML | Specify the type of Endpoint - SOAP or XML based. | SOAP | Yes |
Import Parameters
Parameter | Description
| Recommended Configuration | Mandatrory |
ACCOUNTS_IMPORT_JSON | Specify this parameter to reconcile the accounts and entitlements . | Use the following format to reconcile accounts and entitlements using the Jack Henry application: "CONNECTION1": "acctAuth", "REQUESTTYPE1": "EACHACCOUNT", "RECONCILATIONFIELD1": "ACCOUNTID", "REQUESTXML1": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:user=\"http://www.symxchange.generated.symitar.com/user\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><user:getUserSelectFields><Request MessageId=\"test123\"><UserNumber>{USERNAME}</UserNumber><Credentials><AdministrativeCredentials><Password>${PASSWORD}</Password></AdministrativeCredentials></Credentials><DeviceInformation DeviceType=\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation><SelectableFields><IncludeAllUserFields>true</IncludeAllUserFields><ActivitySelectableFields><IncludeAllActivityFields>true</IncludeAllActivityFields></ActivitySelectableFields><UserTrackingSelectableFields><IncludeAllUserTrackingFields>true</IncludeAllUserTrackingFields></UserTrackingSelectableFields></SelectableFields></Request></user:getUserSelectFields></soapenv:Body></soapenv:Envelope>", "REQUESTPARAMS1": { "Content-Type": "text/xml" }, "RESPONSEDATAPATH1": "Body.getUserSelectFieldsResponse.SingleResponse.User", "ACCOUNTMAPPING1": "CUSTOMPROPERTY1:DeptName,NAME:Number,CUSTOMPROPERTY2:JobTitle,CUSTOMPROPERTY3:Email,ACCOUNTID:Number", "CONNECTION2": "acctAuth", "REQUESTTYPE2": "ENTITLEMENTS", "REQUESTXML2": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:par=\"http://www.symxchange.generated.symitar.com/parameter\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><par:getPrivGroup><Request MessageId=\"getrivGroup123\"><PrivGroupGroup>51</PrivGroupGroup><Credentials><UserNumberCredentials><UserNumber>3500</UserNumber><Password>${PASSWORD}</Password></UserNumberCredentials></Credentials><DeviceInformation DeviceType=\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation></Request></par:getPrivGroup></soapenv:Body></soapenv:Envelope>", "REQUESTPARAMS2": { "Content-Type": "text/xml" }, "RESPONSEDATAPATH2": "Body.getPrivGroupResponse.SingleResponse", "ENTITLEMENTMAPPING2": "PrivilegeGroup:PrivGroup.Description" } |
Yes |
Configuration Parameter for Provisioning
Parameter | Description
| Recommended Configuration | Support for Binding Variables? | Support for Java Ternary Operations? |
CREATEACCOUNTJSON | Specify this parameter to Create an account.
| Use the following format to Create an account using the Jack Henry application: { "CONNECTION": "acctAuth", "REQUESTXML": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:user=\"http://www.symxchange.generated.symitar.com/user\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><user:updateUserByID><Request MessageId=\"addMessageIDHere\"><UserNumber>${task.accountName}</UserNumber><UserUpdateableFields><ActiveMode>0</ActiveMode><DeptName>${user.departmentname==null?'':user.departmentname.toUpperCase()}</DeptName><Email>${user.email==null?'':user.email}</Email><JobTitle>${user.jobDescription==null?'':user.jobDescription.toUpperCase()}</JobTitle><Name>${user.firstname!=null && user.lastname!=null? user.firstname.toUpperCase() + ' ' + user.lastname.toUpperCase():user.lastname==null && user.firstname != null?user.firstname.toUpperCase():user.lastname.toUpperCase()}</Name><Note2><EntryId>1</EntryId><Note2>${user.employeeid !=null?user.employeeid.replaceFirst(\"^0*\", \"\"):''}</Note2></Note2><PasswordHash1>${randomPassword}</PasswordHash1><SsoDomainUser>${user.systemUserName.toUpperCase()}@VISIONSINT.COM</SsoDomainUser><TemporaryPassword>1</TemporaryPassword></UserUpdateableFields><Credentials><AdministrativeCredentials><Password>${PASSWORD}</Password></AdministrativeCredentials></Credentials><DeviceInformation DeviceType=\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation></Request></user:updateUserByID></soapenv:Body></soapenv:Envelope>", "RESPONSEMAPPING": { "RESPONSECODE": "Body.updateUserByIDResponse.UpdateResponse.UpdateStatus.isAllFieldsUpdateSuccess" }, "SUCCESSCRITERIA": "RESPONSECODE=true" } ] | The bindings supported are:
| Yes |
UPDATEACCOUNTJSON | Specify this parameter to Update an account. | { "CONNECTION": "acctAuth", "REQUESTXML": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:user=\"http://www.symxchange.generated.symitar.com/user\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><user:updateUserByID><Request MessageId=\"addMessageIDHere\"><UserNumber>${task.accountName}</UserNumber><UserUpdateableFields><DeptName>${user.departmentname==null?'':user.departmentname.toUpperCase()}</DeptName><Email>${user.email==null?'':user.email}</Email><JobTitle>${user.jobDescription==null?'':user.jobDescription.toUpperCase()}</JobTitle></UserUpdateableFields><Credentials><AdministrativeCredentials><Password>${PASSWORD}</Password></AdministrativeCredentials></Credentials><DeviceInformation DeviceType=\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation></Request></user:updateUserByID></soapenv:Body></soapenv:Envelope>", "RESPONSEMAPPING": { "RESPONSECODE": "Body.updateUserByIDResponse.UpdateResponse.UpdateStatus.isAllFieldsUpdateSuccess" }, "SUCCESSCRITERIA": "RESPONSECODE=true" } ] |
| Yes |
DISABLEACCOUNTJSON | Specify this parameter to Disable an account. | [ |
| Yes |
ENABLEACCOUNTJSON | Specify this parameter to Enable an account. | { "CONNECTION": "acctAuth", "REQUESTXML": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:user=\"http://www.symxchange.generated.symitar.com/user\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><user:updateUserByID><Request MessageId=\"addMessageIDHere\"><UserNumber>${task.accountName}</UserNumber><UserUpdateableFields><ActiveMode>0</ActiveMode><DeptName>${user.departmentname==null?'':user.departmentname.toUpperCase()}</DeptName><Email>${user.email==null?'':user.email}</Email><JobTitle>${user.jobDescription==null?'':user.jobDescription.toUpperCase()}</JobTitle><Name>${user.firstname!=null && user.lastname!=null? user.firstname.toUpperCase() + ' ' + user.lastname.toUpperCase():user.lastname==null && user.firstname != null?user.firstname.toUpperCase():user.lastname.toUpperCase()}</Name><SsoDomainUser>${user.systemUserName.toUpperCase()}@VISIONSINT.COM</SsoDomainUser></UserUpdateableFields><Credentials><AdministrativeCredentials><Password>${PASSWORD}</Password></AdministrativeCredentials></Credentials><DeviceInformation DeviceType=\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation></Request></user:updateUserByID></soapenv:Body></soapenv:Envelope>", "RESPONSEMAPPING": { "RESPONSECODE": "Body.updateUserByIDResponse.UpdateResponse.UpdateStatus.isAllFieldsUpdateSuccess" }, "SUCCESSCRITERIA": "RESPONSECODE=true" } ]
|
| Yes |
GRANTACCESSJSON | Specify this parameter to add access to an account. | [
|
| Yes |
REVOKEACCESSJSON | Specify this parameter to remove access to an account. | { "CONNECTION": "acctAuth", "REQUESTXML": "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:user=\"http://www.symxchange.generated.symitar.com/user\" xmlns:tns=\"http://www.symxchange.generated.symitar.com/common/dto/common\"><soapenv:Header></soapenv:Header><soapenv:Body><user:updateUserByID><Request MessageId=\"updateUser123\"><UserNumber>${task.accountName}</UserNumber><UserUpdateableFields> ${String rolesStr = '';int size = entitlementSet?.size();int i = 0; for (String ent : entitlementSet){rolesStr=rolesStr+' <PrivilegeGroup> <EntryId>'+ent+'</EntryId><PrivilegeGroup>0</PrivilegeGroup></PrivilegeGroup>';i++;if(i == size){return rolesStr;}}}</UserUpdateableFields><Credentials><AdministrativeCredentials><Password>${PASSWORD}</Password></AdministrativeCredentials ></Credentials><DeviceInformation DeviceType =\"{DEVICETYPE}\" DeviceNumber=\"{DEVICENUMBER}\"></DeviceInformation></Request></user:updateUserByID></soapenv:Body></soapenv:Envelope>", "REQUESTPARAMS": { "Content-Type": "text/xml; charset=utf-8" }, "RESPONSEMAPPING": { "RESPONSECODE": "Body.updateUserByIDResponse.UpdateResponse.UpdateStatus.isAllFieldsUpdateSuccess" }, "SUCCESSCRITERIA": "RESPONSECODE=true" } ]
|
| Yes |
Importing Connection Package
Transporting Packages aka T2P connection package helps you build the connection with pre defined JSONs, this can be used if your tenant do not already have out of the box connection templates available. Here are the steps to import the Jack Henry connection package.
Navigate to Admin → Transport → select Import Package.
Browse the downloaded package and Import.
Navigate to Admin → Connections → Select “Jack Henry ” Connection.
Edit the connection with your Jack Henry tenant details.
Creating a Security System
The security system represents the connection between EIC and the target application. For more information on creating a security system, see Creating a Security System.
Creating an Endpoint for the Security System
Endpoint refers to the target application used to provision accounts and entitlements (access). For more information on creating an endpoint, see Creating Endpoints.
Using the Jack Henry Integration
You can use the Jack Henry integration for performing import and provisioning operations after configuring it to meet your requirements.
Guidelines for Using the Integration
You must apply the following guidelines for configuring import:
Run the account import before running the access import.
Map all Jack Henry attributes to EIC account attributes using ImportAccountEntJSON.
You must apply the following guidelines for configuring provisioning:
Use Java ternary operators if you want to add conditions in the provisioning parameters. You can use Java operations to tweak any attributes by using if-else conditions, substrings, or operators in the JSON for provisioning.
Configuring Import Operations
Full account import: When configuring the connection for the first time, first perform the full import to import all existing accounts from the target application to EIC. To perform the full import, the invoke API gets a response from the target application and maps the attributes in the target application with attributes in EIC. As part of this process, the deleted accounts are also identified and marked as suspended from import service.
Full Access import: When configuring the connection for the first time, first perform the full import to import all existing access from the target application to EIC. To perform the full import, the invoke API gets a response from the target application and maps the attributes in the target application with attributes in EIC. As part of this process, the deleted entitlements are also identified and marked as inactive.
The import jobs are automatically created in EIC after you create a connection an integration.
Importing Accounts and Accesses
You must import accounts after the users are available in EIC.
To import accounts:
Specify the connection and import parameters.
Note: Ensure that the connection type is selected as SOAP.Configure the Application Data Import (Single Threaded) job to import accounts and access. For more information, see Data Jobs.
Configuring Provisioning and Deprovisioning
Provisioning is automatically enabled when a connection is configured. For detailed information about performing provisioning tasks, see Access Request System.
To provision objects to the target application:
Specify the connection and provisioning parameters. For more information, see Configuration Parameters for Provisioning.
Note: Ensure that the connection type is selected as SOAP.Configure the Provisioning job (WSRETRY). For more information, see Provisioning Jobs.
When a provisioning job is triggered, it creates provisioning tasks in EIC. When these tasks are completed, the provisioning action is performed on the target application through the connector.
Troubleshooting
To troubleshoot common problems with connectors, answer frequently asked questions, and provide solutions to a few common issues you might encounter while configuring or working with connectors, see Common Troubleshooting Guide for Connectors.
To troubleshoot common problems or obtain answers to frequently asked questions for SOAP connectors, see the SOAP Connector guide.
Note: Ensure that you record the token expiry duration during the initial token generation. The connection may fail if the token is not refreshed.
