Do this right away
We are enabling single sign on integration to GitHub using your Jack Henry credentials. To enable, you only need to visit https://github.com/orgs/Banno/sso and link your Jack Henry account to your GitHub account. You’ll then log in to the Jack Henry portal using your @jhacorp.com username and your JHA password. You must do this before September 15 or you will lose access to the Banno organization on GitHub.
What’s going on
Because we use GitHub authentication to authorize access to other applications (Kibana, Databases, SSH to servers, etc), the FFIEC was uncomfortable with solely a 3rd party being authoritative for auth. To address this concern without causing disruption, we chose to simply add Jack Henry’s Active Directory authentication in front of normal github auth. This provides a level of control by the Jack Henry identity management team. Any GitHub account in the Banno organization which does not have a link to an active directory account will be automatically removed from the org.
What changes with this integration?
You will need to periodically visit a page in the banno org and sign into the web interface of GitHub. All other auth methods are still supported (SSH, personal access tokens, etc). There are a few restrictions - you’ll need to have a passphrase on your SSH key for instance. You’ll see these checks when you make your first pull or clone from a remote after the SSO is enabled. If you use a personal access token for clones using https, the first time you do a pull, it will give you a URL to authorize the token. After doing so, you will not be asked again. You can also authorize these on https://github.com/settings/keys and https://github.com/settings/tokens
Does this affect other organizations I’m a member of?
No not at all. GitHub allows a single account to be used for personal accounts as well as multiple other organizations. This change only affects the Banno org. You can still use a singular GitHub account.
What about Banno Autobot?
We are getting active directory service accounts setup so that our autobot type accounts will also be linked here. They will continue to work as well. In the future, if you need a new service account, we’ll have to request a service account be created by Jack Henry’s identity management team.