Enabling cif claim in developer sandbox

Banno SDK
1

What are you trying to build?
We’re building OIDC as a second SSO authentication path in our Digital Experience product (Salesforce-based), alongside our existing SAML implementation, so financial institutions using Jack Henry’s Banno platform can integrate (Banno only supports OIDC, not SAML). We need the customer_identifier restricted claim to map an authenticated Banno user to their existing core-banking record for account matching and pre-fill.

Environment

  • Product or API: Banno Digital Toolkit / Authentication Framework (Consumer API, OIDC)
  • Environment: Garden sandbox
  • Platform or runtime: Rails (aws-omni-channel-application), Salesforce
  • Authentication flow: Authorization Code flow (RP-initiated), requesting openid scope plus the customer_identifier restricted claim via the claims parameter
  • Documentation consulted: jackhenry.dev — “Claims in the Identity Token,” “Map Customer Identities to Existing System IDs,” “Claims” (Authentication Framework concepts), “OpenID Connect and OAuth 2.0” (Digital Toolkit and Banno SDK versions)

What did you try?
Requested the ID token with the restricted claim included in the claims parameter, per the documented pattern:

https://[GARDEN_ENVIRONMENT]/a/consumer/api/v0/oidc/auth?
  client_id=[CLIENT_ID]
  &redirect_uri=[REDIRECT_URI]
  &scope=openid
  &response_type=code
  &claims={"id_token":{"https://api.banno.com/consumer/claim/customer_identifier":null}}

Exchanged the resulting authorization code for the ID token as documented.

What happened?

  • Expected result: Decoded ID token includes "https://api.banno.com/consumer/claim/customer_identifier" alongside sub, per the documented example payload.
  • Actual result: The claim is absent from the token entirely — not null, not an error, just missing from the claims array.
  • HTTP status, if applicable: 200 (token exchange succeeds; claim is simply omitted)
  • x-request-id, if available: [fill in from an actual request if you have one]
  • UTC date and time: [fill in the actual test timestamp]

The actual question for them: Per the docs, this restricted claim requires the FI’s back-office admin to explicitly enable it for our External Application. For Garden specifically, we don’t have visibility into where that back-office/admin control lives or who administers it on Garden’s side. Can you confirm: (1) where customer_identifier gets enabled for an External Application in Garden, and (2) whether you can enable it for our client ID, or point us to who can?

2

Claims are enabled through the Banno back office application. Please provide your clientId and JH Developer Relations can enable the claim for you on Garden. We’re also going to work to update the developer portal to make this process more clear.

3

Here is our client id: f25d6385-7519-47a5-aa57-3758435b8a4b

Thank you!