Identity and Access Management
Centralized accounts, roles, password rules, and how access is granted and revoked.
1. Purpose
JRJ Group Holdings LLC D/B/A UNIFY uses a centralized identity and access management (IAM) system for UNIFY. Staff, editors, and brokers authenticate against one user directory. Roles and approvals are stored on that record and enforced on the server.
2. System of record
UNIFY’s users collection is the system of record for identity. It issues credentials, session cookies, password-reset tokens, and role flags for admins, editors, and brokers. There is no separate shadow directory for production application access.
3. Provisioning
- Staff admin and editor accounts are created by an existing admin.
- Brokers self-register. The handler sets role and pending approval server-side. Brokers remain unable to submit deals until an admin approves them and onboarding is complete.
- Role changes after account creation are admin-only fields.
4. Authentication
- Email and password, minimum eight characters
- Password-reset messages are built from the configured site origin, not an untrusted request host header
- Reset links expire in one hour
- Sessions use first-party HTTP-only cookies with CSRF origin checks
- MFA is required on in-scope systems
5. Deprovisioning
When a staff member leaves or a broker relationship ends, an admin disables or deletes the account in the same directory. Access reviews confirm that leftover accounts are removed. See Access Reviews and Audits.
6. Hosted consoles
Cloud consoles for hosting, database, email, and object storage are separate from UNIFY login. Those consoles are still in scope for this IAM policy: they must use named accounts, MFA, and removal on termination.