Identity and access management
ADP iHCM to OneLogin integration: OneLogin users from ADP iHCM, with roles per country
With an integration between ADP iHCM and OneLogin, every employee from iHCM gets a OneLogin user with job title, department, country and manager, and that user is suspended on the leaving date recorded in iHCM. OneLogin has no ADP directory; KoppelHet processes ADP's notifications and writes through the OneLogin API, so your mappings give the roles per country.
What the integration does
Organisations that use ADP iHCM for employees in several European countries and OneLogin as identity provider often create OneLogin users by hand per country. A departure that HR moves in iHCM is no longer adjusted in OneLogin, and a returning colleague gets a second user.
- With ADP we enable the Worker API and the notifications in the Consumer Application Registry.
- In OneLogin the administrator creates an API credential with Manage Users and the custom attribute for the country.
- Together with you we record which mappings give roles per country, department and job.
- At go-live we link existing OneLogin users to their workerID.
- After that KoppelHet processes every notification and schedules the suspension on the current leaving date.
What to watch for with ADP iHCM and OneLogin
- OneLogin names Workday, UKG, Namely, BambooHR, HiBob and Sapling as HR sources for provisioning; ADP is not among them. KoppelHet uses the OneLogin API, so the roles still run through your own mappings in OneLogin.
- ADP writes that not every employee in iHCM has an associateOID, while the workerID is always there. KoppelHet puts the workerID in OneLogin's external_id and looks users up by it, so employees without an associateOID get a user too.
- On a rehire iHCM sends the same notification as for a new employee. KoppelHet first searches on external_id; if the suspended user still exists, it sets it back to active. The colleague thus keeps their old username, which must be unique within the OneLogin subdomain.
- A changed leaving date has no notification of its own in iHCM; ADP sends the departure notification again. KoppelHet reads the current date on every departure notification and moves the moment at which the OneLogin user is set to suspended.
- In iHCM 'Reports to' and supervisor exist side by side, and ADP sends leave requests to 'Reports to'. OneLogin expects the manager as a OneLogin user ID. KoppelHet looks up the user of 'Reports to' and fills manager_user_id, so approvals follow the same line as leave.
- OneLogin has no standard field for country, and an unknown custom attribute makes creating the user fail. The administrator therefore creates the attribute for the country first; KoppelHet fills it from the work location in iHCM, so mappings can give different apps per country.
- iHCM reports changes to the private and the business email address with separate notifications. KoppelHet only processes the business one, so a private address never ends up as login or email address in OneLogin.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a returning colleague get a new OneLogin user?
No. KoppelHet recognises them by the workerID and sets their existing user back to active.
Is a leaver deleted from OneLogin?
No, the user is set to suspended. Deleting remains IT's choice.
Can we give different apps per country?
Yes. KoppelHet fills the country, and your mappings in OneLogin attach roles to it.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP iHCM Worker Management API: GET /hr/v2/workers with $skip and $top (maximum 100), per person on workerID; notifications worker.hire (also on return), worker.terminate (also on a changed date or reason), worker.legalName.change, worker.businessCommunication.email.change and worker.workAssignment.modify; access through the Consumer Application Registry (CAR).
- OneLogin API v2 with a credential with Manage Users: POST /api/2/users?mappings=sync and PUT /api/2/users/{id} with username, email, firstname, lastname, title, department, external_id, manager_user_id, custom_attributes and status (1 Active, 2 Suspended); GET /api/2/users on external_id; no invitation email through the API; 5,000 calls per hour per account.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP iHCM | Field in OneLogin | Notes |
|---|---|---|
workerID (Employee Reference Number) | external_id | |
person.legalName | firstname, lastname | |
businessCommunication.email of naamgevingsregel | username en email | |
workAssignments (primair): jobTitle | title | |
workAssignments (primair): homeOrganizationalUnits | department | |
homeWorkLocation.address.countryCode | custom_attributes.country | |
reportsTo ('Reports to') | manager_user_id | |
workerDates (hire, termination) | status (1 actief, 2 geschorst) |
Related
ADP iHCM → Active Directory
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
ADP iHCM → Coupa
ADP iHCM to Coupa integration: approved Coupa expenses as a variable pay field in ADP iHCM NL
DyADP iHCM → Dyflexis
ADP iHCM to Dyflexis integration: employees and contracts in scheduling, hours back to ADP
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country