Identity and access management
ADP Workforce Now to Omada integration: Omada reads Workforce Now directly, with ADP's certificate and filters
With an integration between ADP Workforce Now and Omada Identity, every employee from Workforce Now becomes an identity in Omada, with department as context, the manager as owner and start and end dates, so roles and reviews run on HR data. Omada has no ADP connector, but the REST collector can read ADP's Worker API with OAuth and a client certificate; KoppelHet sets that up.
What the integration does
Organisations with ADP Workforce Now for HR and payroll and Omada Identity for identity governance often load employees with a report from ADP that someone exports by hand. Leavers then stay in Omada until the next file, and reviews go to a manager who has already left.
- Through ADP we arrange client ID, secret and a client certificate for the Worker API.
- In ADP the administrator uses People Access to limit which employees the integration sees.
- In Omada we set up the REST collector with OAuth2 Client Credentials, the certificate and pagination with $top and $skip.
- With an alias we pick the primary position per employee, and we set thresholds for the import.
- KoppelHet monitors the certificate's expiry date and the last successful import.
What to watch for with ADP Workforce Now and Omada
- Omada has no ADP connector in the Connectivity Directory or documentation. The REST collector can, however, use OAuth2 Client Credentials and send a client certificate with private key, and ADP requires exactly that combination for its APIs. Omada therefore reads Workforce Now itself; KoppelHet does not need to keep a copy of the data.
- The ADP certificate is valid for two years. If it expires, the import stops without employees disappearing, but new hires and leavers no longer come through. KoppelHet puts the expiry date in monitoring and swaps the certificate in Omada in time.
- ADP returns fifty employees per call by default, with $top and $skip. Omada's REST collector can paginate with URL parameters and a counter, and reads on until an empty result. KoppelHet sets $skip to that counter. Because ADP does not support sorting, the import runs outside office hours, so the order between two pages does not shift.
- Employees that ADP has archived only come along with the header Content-Type application/json;archived=true. Omada can send custom headers per connection. KoppelHet switches that header on, so an archived leaver does not disappear from Omada as deleted but stays with their end date for audits.
- According to ADP the associateOID is unique across all of ADP, the workerID unique per client and the positionID unique per position. An employee with two positions therefore has one associateOID. KoppelHet uses it as business key and uses an alias in Omada to pick the primary position for department and owner.
- If HR records a departure with a future date, the position in ADP is set to terminated straight away while the employee stays active until that date. KoppelHet therefore bases the status in Omada on the date and sets ValidTo to the last working day, so roles do not lapse on the day HR enters the departure.
- ADP can filter on department and on position status. If Workforce Now also contains companies or departments that do not belong in Omada, KoppelHet limits the import with People Access in ADP and a filter expression in Omada, not afterwards by hand.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is there a KoppelHet program between ADP and Omada?
No. Omada reads ADP itself; KoppelHet sets up the import and monitors it.
What happens to employees on leave?
We agree that with you. The position status comes along, so a role rule in Omada can treat leave differently.
Does Omada see pay data too?
No. The import only requests the fields needed for identities, and ADP masks sensitive fields by default.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now Worker Management API: GET /hr/v2/workers with $top (default 50) and $skip, $select and $filter (including homeOrganizationalUnits, assignmentStatus/statusCode, workerID, positionID, homeWorkLocation); no $orderby (US1102423); Content-Type application/json;archived=true for archived employees; People Access on the Marketplace profile. Token through accounts.adp.com with OAuth 2.0 Client Credentials and mutual TLS (certificate valid for two years).
- Omada REST collector (Content: Identity data): OAuth2 Client Credentials with Include certificate (PEM certificate and private key), Headers as JSON, URL parameters pagination without Total, alias mappings with a JSONPath condition on the primary position, filter expression per row; required identity mapping Business key, Unique ID, Name and Status; thresholds per import.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in Omada | Notes |
|---|---|---|
associateOID | Business key en Unique ID | |
workerID | EmployeeNumber (extensieattribuut) | |
person.legalName (of preferredName) | Name, FirstName, LastName | |
businessCommunication.email | Email | |
workAssignments (primair): assignmentStatus | Status | |
workAssignments: hireDate, terminationDate | ValidFrom, ValidTo | |
workAssignments (primair): homeOrganizationalUnits | Context (afdeling) en context assignment | |
workAssignments (primair): reportsTo | Identity owner |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions