Accounts in applications
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
With an integration between AFAS Profit and Adobe Creative Cloud, a new employee from AFAS gets an Adobe user in the Admin Console, with the product profile that fits their job or department. When they change jobs or leave, the integration removes the product profiles and the licence is freed, without their files disappearing straight away.
What the integration does
Organisations that manage employees in AFAS and assign Creative Cloud licences in the Adobe Admin Console keep the licence list by hand. After a job change or departure an expensive licence often stays assigned to someone who no longer uses it.
- HR enters a new employee in AFAS with job, organisational unit and work email.
- KoppelHet looks up in the table which product profiles belong to that job or unit; no row means no licence.
- The user is created in the Admin Console with your organisation's identity type and the right product profiles.
- On a job change KoppelHet removes the old profiles and adds the new ones.
- After the end date KoppelHet removes all profiles and removes the user from the organisation, without deleting the account.
What to watch for with AFAS Profit and Adobe Creative Cloud
- Adobe has three kinds of accounts, Adobe ID, Enterprise ID and Federated ID, each with its own create command. With single sign-on through your identity provider it is Federated ID, and then Adobe also requires the country next to name and email. KoppelHet derives the country from the employer or site in AFAS.
- The country of an Adobe user cannot be changed through the API after creation. KoppelHet therefore checks the country before creating. When an employee in AFAS moves to an employer in another country, KoppelHet reports it to the administrator instead of leaving a wrong country.
- In Adobe a licence belongs to a product profile. In AFAS job and organisational unit determine who needs which package. A table links them to product profiles, so that, for example, only communications and marketing get the full Creative Cloud.
- Adobe can remove a user from the organisation and optionally delete the account permanently, with all files. That cannot be undone. KoppelHet never deletes on departure; it only removes the user from the organisation, so files can still be handed over.
- Adobe always reports removal from the organisation as successful, even if the user did not exist. KoppelHet therefore checks afterwards that the user is really gone, so a typo in a work email does not silently leave a licence in place.
- Adobe allows at most ten users per request, and at most ten groups added per user. For the first load from AFAS KoppelHet splits the employees over requests of ten and respects Adobe's limits.
- Adobe does not allow admin roles such as system administrator to be assigned or revoked through the API. KoppelHet reports a departing employee with such a role to the Adobe administrator, who revokes the role.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not Adobe's User Sync Tool?
It syncs from LDAP or Active Directory, Okta, another Admin Console or a CSV file, not directly from AFAS. If your employees are already correct in Active Directory or Okta, that route can be enough; this integration is for organisations where AFAS is the source.
What happens to a leaver's files?
They remain, because KoppelHet does not delete the account. The administrator can transfer them in the Admin Console.
Do all employees get an Adobe account?
No. Only jobs or units listed in the table get an account and a product profile.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector under its own app connector (employees with preferred name, last name, job, organisational unit, employer, work email and end date), filtered on modification date.
- To Adobe through the User Management API (UMAPI) with an integration in the Adobe Developer Console. Actions createFederatedID (firstname, lastname, email and country required) or createEnterpriseID, update (country cannot be changed), add and remove group for product profiles and user groups (remove all for everything), removeFromOrg with deleteAccount false. At most ten users per request; _org_admin not through the API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Adobe Creative Cloud | Notes |
|---|---|---|
E-mail werk | email en username | |
Roepnaam | firstname | |
Voorvoegsel + Achternaam | lastname | |
Land (vestiging of werkgever) | country | Two letters, cannot be changed after creation |
Functie of Organisatorische eenheid | add/remove group (productprofiel) | Through a table; no row means no licence |
Organisatorische eenheid | add/remove group (gebruikersgroep) | |
Datum uit dienst | remove all en removeFromOrg (deleteAccount false) |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix
AFAS Profit → AllSolutions
AFAS to AllSolutions integration: the AFAS Profit payroll journal posted in AllSolutions