Identity and access management
AFAS to Okta integration: AFAS Profit as the HR source for all accounts and apps
With an integration between AFAS Profit and Okta, AFAS becomes Okta's HR source, so a new employee in AFAS becomes an Okta user with department, job title, manager and the apps that go with them. On the end date in AFAS the employee loses access to all apps that run through Okta in one go.
What the integration does
Organisations that use Okta for single sign-on to Microsoft 365, Slack and other SaaS apps often create Okta users by hand after an email from HR in AFAS. On departure Okta is sometimes only updated weeks later, while access to every app depends on it.
- HR enters the new employee in AFAS, with employer, department, job title and manager.
- KoppelHet delivers the employee to Okta as an HR source. Okta creates the user and puts them in their department's group.
- Through the group rules you already have, Okta gives the apps that go with department and job title.
- When the department or manager changes in AFAS, the user in Okta moves to the new group.
- On the end date KoppelHet removes the employee from the source in Okta. Okta deactivates the user and revokes access to the apps.
What to watch for with AFAS Profit and Okta
- Okta has a separate entry point for HR sources, and KoppelHet delivers AFAS there. In Okta, AFAS then looks like any other HR source.
- Through that entry point KoppelHet can deliver groups and their members as well as users. The organisational units from AFAS thus become groups in Okta, with the right employees in them, and your existing app rules work on those.
- Okta stores data from such an HR source as text only. KoppelHet therefore writes dates from AFAS in a fixed format, so rules in Okta can compare on start or end date.
- AFAS keeps the name prefix and surname separately. KoppelHet combines them into one surname for Okta, such as "van den Berg", while the login follows your Dutch convention, for example without spaces.
- If the group has several employers in AFAS, the employer is passed to Okta. Apps and policy can then differ per employer, without anyone maintaining that in Okta.
- Once AFAS is the source, Okta no longer manages the delivered data itself. Anyone wanting to correct a department or job title does so in AFAS; a change made only in Okta is overwritten at the next delivery.
- KoppelHet reads AFAS with its own connector that contains only the fields for Okta. Salary, BSN and bank details never pass through the integration.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to Okta users that already exist?
Before go-live we link existing users to employees in AFAS by employee number or email address. Users who are not in AFAS, such as external staff, are left alone by the integration.
We already have an integration platform. Does this fit alongside it?
Yes. This integration runs on the KoppelHet platform and asks nothing of your existing integration platform. Every action is in the audit logging, so operations and audit know what happened.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector under its own app connector (OAuth or token), filtered on modification date. The classic token expires on 31 August 2027.
- Okta is fed through the Identity Sources API (Anything-as-a-Source) with a custom identity source. Per run a session (status CREATED), then bulk-upsert for users (externalId at most 512 characters, profile attributes of type string only), bulk-groups-upsert and bulk-group-memberships-upsert for departments, bulk-delete on leaving, and start-import.
- Profile sourcing makes the delivered attributes read-only in Okta. Okta profile attributes include employeeNumber, firstName, lastName, login, email, title, department, organization, costCenter and managerId.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Okta | Notes |
|---|---|---|
Medewerkernummer | externalId en employeeNumber | Fixed key of the HR source |
Roepnaam | firstName | |
Voorvoegsel + Achternaam | lastName | Name prefix as HR uses it |
Naamgevingsregel | login en email | |
Functie | title | |
Organisatorische eenheid | department en groep | Group with membership from the source |
Werkgever | organization | |
Leidinggevende (medewerkernummer) | managerId | |
Kostenplaats | costCenter | |
Datum in dienst en uit dienst | Eigen attributen als tekst | Okta stores source attributes as text only |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix