OIIdentity and access management
AFAS to One Identity integration: AFAS Profit as the HR source for One Identity Manager
With an integration between AFAS Profit and One Identity Manager, employees, organisational units and managers from AFAS are prepared in fixed files that One Identity Manager's CSV connector imports. One Identity Manager then creates accounts and permissions based on AFAS, and sees a departure on the end date.
What the integration does
Organisations that use AFAS for HR and One Identity Manager for accounts and permissions often work with an export from AFAS placed on a network drive. When the export changes, for example an extra column or a different date format, the synchronisation stops or One Identity Manager reads wrong values.
- The AFAS administrator creates a dedicated app connector for KoppelHet with only the GetConnectors for this integration.
- KoppelHet reads employees, contracts, job lines and organisational units from AFAS.
- KoppelHet places an employee file and a department file where One Identity Manager's synchronisation server can read them.
- One Identity Manager imports the files with the CSV connector, departments first and then employees.
- Accounts, groups and permissions follow from the rules in One Identity Manager; after the end date One Identity Manager sees the departure.
What to watch for with AFAS Profit and One Identity
- AFAS stores the name prefix separately from the surname. A CSV file with "van der Berg" in two columns produces a different name in One Identity Manager than HR intends. KoppelHet supplies the surname with prefix in one column and keeps the separate fields alongside for whoever needs them.
- The organisational units in AFAS form a tree. The CSV connector can read exactly one column as a path in a hierarchy and then loads parent departments first. KoppelHet supplies that path for every unit, so a new department under a new cluster is correct in a single run.
- An employee can have more than one job line or contract in AFAS at the same time. With duplicate keys the CSV connector picks, depending on its setting, the first row, the last, none or an error. KoppelHet avoids that choice by supplying one row per employee with the main contract.
- The CSV connector reads dates according to the language set for the file. A Dutch date such as 03-04 means 4 March under an English setting. KoppelHet always writes dates as year-month-day, so an end date is never read as a different month.
- When One Identity Manager works with a file from another source, it cannot mark missing persons as outstanding. KoppelHet therefore keeps a leaver in the file with their end date until after the agreed period, so the departure is visible and not a gap.
- AFAS fields such as a description or note can contain a semicolon or line break. KoppelHet puts every text column between quotes and doubles quotes inside the text, as the CSV connector expects, so a row does not break in two.
- A job change is often in AFAS weeks ahead. KoppelHet only puts the new job in the file from the start date, so One Identity Manager does not switch permissions too early.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Where are the files placed?
In a location One Identity Manager's synchronisation server can read, usually a folder on that server. KoppelHet places them there through an outbound connection.
Can One Identity Manager also write anything back to AFAS?
Not through the files; they are read-only. If the work email needs to go back to AFAS, KoppelHet does that separately through an UpdateConnector.
What if the file is missing one day?
KoppelHet then reports it before the synchronisation starts. We recommend not running the synchronisation in that case, so One Identity Manager does not re-import an old state.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with dedicated GetConnectors under its own app connector (OAuth or token; the classic token expires on 31 August 2027), filtered on modification date, with contracts, job lines with start date and organisational units.
- One Identity Manager reads through the CSV connector: a system connection with two files (employees and departments), UTF-8, semicolon as separator with text delimiters, one header line, key columns per file, Hierarchical sort order on the department path, Uniqueness violation behavior set to Throw error and Read-only access. The synchronisation server reads the files directly or through a remote connection server.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in One Identity | Notes |
|---|---|---|
Medewerker (EmId) | Sleutelkolom PersonnelNumber | Unique per row |
Roepnaam | FirstName | |
Voorvoegsel + achternaam | LastName | |
Functiecode en -omschrijving | Kolommen functiecode en functie | |
Organisatorische eenheid met bovenliggende eenheden | Afdelingspad (hiërarchische sortering) | |
Leidinggevende van de eenheid | Manager in het afdelingsbestand | |
Werkgever | Kolom bedrijf | |
Datum in en uit dienst | EntryDate en ExitDate | Always YYYY-MM-DD |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix