Identity and access management
AFAS to OneLogin integration: OneLogin users with roles from AFAS Profit
With an integration between AFAS Profit and OneLogin, KoppelHet creates a OneLogin user for every new employee in AFAS, with department, job title, employer and manager, so OneLogin's mappings assign the right roles and apps. After the end date KoppelHet sets the user to suspended in OneLogin.
What the integration does
Organisations that have AFAS Profit as their HR system and OneLogin for single sign-on often add new employees to OneLogin by hand or let them come in through a connected directory that is itself maintained by hand. Roles then do not match the job in AFAS, and leavers keep access to their apps.
- The AFAS administrator creates a dedicated app connector for KoppelHet, with a GetConnector holding only the fields for OneLogin.
- In OneLogin we create an API credential with the right to manage users and a custom attribute for the employee number.
- KoppelHet creates new users with department, job title and employer; OneLogin's mappings assign roles on that basis.
- KoppelHet updates changes in job, department or manager on the same user, found through the employee number.
- After the end date KoppelHet sets the status to suspended; the nightly comparison catches missed changes.
What to watch for with AFAS Profit and OneLogin
- OneLogin has no standard field for the employee number. KoppelHet puts the AFAS employee number in a custom attribute and finds users again with the custom attribute filter, so a change of name or address does not produce a second user.
- OneLogin expects the manager as its own user id, not as an employee number. KoppelHet first looks up the OneLogin user of the manager from AFAS and then fills manager_user_id; a new manager therefore comes in before their team members.
- Roles in OneLogin follow from mappings, which by default only run after the API response. KoppelHet has the mappings run immediately on creation, so the log per employee shows straight away which roles the job from AFAS produced.
- A user created through the API gets no invitation email from OneLogin. KoppelHet creates the user before the first working day, and you decide how a new colleague receives their first password, for example through the manager.
- OneLogin allows 5,000 API calls per hour per account, shared with every other integration on that account. For the initial load from AFAS, KoppelHet spreads the calls and watches the remaining capacity in the headers, so other integrations do not stall.
- In AFAS the employer sits on the contract. KoppelHet puts that employer in the company field, so OneLogin mappings can give different apps per company and a move within the group keeps the same user.
- A username must be unique within the OneLogin subdomain, otherwise OneLogin rejects the user. KoppelHet checks the name from the naming rule beforehand and picks the agreed variant for a duplicate name.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Who decides which apps someone gets?
The mappings and roles in OneLogin. KoppelHet only supplies the AFAS data those mappings work on.
Is a leaver deleted?
No, suspended. Deleting after a retention period can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector under its own app connector (OAuth or token), filtered on modification date, with job lines, organisational units and employer per contract.
- OneLogin API v2 with an OAuth 2.0 token from an API credential with Manage Users: POST /api/2/users?mappings=sync and PUT /api/2/users/{id} with username, email, firstname, lastname, title, department, company, manager_user_id, status (1 Active, 2 Suspended) and custom_attributes; GET /api/2/users with custom_attributes.{name} and updated_since, at most 50 per page. Limit 5,000 calls per hour per account, visible in X-RateLimit-Remaining.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in OneLogin | Notes |
|---|---|---|
Medewerker (EmId) | custom_attributes.employeenumber | Custom attribute in OneLogin |
Naamgevingsregel | username | Unique within the subdomain |
E-mail werk | email | |
Roepnaam en voorvoegsel + achternaam | firstname en lastname | |
Functie (omschrijving) | title | |
Organisatorische eenheid | department | |
Werkgever | company | |
Leidinggevende | manager_user_id | OneLogin id of the manager |
Datum uit dienst | status 2 (Suspended) |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix