Identity and access management
AFAS to Ping Identity integration: employees from AFAS Profit as users in PingOne
With an integration between AFAS Profit and Ping Identity, every new employee from AFAS is automatically a user in PingOne, in the population of their employer and with job, department and manager. Organisational units from AFAS become groups in PingOne, and after the end date the user can no longer sign in.
What the integration does
Organisations with AFAS as their HR system and PingOne for single sign-on and MFA often add new employees to PingOne by hand or through a CSV import. Leavers then stay until someone cleans them up, and groups lag behind the organisation in AFAS.
- The AFAS administrator creates a dedicated app connector for KoppelHet, and PingOne gets a Worker app with admin rights on identity data.
- KoppelHet reads employees, contracts, job lines and organisational units from AFAS.
- For a new employee KoppelHet creates a user in the employer's population, disabled until shortly before the first working day.
- The user becomes a member of their organisational unit's group; on a change the membership moves on the start date.
- After the end date KoppelHet disables the user, and after the retention period KoppelHet deletes them.
What to watch for with AFAS Profit and Ping Identity
- For HR sources PingOne only has a ready-made provisioner for Workday. For AFAS, KoppelHet delivers through PingOne's SCIM entry point, which Ping itself points to for importing identities.
- PingOne's SCIM entry point has no groups and returns lists of at most 200 users without a next page. KoppelHet therefore manages the groups per organisational unit through the regular PingOne API and keeps its own record of which users come from AFAS.
- In AFAS the employer is attached to the contract. PingOne puts every user in exactly one population. When an employee moves to another company, KoppelHet moves the user to the new employer's population instead of creating a second user.
- AFAS can hold a private address as well as the work email, and PingOne accepts only one email address per user. KoppelHet only sends the work email; if a new employee does not have one yet, KoppelHet fills in the address according to the naming rule.
- PingOne's standard profile has no place for department or manager. KoppelHet writes those from AFAS to custom attributes in the PingOne schema, so policies and applications can act on them.
- A username must be unique within a PingOne environment; a duplicate is refused. KoppelHet builds the name from your naming rule and adds a sequence number for two identical names, so a second Jan de Vries simply gets an account.
- A job change is often entered in AFAS weeks ahead with a start date. KoppelHet only applies the new group and job in PingOne on that date, so someone cannot reach their new team's applications too early.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to users who do not come from AFAS?
The integration leaves them alone, for example contractors or service users in their own population.
Can PingOne then create accounts in applications?
Yes, with PingOne's outbound provisioning. KoppelHet makes sure the data from AFAS is right; PingOne passes it on.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector under its own app connector (OAuth or token; the classic token expires on 31 August 2027), filtered on modification date, with contracts (employer) and job lines with start date.
- PingOne is written with a Worker app with the Identity Data Admin role: users through the SCIM API on scim-api.pingone.com (/v2/DirectMappedUsers for custom attributes, population.id as a valid UUID, unique username, a single email value; no paging, lists at most 200), groups and memberships through the PingOne Platform API and disabling through enabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Ping Identity | Notes |
|---|---|---|
Medewerker (EmId) | externalId en eigen attribuut medewerkernummer | Fixed key |
Naamgevingsregel | username | Unique in the environment |
Roepnaam | name.given | |
Voorvoegsel + achternaam | name.family | |
E-mail werk | email | One address |
Functie (omschrijving) | title | |
Organisatorische eenheid | Groep en eigen attribuut afdeling | |
Leidinggevende | Eigen attribuut leidinggevende | |
Werkgever | population.id | |
Datum uit dienst | enabled |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix