Identity and access management
AFAS to SailPoint integration: AFAS Profit as the authoritative source for roles and access
With an integration between AFAS Profit and SailPoint Identity Security Cloud, AFAS becomes the authoritative HR source, so SailPoint has an identity for every employee with job, department, employer and the right lifecycle state. Roles and access in SailPoint then follow hiring, job changes and departures in AFAS.
What the integration does
Organisations that base access to Active Directory and other systems on roles with SailPoint define those roles on job title and department from AFAS. As long as the HR data comes from a manual export, the roles lag days behind reality.
- KoppelHet reads the employees, employments and job lines in AFAS that have changed since the previous round.
- KoppelHet assembles the data in the shape the SailPoint source expects, with job code, department, employer and dates.
- KoppelHet delivers the data to SailPoint and has SailPoint start processing straight away.
- SailPoint determines the lifecycle state and assigns or revokes roles. SailPoint creates the accounts in AD and other systems itself.
- If agreed, KoppelHet writes the work email address that SailPoint had created back to AFAS.
What to watch for with AFAS Profit and SailPoint
- AFAS has a code and a description for every job. KoppelHet supplies both, and roles in SailPoint should be based on the code. If HR changes a job's description, the roles stay correct.
- Job and department changes in AFAS have a start date and are often entered weeks ahead. KoppelHet only supplies the new value from that date, so SailPoint does not switch the role too early and the employee keeps the old access until the move.
- The organisational units in AFAS form a tree. KoppelHet supplies the full path above the department as well as the department itself, so a role for a whole cluster or division can be made in SailPoint with one rule.
- SailPoint rejects an identity without a surname or work email address. AFAS keeps name prefix and surname separately, and the work address often only exists once SailPoint has had the account created. KoppelHet combines the name and fills a temporary address from the naming rule until then.
- If the organisation has several employers in AFAS, the employer arrives as a separate attribute in SailPoint. Roles that only apply to one employer, such as access to its own finance system, can be limited on that.
- SailPoint normally collects sources at fixed times. KoppelHet delivers after every change round in AFAS and starts processing in SailPoint straight away, so a departure does not wait until the next scheduled round.
- KoppelHet reads AFAS with a dedicated connector containing only the fields for SailPoint. BSN, salary and bank details do not appear in the identity environment.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does KoppelHet also create the accounts in Active Directory?
No. With SailPoint, SailPoint creates accounts and grants access. KoppelHet makes sure SailPoint has the right HR data.
Can we use the AFAS source next to another HR source?
Yes. In SailPoint the order of the identity profiles decides which source wins if someone is in both.
Does SailPoint see salaries from AFAS?
No. Only the data roles and the lifecycle need is passed on.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector under its own app connector, filtered on modification date, including job lines (organisational unit and job with start date). The work address is written back through the UpdateConnector KnEmployee (person, work email).
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source. KoppelHet sends the file through the import-accounts API, which starts aggregation straight away. The identity profile calculates the lifecycle state from startDate and endDate with a transform; required attributes uid, email and lastname.
- The API client in SailPoint only has rights on this source. Attribute names on the SailPoint side follow the account schema the customer sets up on the source.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in SailPoint | Notes |
|---|---|---|
Medewerkernummer | uid en employeeNumber | Key of the identity |
Roepnaam | firstname | |
Voorvoegsel + Achternaam | lastname | Required in SailPoint |
E-mail werk | email | Required; temporary value from the naming rule while empty |
Functiecode | jobCode | Code rather than description |
Functieomschrijving | title | |
Organisatorische eenheid (code en pad) | department en departmentPath | |
Werkgever | company | |
Leidinggevende (medewerkernummer) | manager | |
Datum in dienst en datum uit dienst | startDate en endDate | Basis for the lifecycle state |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix