Identity and access management
BambooHR to OneLogin integration: OneLogin users and roles from BambooHR, with OneLogin's directory or custom
With an integration between BambooHR and OneLogin, every employee in BambooHR becomes a OneLogin user with job title, department, roles and manager, and that user is suspended on the leaving date. OneLogin itself has a BambooHR directory that syncs every six hours; KoppelHet comes in when departures must be faster, the manager must be right straight away or custom statuses in BambooHR get in the directory's way.
What the integration does
Organisations that use BambooHR as the source for OneLogin often start with the BambooHR directory in OneLogin. What chafes afterwards is the wait until the next sync on a departure, a manager that has to be filled through a detour, and termination statuses with custom names the directory does not recognise.
- BambooHR gets an API key on a user who may only see the employees and fields for OneLogin, and a webhook on the monitored fields.
- In OneLogin the administrator creates an API credential with Manage Users for KoppelHet.
- For a new employee KoppelHet creates the OneLogin user, suspended until the start date, with roles and manager.
- On the start date KoppelHet sets the user to active; OneLogin then provisions the apps itself through roles and mappings.
- On the leaving date KoppelHet sets the user to suspended and reports it if that fails.
What to watch for with BambooHR and OneLogin
- OneLogin's BambooHR directory syncs automatically every six hours. A departure in the morning may therefore only come through late in the afternoon. KoppelHet reacts to the BambooHR webhook and suspends the user on the leaving date itself.
- OneLogin ties its own manager field to the OneLogin or Active Directory directory, so the directory cannot put the manager from BambooHR in it directly. OneLogin advises a detour through a custom field and a mapping. KoppelHet looks up the manager's OneLogin user and fills manager_user_id directly.
- The option not to create terminated employees does not work when BambooHR uses custom names for termination statuses. KoppelHet derives a departure from the termination date and the history of the employment status, so the name of the status does not matter.
- The directory only reads the current value of jobInfo and employmentStatus. OneLogin therefore sees a returning colleague as new. KoppelHet recognises them by the original hire date in BambooHR and reactivates the existing OneLogin user with the same external_id.
- Teams and groups from BambooHR arrive in the directory as a semicolon-separated list in a custom field, after which rules turn them into roles. KoppelHet translates department, division and location into role_ids using a fixed table, so a role does not depend on how a text in a list is spelled.
- Both the directory and KoppelHet only see the employees and fields that the BambooHR user behind the key may see. OneLogin names as a symptom that only the administrator themselves is synced. Every run KoppelHet checks whether the number of employees and the required fields add up, and stops on a sudden drop.
- Users created through OneLogin's API get no invitation email, and a username may only occur once per subdomain. KoppelHet checks the name beforehand and makes sure the first password goes through your own onboarding step.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just OneLogin's BambooHR directory?
It is often enough with standard statuses and if waiting six hours on a departure is no problem. Choose custom work when access must stop on the day itself.
Does the integration also create accounts in other apps?
OneLogin does that itself, through roles and app provisioning. KoppelHet makes sure the roles are right.
What happens with a terminated employee?
The user is suspended on the leaving date. Deletion only happens after the retention period.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Standard: the BambooHR directory in OneLogin (Users, Directories) with a permanent BambooHR token and the subdomain, automatic sync every six hours, Synchronize Users (Force) for an immediate run, optionally a real-time update URL for BambooHR webhooks, Sync user status and Do not create terminated users.
- KoppelHet reads BambooHR through event-based webhooks (employee.created, employee.updated with monitor fields, employee.deleted) and the REST API (jobInfo, employmentStatus, originalHireDate, supervisorEId).
- To OneLogin through API v2 with the Manage Users scope: POST and PUT /api/2/users with username, email, external_id, title, department, manager_user_id, role_ids and status (0 unactivated, 1 active, 2 suspended); mappings=sync runs mappings before the response. An unknown custom attribute returns 400.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in OneLogin | Notes |
|---|---|---|
id | external_id | |
firstName en lastName | firstname en lastname | |
workEmail | email en username | |
jobInfo.jobTitle | title | |
jobInfo.department | department | |
jobInfo.division en jobInfo.location | role_ids | Following the role table |
supervisorEId | manager_user_id | |
employmentStatus en terminationDate | status (1 actief, 2 geschorst) |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → Active Directory
BambooHR to Active Directory integration: accounts in your own domain from HR
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll