Identity and access management
BambooHR to Ping Identity integration: PingOne users from BambooHR
With an integration between BambooHR and Ping Identity, every new employee from BambooHR gets a user in PingOne, with job title, department, division, location and manager, and that user can no longer sign in after the termination date in BambooHR. PingOne has no ready-made provisioning for BambooHR, so KoppelHet writes through PingOne's APIs and puts the work email back in BambooHR, so single sign-on to BambooHR also works.
What the integration does
Organisations with BambooHR as their HR system and PingOne as identity provider often already use Ping for single sign-on to BambooHR itself. IT still creates users in PingOne by hand, and a termination date HR enters in advance only reaches IT when someone passes it on.
- BambooHR gets a separate user with its own API key, with write access to the work email only; PingOne gets a Worker app with the Identity Data Admin role.
- Together with you we record which population belongs to which country or employment type.
- For a new employee KoppelHet creates the PingOne user with sign-in blocked, and writes the work email back to BambooHR.
- On the hire date KoppelHet enables sign-in; department and division become groups.
- After the termination date KoppelHet blocks sign-in; deletion follows after the retention period.
What to watch for with BambooHR and Ping Identity
- For BambooHR, Ping only describes single sign-on, where BambooHR expects the email address in the NameID. PingOne has a ready-made HR provisioner for Workday, not for BambooHR. KoppelHet therefore fills PingOne itself through Ping's user API.
- Because single sign-on to BambooHR works on the email address, the work email in PingOne must be the same as in BambooHR. KoppelHet creates the address with your naming rule and writes it back to BambooHR, so a new colleague can also sign in to BambooHR itself on day one.
- A transfer appears in BambooHR as a new jobInfo row with an effective date, often weeks ahead. KoppelHet only changes the groups in PingOne on that effective date, so someone does not already get access to the applications of their new department.
- PingOne puts every user in exactly one population, and that can only be changed through a separate request. KoppelHet picks the population from the location in BambooHR and moves the user with that request when they transfer to another country, so MFA devices and history remain.
- BambooHR returns the manager as an employee ID and as an email address, both read-only. PingOne has no standard field for the manager. KoppelHet puts the ID in a custom attribute in the user schema, so approval flows can follow the line.
- A username in PingOne is unique, case-insensitive and at most 128 characters. KoppelHet builds it from a fixed rule on the BambooHR ID or the work email, so a name change in BambooHR does not produce a new user.
- A deleted record in BambooHR is usually a mistake, not a departure. KoppelHet does not block in that case, but reports it to IT. Only a termination date in the employment status history leads to blocking.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to administrators and service users in PingOne?
They are in their own population and the integration leaves them alone. KoppelHet only touches users with a BambooHR ID.
Does the integration read salaries in BambooHR?
No. The user behind the API key has no access to compensation.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads BambooHR through event-based webhooks (employee.created, employee.updated with monitor fields, employee.deleted, signed with HMAC SHA-256), the changed-employees endpoint and the jobInfo and employmentStatus tables. The work email goes back through update-employee (workEmail).
- PingOne with a Worker app (Identity Data Admin): users through /v1/environments/{envID}/users or the SCIM entry point, username unique and at most 128 characters, population.id only changeable through the population sub-resource, groups through the Platform API, custom attributes in the user schema and sign-in blocked through enabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in Ping Identity | Notes |
|---|---|---|
id | externalId | |
firstName of preferredName | name.given | |
lastName | name.family | |
Naamgevingsregel | username en email | |
jobInfo (jobTitle) | title | |
jobInfo (department en division) | Groepen per afdeling en divisie | |
jobInfo (location) | Populatie en eigen attribuut locatie | |
supervisorEId | Eigen attribuut leidinggevende | |
hireDate en terminationDate | enabled (aanmelden toegestaan of geblokkeerd) |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → Active Directory
BambooHR to Active Directory integration: accounts in your own domain from HR
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll