Identity and access management
BuddeeHR to Okta integration: Buddee as HR source for Okta
With an integration between BuddeeHR and Okta, every employee from Buddee becomes an Okta user with job title, department, location, employment type and manager, and the groups in Okta follow the position that applies on that day. After the last contract in Buddee Okta deactivates the user, and the Okta login address goes back to Buddee as work email.
What the integration does
Organisations that do HR in BuddeeHR and use Okta for access now put new colleagues into Okta by hand. A move to another department as of the first of the month is applied too early or too late, and an agency worker with a series of temporary contracts sometimes loses access between two contracts.
- Buddee gets a separate account for the integration, and Okta a custom HR source with a service app for KoppelHet.
- KoppelHet reads employees, employments, contracts and positions and selects the position that applies that day.
- KoppelHet delivers new and changed employees, groups and memberships in one Okta session.
- Okta creates the user; KoppelHet writes the login address back to the work email in Buddee.
- After the last contract in the series KoppelHet delivers a deletion, and Okta deactivates the user.
Back: The Okta login address goes back to the employee's work email through the Buddee API.
What to watch for with BuddeeHR and Okta
- Buddee offers sign-in with Microsoft or Google, but no integration with Okta. KoppelHet uses Okta's custom HR source, so Buddee decides who gets an Okta user and Okta then handles the apps.
- Buddee returns lists in pages of two hundred, and Okta accepts at most two hundred users per request, with fifty requests per session. At the first load KoppelHet turns each Buddee page into one request and spreads a large organisation over several sessions in a row.
- Contracts in Buddee are stored as a series with a sequence number and a flag for the last contract. KoppelHet only delivers an employee to Okta as a deletion once the last contract of the series has ended, so an agency worker keeps their Okta user between two temporary contracts.
- Besides the manager, Buddee has an indirect manager, an HR manager and a buddy. Okta only has a field for the manager; KoppelHet fills it with the direct manager and puts the buddy in its own text attribute, so an Okta workflow can send the buddy a message at the start.
- Department, location and job title are stored in Buddee as positions with a start and end date. Okta accepts no lists from a custom HR source. KoppelHet selects the position that applies today and delivers it on the effective date, so the groups in Okta only switch on the day of the move.
- Buddee has six employment types, from employee to freelancer and volunteer. KoppelHet puts the type as text in Okta, so a group rule only gives a volunteer or freelancer the apps that belong to their role.
- The Buddee API signs in with email and password of a regular user. If an organisation later enforces sign-in with Microsoft or Google, that integration account must keep a password. KoppelHet uses a separate account with only the necessary rights and excludes it from the HR source for Okta.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Buddee have an Okta integration?
Not according to Buddee's integrations page; it lists sign-in with Microsoft and Google. KoppelHet delivers Buddee to Okta through the custom HR source.
Does salary or bank data go to Okta?
No. KoppelHet reads no salaries and drops IBAN and BSN from the employee record immediately.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Buddee through the REST API on api.buddee.nl: /employees (company_id, number, first_name, composed_last_name, manager_id, buddy_id, work_email), /employments (type, start_date, end_date), /contracts (sequence_number, is_last_in_sequence, start_date, end_date) and /positions (job_id, department_id, location_id, manager_id with start_date and end_date); per_page 200; filter active=1. Basic Auth on /auth/token, then a JWT access token with refresh token. Write-back through PUT /employees/{id} (work_email).
- Okta through the Identity Sources API (Custom Identity Source) with a service app: one session at a time per source, bulk upsert with externalId and text attributes only (200 per request, 50 requests per session), groups and memberships separately, bulk delete deactivates. importType INCREMENTAL only.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BuddeeHR | Field in Okta | Notes |
|---|---|---|
company_id + number | externalId en employeeNumber | number is unique within a company |
first_name | firstName | |
composed_last_name_prefix + composed_last_name | lastName | |
Naamgevingsregel of work_email | email en login | |
Functie (job_id, positie van vandaag) | title | |
Afdeling (department_id) | department en groep | |
Locatie (location_id) | Groep per locatie | |
manager_id | managerId | External ID of the manager |
buddy_id | Eigen attribuut buddy (tekst) | |
employment.type | userType | |
Laatste contract in de reeks | Uit de HR-bron (deactiveren) |
Related
BuddeeHR → Active Directory
BuddeeHR to Active Directory integration: domain account from employment and position in Buddee
BuddeeHR → AllSolutions
Buddee to AllSolutions integration: employees, positions and schedules from BuddeeHR in AllSolutions
ASBuddeeHR → Arbodienst (SIVI)
BuddeeHR to occupational health service via SIVI: verified sickness registrations from Buddee to the health service
BuddeeHR → Microsoft Entra ID
BuddeeHR to Entra ID integration: Microsoft 365 account from the employment in Buddee