Identity and access management
Cezanne HR to Okta integration: Okta users from Cezanne, and then Cezanne accounts from Okta
With an integration between Cezanne HR and Okta, a new employee from Cezanne gets an Okta user with job title, department, location and company, and Okta deactivates that user after the end of the employment in Cezanne. The SCIM integration Cezanne itself describes for Okta works the other way and only creates Cezanne accounts; KoppelHet fills Okta from Cezanne, so that SCIM integration then finds the right person.
What the integration does
Organisations that use Cezanne HR for HR and Okta for access often switch on the Cezanne app in Okta and expect it to fill Okta from Cezanne. That app, however, creates Cezanne users from Okta, and the Okta user itself remains manual work for IT.
- Through Cezanne's Customer Success contact KoppelHet gets API access with an integration user that only sees the employers needed.
- In Okta the account team enables a custom HR source for KoppelHet.
- KoppelHet reads persons, primary employments and the job, unit and location assignments, and delivers the changes to Okta.
- Anyone using Cezanne's SCIM app then lets Okta create the Cezanne account based on the person code.
- After the end date of the primary employment Okta deactivates the user.
What to watch for with Cezanne HR and Okta
- For Okta, Cezanne describes a SCIM integration with which Okta creates and deactivates Cezanne users. Cezanne does not mention data from Cezanne to Okta. KoppelHet delivers the missing direction, from HR to Okta, and does not touch Cezanne's SCIM settings.
- Cezanne's SCIM app can only create an account for someone who already exists as a person in Cezanne, and finds them through email or through an employee number equal to the person code or employment ID. KoppelHet puts the Cezanne person code in employeeNumber in Okta, so that integration always finds the right person.
- Through SCIM from Okta, Cezanne can only update username, Cezanne role and email; first name, last name and employee number come from the Cezanne record and do not change. Names and organisational data therefore belong in Cezanne, and KoppelHet takes them from there to Okta.
- Requesting all persons in Cezanne also returns future starters; the filter on active employees leaves them out. KoppelHet reads the full table with the start date, so a new colleague is staged in Okta and activated on the start date.
- An employment without an end has 31 December 2999 as its end date in Cezanne. KoppelHet treats that date as empty and only schedules a deactivation in Okta for a real end date.
- Job, organisational unit and location are separate assignments in Cezanne with their own effective date. Okta only accepts string values in a custom HR source. KoppelHet delivers the value that applies today as text, and switches the Okta group of location or unit on the effective date.
- Every employment in Cezanne belongs to a company code. KoppelHet uses the primary employment for the company group and the email domain in Okta, so someone with a secondment next to their permanent job keeps one Okta user.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the Cezanne app in Okta not do this already?
No. It creates Cezanne accounts from Okta. KoppelHet creates the Okta user from Cezanne. Together they cover both directions.
Do we need People PLUS+?
No. Without webhooks KoppelHet compares every hour.
Does this work with several employers?
Yes. The company code of the primary employment decides group and domain in Okta.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Cezanne HR API v2 (OData, dataservice.svc, JSON) with OAuth 2.0; access through Customer Success. Tables People (filter ActiveEmployee), PeopleToEmploymentCurrentPrimary, Employments (CompanyCode, TerminationDate), JobDeployments, OrgUnitPositionDeployments and LocationDeployments. Webhooks only with People PLUS+.
- Okta through a Custom Identity Source (bulk upsert of up to 200 profiles per request, string values only, bulk delete deactivates) or the Users API. Alongside this integration optionally the Cezanne app in Okta (SCIM, Administration > Integrations > SCIM in Cezanne, OAuth2 bearer token, matching on email or employee number).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Cezanne HR | Field in Okta | Notes |
|---|---|---|
PersonCode | employeeNumber en externalId | Also the key for Cezanne's SCIM app |
Voornaam en achternaam | firstName en lastName | |
Werkadres of naamgevingsregel | login en email | |
JobDeployments | title | |
OrgUnitPositionDeployments | department en groep | |
LocationDeployments | city en groep per locatie | |
CompanyCode (Employments) | organization en groep per bedrijf | |
TerminationDate | Deactiveren | 31-12-2999 means no end |
Related
Cezanne HR → Active Directory
Cezanne HR to Active Directory integration: domain accounts per employer and location
Cezanne HR → ADP iHCM
Cezanne HR to ADP iHCM integration: compensation, single payments and leavers to Dutch ADP payroll
Cezanne HR → AFAS Profit
Cezanne HR to AFAS integration: the Dutch employer from Cezanne in AFAS Profit Payroll
ASCezanne HR → Arbodienst (SIVI)
Cezanne HR to the occupational health service via SIVI: sickness absence events as absence reports