OIIdentity and access management
Dayforce to One Identity integration: Dayforce as the HR source for One Identity Manager through Starling Connect
One Identity Manager has a template for Dayforce that reads employees, departments and locations as Person, Department and Locality through the Starling Connect Dayforce connector. With an integration between Dayforce and One Identity, the HR data from Dayforce therefore drives accounts and permissions; KoppelHet sets up the Starling connector and the synchronisation and makes sure the first full run does not stall on Dayforce's limits.
What the integration does
Organisations that use Dayforce for HR and payroll and One Identity Manager for identity governance often already have a Starling Connect subscription but leave the Dayforce source unused. The first full synchronisation stopped on an error about too many requests, and since then One Identity Manager has been reading an export someone in HR makes.
- In Dayforce we create a web services user with a role that may only read the required employee data and change the four write-back fields.
- In Starling Connect we configure the Dayforce connector with a SCIM endpoint and set the date offset.
- In the Synchronization Editor we create a project with the SCIM connector and choose the Cloud HR template for Dayforce.
- KoppelHet plans the first full synchronisation so it stays within Dayforce's limit.
- After each run KoppelHet compares the number of employees with Dayforce and reports deviations.
What to watch for with Dayforce and One Identity
- One Identity Manager's Cloud HR Systems template for Dayforce is called One Identity Starling Connect Dayforce. It maps three Starling endpoints to three tables - Identities to Person, Departments to Department and Locations to Locality. Cost centres or other organisation levels from Dayforce are not in the template; KoppelHet adds them as a custom mapping if roles depend on them.
- In Starling Connect's known issues One Identity states that the first full synchronisation with Dayforce does not finish, because Dayforce returns a 429 error above one hundred requests per minute. Dayforce itself gives ten per second or one hundred per minute for fetching employee details. KoppelHet plans the first run outside office hours and in parts, so it does finish.
- Dayforce's limit applies per client, not per application. If other integrations already run on Dayforce, such as a payroll or time integration, they share the capacity with Starling Connect. KoppelHet maps those integrations up front and spreads the synchronisation so none of them stalls.
- According to One Identity, writing back is only possible for Phone, PhoneMobile, DefaultEmailAddress and Username, and One Identity advises against creating extra two-way mappings. KoppelHet leaves those four fields to One Identity Manager and keeps all other HR data one-way from Dayforce.
- Starling Connect has a configurable date and time offset for Dayforce. Dayforce often serves several countries; if the offset is wrong, a termination around midnight can reach One Identity Manager a day early or late. KoppelHet sets it to the time zone in which HR records the dates.
- The Dayforce connector later gained the employmentStatusGroup attribute. A status group is more stable than individual status codes that differ per country. KoppelHet bases the Person's status on that group, so a new local status code does not silently open or close access.
- The Starling connector for Dayforce does not create or delete employees; it only reads and updates a few fields. Anyone expecting an account in One Identity Manager to also terminate an employee in Dayforce will be disappointed. A departure always starts with HR in Dayforce.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why does the first synchronisation stall?
Dayforce allows at most one hundred employee detail requests per minute per client. A full run with all employees exceeds that if it is not spread out.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- One Identity Manager Cloud HR Systems module (9.3 guide: One Identity Manager 9.3 or later): template One Identity Starling Connect Dayforce on the SCIM connector, mapping sets Identities-Person, Departments-Department, Locations-Locality; update only Phone, PhoneMobile, DefaultEmailAddress and Username through Change master data. Synchronisation project in the Synchronization Editor, through a remote connection server if needed.
- Starling Connect Dayforce connector: SCIM endpoint, configurable datetime offset, employmentStatusGroup attribute, extra attributes on Employees and Organizations (GET/PUT); known issue: 429 above 100 requests per minute during the first full synchronisation. Dayforce RESTful Rate Limiter: 10 per second or 100 per minute for Get Employee HR Details, shared per client.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Dayforce | Field in One Identity | Notes |
|---|---|---|
XRefCode | Person (sleutel via de Identities-endpoint) | |
Voornaam en achternaam | FirstName, LastName | |
Departments | Department | |
Locations | Locality | |
employmentStatusGroup | Status van de Person | Attribute since a connector enhancement |
Begin- en einddatum dienstverband | EntryDate, ExitDate | |
Telefoon, mobiel, e-mail, gebruikersnaam | Phone, PhoneMobile, DefaultEmailAddress, Username | In both directions |
Related
Ashby → Dayforce
Ashby to Dayforce integration: have Dayforce validate the hire first, then save it
Bullhorn → Dayforce
Bullhorn to Dayforce integration: first placement of an employee as an employee in Dayforce
Carerix → Dayforce
Carerix to Dayforce integration: successful placement as a validated new employee in Dayforce
Dayforce → 4PS Construct
Dayforce to 4PS Construct integration: technicians and site managers from Dayforce in 4PS, with cost centre and end date