Identity and access management
Dayforce to OneLogin integration: OneLogin users from Dayforce, within the limits of both APIs
With an integration between Dayforce and OneLogin, every employee from Dayforce becomes a OneLogin user with job title, department, location and the manager of their primary work assignment, and the user is suspended as soon as employment ends in Dayforce. OneLogin has no Dayforce directory; KoppelHet reads Dayforce, writes through the OneLogin API and puts the OneLogin login back as the SSO account in Dayforce.
What the integration does
Organisations with Dayforce for HR and payroll and OneLogin as identity provider often put new colleagues into OneLogin by hand. Roles for a location or country are then forgotten, and Dayforce holds no SSO account, so signing in to one's own payslip only works after a ticket.
- In Dayforce KoppelHet gets an API user with a role for the fields OneLogin needs and the SSO account.
- In OneLogin the administrator creates an API credential with Manage Users and the custom attribute for the country.
- At go-live we link existing OneLogin users to their XRefCode.
- New employees arrive as unactivated with roles from the mappings, and are set to active on the start date.
- After creation KoppelHet sets the OneLogin username as the SSO account in Dayforce.
What to watch for with Dayforce and OneLogin
- As HR sources for provisioning OneLogin names Workday, UKG, Namely, BambooHR, HiBob and Sapling. Dayforce is not among them. KoppelHet therefore uses the OneLogin API to create and update users, with your own mappings for the roles.
- Both sides have a limit. Dayforce returns at most one hundred employee details per minute, OneLogin allows five thousand calls per hour per account. A full comparison of a large population therefore touches both limits; KoppelHet spreads it over the night and only works with changed employees during the day.
- A hire is often entered weeks ahead in Dayforce. KoppelHet requests the data as it applies on the start date and creates the OneLogin user with status 0, unactivated. The mappings then already give the roles of the new job, but signing in only becomes possible when KoppelHet sets status 1 on the start date.
- Dayforce stores managers per work assignment; OneLogin expects the manager as a OneLogin user ID. KoppelHet takes the manager of the primary work assignment, looks up their user through external_id and fills manager_user_id, so approvals in apps behind OneLogin end up with the day-to-day manager.
- Dayforce can store an account for single sign-on per employee. If employees sign in to Dayforce through OneLogin, KoppelHet puts the OneLogin username there, so a new colleague can also get into Dayforce on day one. That is why this integration runs in two directions.
- Dayforce often serves several countries. OneLogin has no standard field for country; KoppelHet puts the country of the primary work location in a custom attribute, which must exist in OneLogin first. An unknown attribute makes OneLogin reject the whole user.
- Without the right to a field, Dayforce leaves it out of the response without an error. An empty job title would trigger the wrong mapping in OneLogin and therefore the wrong roles. KoppelHet only writes an employee to OneLogin once job title, department and country are filled.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do new users get an invitation email from OneLogin?
No, OneLogin does not send one when users are created through the API. You decide how a new colleague gets their first password or passkey.
Is a leaver deleted from OneLogin?
No, the user is set to suspended. Deleting remains IT's choice.
Does the integration take capacity from our payroll integration on Dayforce?
KoppelHet only requests changed employees and spreads the nightly comparison, so other integrations keep room within the Dayforce limit.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Dayforce RESTful Web Services: GET /V1/Employees with filterUpdatedStartDate, filterUpdatedEndDate, filterHireStartDate and filterTerminationStartDate (XRefCodes only), per XRefCode the details with expand for WorkAssignments, EmploymentStatuses, EmployeeWorkAssignmentManagers, Contacts and SSOAccounts, with contextDate; rate limiter 10 per second or 100 per minute per customer.
- OneLogin API v2 with a credential with Manage Users: POST /api/2/users?mappings=sync and PUT /api/2/users/{id} with username, email, firstname, lastname, title, department, company, external_id, manager_user_id, custom_attributes and status (0 Unactivated, 1 Active, 2 Suspended); GET /api/2/users on external_id; 5,000 calls per hour per account.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Dayforce | Field in OneLogin | Notes |
|---|---|---|
XRefCode | external_id | |
FirstName, LastName | firstname, lastname | |
Contacts (zakelijk e-mailadres) of naamgevingsregel | username en email | |
WorkAssignments (primair): Job | title | |
WorkAssignments (primair): Department | department | |
Legal entity | company | |
WorkAssignments (primair): Location, land | custom_attributes.country | |
EmployeeWorkAssignmentManagers (primair) | manager_user_id | |
EmploymentStatuses, HireDate, TerminationDate | status (0, 1 of 2) | |
username (OneLogin) | SSOAccounts (Dayforce) |
Related
Ashby → Dayforce
Ashby to Dayforce integration: have Dayforce validate the hire first, then save it
Bullhorn → Dayforce
Bullhorn to Dayforce integration: first placement of an employee as an employee in Dayforce
Carerix → Dayforce
Carerix to Dayforce integration: successful placement as a validated new employee in Dayforce
Dayforce → 4PS Construct
Dayforce to 4PS Construct integration: technicians and site managers from Dayforce in 4PS, with cost centre and end date