Identity and access management
Factorial to Okta integration: Okta users from Factorial, with team, entity and manager
With an integration between Factorial and Okta, every new employee in Factorial gets an Okta user with team, job title, legal entity and manager, and access closes after the end date in Factorial. Group rules in Okta can then work on team, job title and legal entity.
What the integration does
Organisations that use Factorial as their HR system and Okta as their identity provider want to assign apps by team or entity. That only works if those fields from Factorial are also in Okta.
- HR records a new employee in Factorial with legal entity, team, job title and start date.
- KoppelHet creates the Okta user without activating it, with a login on the entity's domain.
- On the start date KoppelHet activates the user; groups for team and entity assign the apps, including Factorial itself.
- A new contract version adjusts job title, team and groups on the effective date.
- After the end date KoppelHet deactivates the Okta user, which also stops the sign-in to Factorial.
What to watch for with Factorial and Okta
- Signing in to Factorial with Okta runs through a custom SAML app in Okta, and only users assigned to that app can sign in that way. KoppelHet assigns the app through a group on the start date and deactivates the user after the end date, so access to Factorial follows along.
- In Factorial's SAML settings you only add domains, and with several domains all of them. KoppelHet creates the Okta login per legal entity on one of those domains, so a colleague of a second entity does not end up on a domain Factorial does not know for sign-in.
- Factorial reports new hires, contract changes and terminations as separate types, filterable by legal entity. KoppelHet only reads the entities that belong to this Okta environment, so a subsidiary with its own Okta does not end up in the wrong environment.
- A new job or another team is in Factorial as a contract version with an effective date. KoppelHet changes title, department and groups in Okta on that date, so apps of the new team are not already open as soon as HR enters the version.
- An Okta Custom Identity Source processes one session at a time per source and rejects a new session within five minutes of an active one. KoppelHet therefore bundles notifications from Factorial every few minutes into one session, so a busy Monday with many new hires does not produce rejected sessions.
- Factorial retries a failed notification up to twenty times in 48 hours and then switches the subscription off. KoppelHet monitors that subscription and compares the active employees with Okta every day, so a departure never depends on a single notification.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does signing in to Factorial with Okta keep working?
Yes. KoppelHet assigns Factorial's SAML app through a group in Okta, and the login is on a domain configured in Factorial.
What about audit logging and GDPR?
Every action of the integration is in the audit logging of the KoppelHet platform, which runs in the EU. You are the controller and KoppelHet is the processor, under a data processing agreement. Salary and absence stay outside the integration.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SAML SSO with Okta through a custom app integration with Factorial's ACS on Amazon Cognito (eu-central-1), attribute emailaddress from user.email, and the company domains in Factorial under Single Sign On (SSO).
- KoppelHet reads Factorial through the Factorial API (version with a date in the path) with OAuth 2.0 - employee updates (new hires, contract changes, terminations) filtered on legal_entities_ids, employees, contract versions, teams and legal entities. Webhook subscriptions with up to twenty attempts in 48 hours.
- To Okta through the Users API with an OAuth 2.0 service app (create without activation, activate, deactivate, group membership) or through a Custom Identity Source (Identity Sources API, one session at a time per source, no new session within five minutes).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Factorial | Field in Okta | Notes |
|---|---|---|
Employee id | employeeNumber | |
first_name en last_name | firstName en lastName | |
Naamgevingsregel per entiteit | login en email | |
Functie (contract version) | title | |
Team | department | |
Legal entity | organization | |
Manager | managerId en manager | |
Startdatum en einddatum | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Factorial → 4PS Construct
Factorial to 4PS Construct integration: fitters and site managers with their cost centre as a dimension in 4PS
Factorial → Active Directory
Factorial to Active Directory integration: domain accounts from Factorial
Factorial → ADP iHCM
Factorial to ADP iHCM integration: contract versions and terminations of the Dutch entity to ADP
Factorial → AFAS Profit
Factorial to AFAS integration: employees and contracts from Factorial in AFAS Profit Payroll