Identity and access management
Loket to Okta integration: employees from Loket.nl as the HR source for Okta, per employer
With an integration between Loket.nl and Okta, every new employee from Loket automatically gets an Okta user with the name they actually use, department and employer, and joins the groups that grant access to their apps. After the end date of the employment Okta deactivates the user, and an employee still in draft in Loket gets no access yet.
What the integration does
Organisations that run payroll in Loket.nl, often through a payroll bureau, and use Okta as their access gateway usually hear by email that someone starts or leaves. Okta users are then created by hand, with names that are not right, and leavers keep access until someone disables them.
- A Loket user with read-only rights gives KoppelHet one-time consent, and the Okta account team enables a custom HR source.
- KoppelHet asks per employer what has changed in employees and employments since the last run.
- An employee who is no longer a draft is delivered by KoppelHet to the HR source in Okta, with department and employer as groups.
- Okta creates the user and assigns the apps that belong to the groups.
- After the end date KoppelHet removes the employee from the HR source and Okta deactivates the user.
What to watch for with Loket and Okta
- KoppelHet delivers the employees through Anything-as-a-Source, the entry point Okta offers for a custom HR source. Loket then becomes the source in Okta for who works there.
- Loket only reports events to people by email, not to other systems. KoppelHet therefore requests the recorded changes per employer and only delivers those to Okta, instead of all employees every time.
- Loket stores prefix, surname and partner name separately, plus a formal name for the payslip. Okta shows the name in the dashboard and passes it on to apps. KoppelHet composes the name as the employee uses it, so apps behind Okta do not show "Bergen S.L. van".
- An employee number in Loket is only unique within one employer, while Okta wants one fixed key per user from the source. KoppelHet builds that key from employer code and number, so two employees numbered 12 at two employers are not seen as one user.
- A new employee can exist in Loket as a draft first. KoppelHet only delivers them to Okta once the draft has been converted, so a hire that falls through produces no Okta user and no app licences.
- Access to Loket runs on the consent of a Loket user, which is then refreshed continuously. If a payroll bureau works in your Loket, we have that consent given by a dedicated user with read-only rights, so the integration with Okta does not stop when someone at the bureau leaves.
- Okta only stores fields from a custom HR source as text. KoppelHet writes the start and end date from Loket in a fixed format, so Okta rules can work with the start date, for example for a welcome email.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Okta see salary data from Loket?
No. KoppelHet only reads name, employment and organisation, and only delivers those to Okta.
What happens to Okta users who are not in Loket?
The integration leaves them alone, such as contractors and admin accounts.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Loket is read through the Loket REST API with OAuth (authorization code flow with refresh token), per employer through the mutations on employee and employment; fields include employeeNumber, firstName, prefix, lastName, prefixPartner, lastNamePartner, formattedName, organisational entity and start and end date of employment. Event notifications are email recipients only.
- Okta is fed through the Identity Sources API (Custom Identity Source) with sessions, bulk-upsert for users, bulk-groups-upsert and bulk-group-memberships-upsert for department and employer, and bulk-delete at the end of employment (Okta deactivates). Profile attributes as strings only, at most 200 per request.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Loket | Field in Okta | Notes |
|---|---|---|
Werkgever en employeeNumber | externalId en employeeNumber | Employer code before the number |
firstName | firstName | |
prefix, lastName, prefixPartner, lastNamePartner | lastName en displayName | According to name usage |
Naamgevingsregel | login en email | |
Organisatorische eenheid | department en groep | |
Werkgever | organization en groep | |
Begindatum dienstverband | Eigen attribuut startdatum (tekst) | |
Einddatum dienstverband | Uit de HR-bron (deactiveren) |
Related
ADP Workforce Now → Loket
ADP Workforce Now to Loket integration: hires, pay, hours and bonuses from ADP to the Dutch payroll run
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll
BambooHR → Loket
BambooHR to Loket integration: HR changes from BambooHR for Dutch payroll
Bullhorn → Loket
Bullhorn to Loket integration: placement as a concept employee in the right payroll administration