OIIdentity and access management
Loket to One Identity integration: employees from Loket.nl in One Identity Manager, with the right leaving date
With an integration between Loket.nl and One Identity Manager, employees, employers and organisational units from Loket are ready in fixed files that One Identity Manager's CSV connector imports. The end date of the last employment becomes the leaving date, on which One Identity Manager locks the identity and its accounts, without any pay data going along.
What the integration does
Organisations with their payroll in Loket.nl and One Identity Manager for identities often import employees through an export made by the payroll bureau. It lists every period of an employment separately, so an employee who returns appears in One Identity Manager as both a leaver and a new colleague.
- A dedicated Loket user with read-only rights on your employers gives KoppelHet consent.
- KoppelHet reads employees, employments and organisational units per employer, and leaves out draft employees.
- KoppelHet places an employee file and a department file where the synchronisation server reads them.
- One Identity Manager imports both files with the CSV connector and applies its rules for accounts and permissions.
- On the leaving date One Identity Manager's schedule sets the identity to permanently deactivated.
What to watch for with Loket and One Identity
- Employments in Loket are a chain of periods, with or without gaps. One Identity Manager locks accounts once the leaving date is reached. KoppelHet therefore sets the end date of the last period as the leaving date, and not the end of every period in between.
- If there is a gap between two periods, One Identity Manager has a temporary deactivation with a start and end date, after which a schedule reactivates the identity. KoppelHet fills those dates with the gap from Loket, so a seasonal worker gets their accounts back when the new period starts.
- An identity that is permanently deactivated can be reactivated by One Identity Manager if that did not come from a certification. If a former employee returns after a long time, Loket keeps the same employee number with the same employer. KoppelHet delivers them with the same key, so the existing identity reopens instead of a new one.
- An employee number in Loket is only unique per employer, and a payroll bureau often works with several employers in one environment. The CSV connector allows several key columns; KoppelHet supplies employer code and number as two columns that together determine the identity.
- A new employee can first exist in Loket as a draft. KoppelHet leaves draft employees out of the file, so One Identity Manager does not create a central account for someone whose hire is not yet final.
- Loket stores prefix and surname separately, plus those of the partner, and a formal name for the payslip. One Identity Manager builds display name and account names from the names in the file. KoppelHet puts the surname in it as the employee uses it, with the prefix in front.
- A Loket employer has its own organisational units. KoppelHet builds a path in the department file with the employer above it, so One Identity Manager sees the units of two employers as separate departments in one tree and imports the parent first.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with several employers at our payroll bureau?
Yes. All employers go into the same file, with the employer code as part of the key.
Does payroll data go to One Identity Manager?
No. Only name, number, employer, unit and the employment dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Loket is read through the Loket REST API (oauth.loket.nl, authorization code and refresh token) under /v2/providers/employers/{employerId}/employees, the employments as a chain of periods (broken or linked date chains) and the organisational units; draft employees are skipped. No BSN, pay or bank data in the files.
- One Identity Manager reads through the CSV connector: two files in one system connection, UTF-8 with header line, two key columns in the employee file, Hierarchical sort order on the department path, Read-only access. Leaving date and temporarily inactive from/until are processed by the schedules for leavers and temporary deactivation; reachable directly or through a remote connection server.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Loket | Field in One Identity | Notes |
|---|---|---|
Werkgevercode | Sleutelkolom 1 | |
employeeNumber | Sleutelkolom 2 | Unique together |
firstName | FirstName | |
prefix, lastName, prefixPartner, lastNamePartner | LastName | According to name usage |
Werkgever en organisatorische eenheid | Afdelingspad in het afdelingsbestand | |
Begindatum eerste periode | EntryDate | |
Einddatum laatste periode | ExitDate (uitdienstdatum) | |
Gat tussen twee perioden | Tijdelijk inactief van en tot |
Related
ADP Workforce Now → Loket
ADP Workforce Now to Loket integration: hires, pay, hours and bonuses from ADP to the Dutch payroll run
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll
BambooHR → Loket
BambooHR to Loket integration: HR changes from BambooHR for Dutch payroll
Bullhorn → Loket
Bullhorn to Loket integration: placement as a concept employee in the right payroll administration