Identity and access management
Loket to OneLogin integration: OneLogin users per employer from Loket.nl
With an integration between Loket.nl and OneLogin, every new employee from Loket gets a OneLogin user with employer, organisational unit and job title, so the roles and apps from OneLogin are ready on the first working day. After the last employment KoppelHet sets the user in OneLogin to suspended.
What the integration does
Organisations that have payroll in Loket.nl and OneLogin for signing in to their apps only get a new colleague into OneLogin once someone raises a ticket. A temporary or seasonal worker with several periods in Loket meanwhile keeps access between two contracts.
- A dedicated Loket user with read-only rights gives KoppelHet consent; in OneLogin we create an API credential with the Manage Users right.
- KoppelHet reads the changed employees and employments per employer and skips draft employees.
- KoppelHet looks up the employee in OneLogin by external_id and creates them if they do not exist yet, with the mappings run immediately.
- On a transfer KoppelHet updates department and title, so the mappings in OneLogin adjust the roles.
- During a gap between two periods and after the last employment KoppelHet sets the status to suspended; at a new period back to active.
What to watch for with Loket and OneLogin
- OneLogin has no directory or app that reads employees from Loket. KoppelHet writes through the OneLogin API and puts employer code and employee number in external_id, the field OneLogin has for an ID from another directory. KoppelHet looks the user up on it in every round.
- Loket has no client credentials, OneLogin does. KoppelHet manages Loket's refresh token and a separate OneLogin credential with only Manage Users, so you can revoke the reading side and the writing side independently.
- An employment in Loket can consist of several periods, with a gap in between. KoppelHet sets the OneLogin user to suspended during such a gap and back to active at the next period, so someone who returns keeps the same user and the same app assignments.
- OneLogin does not send an invitation email to a user created through the API. Because a new employee is often only entered in Loket shortly before the start, KoppelHet creates the user straight away and we agree how the first password reaches the employee.
- In OneLogin roles follow from mappings on fields such as company and department. A payroll bureau often manages several employers in Loket; KoppelHet puts the employer in company and has the mappings run immediately at creation, so each employer gets its own apps from the first sign-in.
- A username must be unique within the OneLogin subdomain, and Loket stores the partner's surname next to the employee's own. KoppelHet builds the name from the name the employee uses, with the prefix in front, and chooses the agreed variant for a duplicate name instead of letting an error occur.
- A draft employee in Loket is still an applicant. KoppelHet only creates a OneLogin user once the draft has been converted, so an offer that falls through does not produce a user that the mappings have already linked to apps.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the manager come along to OneLogin?
Only if you record it in Loket; we check that during the intake. OneLogin expects a OneLogin ID for it, which KoppelHet then looks up.
Does pay data go to OneLogin?
No. Only name, employer, unit, job title, work email and the employment dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Loket through the Loket REST API (oauth.loket.nl, authorization code and refresh token) per employer through the mutations on employee and employment; fields include employeeNumber, firstName, prefix, lastName, prefixPartner, lastNamePartner, job title, organisational unit and the periods of the employment. No BSN, pay or bank data.
- OneLogin API v2 with an OAuth 2.0 token from an API credential with Manage Users: POST /api/2/users?mappings=sync with username, email, firstname, lastname, title, department, company, external_id and custom_attributes; lookup with GET /api/2/users?external_id=… (at most 50 per page, updated_since); status 1 Active and 2 Suspended; no invitation email through the API; a duplicate username returns 422.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Loket | Field in OneLogin | Notes |
|---|---|---|
Werkgevercode + employeeNumber | external_id | Unique across all employers |
Naamgevingsregel | username en email | |
firstName | firstname | |
prefix, lastName, prefixPartner, lastNamePartner | lastname | According to name usage |
Functie | title | |
Organisatorische eenheid | department | |
Werkgever | company | |
Begindatum dienstverband | custom_attributes (startdatum) | |
Gat of einddatum in de keten | status 2 (Suspended) |
Related
ADP Workforce Now → Loket
ADP Workforce Now to Loket integration: hires, pay, hours and bonuses from ADP to the Dutch payroll run
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll
BambooHR → Loket
BambooHR to Loket integration: HR changes from BambooHR for Dutch payroll
Bullhorn → Loket
Bullhorn to Loket integration: placement as a concept employee in the right payroll administration