Identity and access management
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff
With an integration between Nedap ONS and Google Workspace, every care worker in ONS gets a Google account and is a member of the Google groups of the teams and expertise recorded in ONS. After the last contract the account is suspended, and flex workers and freelancers get their own organisational unit with stricter rules.
What the integration does
Organisations that schedule in Nedap ONS and use Google Workspace for email, calendar and protocols often maintain the team groups in Google by hand. When employees work in several teams and the team layout changes often, those groups always lag behind.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- A new employee in ONS gets a Google account in the organisational unit for own staff or for externals.
- The teams and expertise from ONS decide the Google groups, and with them the shared calendars and protocol folders.
- When a team assignment ends or a new one starts, KoppelHet adjusts the groups on that date.
- After the last contract KoppelHet suspends the account and transfers the files.
What to watch for with Nedap ONS and Google Workspace
- Care workers often work in several teams at once, each with a start and end date in ONS. KoppelHet turns each team assignment into a membership of that team's Google group, and removes it on the end date.
- ONS also records expertise, such as district nurse or care assistant. These become separate Google groups, so for example only nurses see the folder with nursing protocols.
- ONS distinguishes own employees from externals, such as flex workers and freelancers. Externals go into their own organisational unit, where you can for example restrict sharing outside the organisation and sign-in on unknown devices.
- The email address follows the birth name from ONS, not the name someone uses. If an employee marries, the name in Google changes, but the address stays the same.
- ONS also holds client data. The integration only requests access from Nedap to employees and their team and expertise assignments, so no client record passes through the integration.
- ONS expects a notification to be acknowledged within three seconds, and tests at registration whether the receiver rejects a notification with a wrong signature. KoppelHet acknowledges straight away and processes afterwards, so ONS does not see the integration as failing.
- Someone who gets a new contract while the old one ends stays active. KoppelHet only suspends once the last contract in ONS has ended.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Nedap have to approve the integration?
Yes. The care organisation requests the integration through the Ons API Dashboard and Nedap reviews the request. KoppelHet always works on behalf of the care organisation.
Does client data end up in Google?
No. The integration only reads employees and their team and expertise assignments.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads the fields Google Workspace needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS is read through the Ons API with webhooks (CREATE, UPDATE and DELETE for Employee and the assignments; HMAC signature, acknowledgement with 200 within three seconds, 401 on a wrong HMAC, NOP events at registration) and the updates endpoints as a safety net. Initial load through /v0/xstream/api/employees/data. Access with a client certificate signed by Nedap, requested through the Ons API Dashboard.
- Google is written through the Admin SDK Directory API (users with externalIds, name, primaryEmail, orgUnitPath, organizations and suspended; groups and members) and the Data Transfer API for Drive. Access through a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Google Workspace | Notes |
|---|---|---|
identificationNo | externalIds (type organization) | |
Roepnaam | name.givenName | |
Achternaam volgens naamgebruik | name.familyName | |
birthName en birthNamePrefix | primaryEmail | Birth name, so the address does not change on marriage |
type (0 Regular, 1 External) | orgUnitPath | |
TeamAssignment (team, begin, einde) | Lidmaatschap teamgroep | |
ExpertiseProfileAssignment | Lidmaatschap deskundigheidsgroep | |
Team van het hoofdcontract | organizations.department | |
Einde laatste contract | suspended = true |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → JumpCloud
Nedap ONS to JumpCloud integration: care staff and teams as the source for JumpCloud