Identity and access management
Nedap ONS to JumpCloud integration: care staff and teams as the source for JumpCloud
With an integration between Nedap ONS and JumpCloud, care staff from ONS become users in JumpCloud, with their teams as an attribute on which dynamic groups assign the right apps and devices. Before the first working day the user is staged without access, and after the last contract in ONS JumpCloud suspends them.
What the integration does
Care organisations that use Nedap ONS and JumpCloud for accounts, devices and sign-in often create users by hand as soon as a planner adds a new colleague in ONS. Team changes and departures then reach IT late, while access to records should match per team.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- KoppelHet receives the notifications from ONS and keeps a current row per employee, with teams, contract dates and a work address.
- In JumpCloud we set up a Custom API import on KoppelHet's address, with a state rule on the contract dates.
- Dynamic groups in JumpCloud look at the team attribute and grant apps, devices and policies.
- After the last contract the state rule sets the user to suspended.
What to watch for with Nedap ONS and JumpCloud
- ONS only grants access with a client certificate signed by Nedap, after approval per integration. JumpCloud's import reads a JSON list with a key and cannot request that certificate itself. KoppelHet holds the certificate and offers JumpCloud its own address with only the fields JumpCloud needs.
- Work email and username are required in the JumpCloud import, but ONS usually holds no work email for a new care worker. KoppelHet builds both from the birth name according to your rule, so a marriage does not change the login later.
- A care worker often works in several teams at once. A dynamic group in JumpCloud compares values literally and case-sensitively. KoppelHet puts all current team codes with delimiters into one custom attribute, so a rule on team 12 does not also catch team 120.
- A team assignment in ONS has a start and end date. KoppelHet changes the team attribute on those dates. JumpCloud recalculates dynamic groups when an attribute changes and every night, and that can take up to a day; for records that must close immediately, we agree a fixed group.
- A new colleague is often in ONS weeks before the start. The state rule in JumpCloud keeps the user staged, without access, until the first contract day. According to JumpCloud, once a user has been active they cannot go back to staged.
- ONS does not resend notifications when the receiver fails, keeps failed notifications for a day and can send a change before the creation. KoppelHet therefore acknowledges straight away, reads the full employee afterwards and uses the ONS updates list as a safety net.
- ONS distinguishes own employees from externals, such as flex workers and freelancers. That arrives as employee type in JumpCloud, so a dynamic group can give externals stricter password or device rules, for example.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Nedap have to approve the integration?
Yes. The care organisation requests it through the Ons API Dashboard; KoppelHet works on its behalf.
Is a leaver deleted from JumpCloud?
No, suspended. Deleting remains a step for IT.
Does client data go to JumpCloud?
No. The integration only requests employees, contracts and team assignments from Nedap.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS through the Ons API with webhooks (CREATE, UPDATE and DELETE for employee, contract and team_assignment, plus team_assignment_changed; HMAC-SHA512 in X-Signature-SHA512, acknowledgement with 200 within three seconds, no automatic retry, failed events kept for 24 hours) and /v0/xstream/api/employees/updates and /data. Access with a client certificate signed by Nedap (RSA 4096 bits, TLS 1.2), requested through the Ons API Dashboard.
- JumpCloud: Custom API import (HR Directories) on the KoppelHet address with Bearer Token or API Key, method GET, offset paging (limit and offset), Total Count; required mapping Company email and Username; State through EXPR with manageUserState (STAGED, ACTIVATED, SUSPENDED) and date functions such as today() and dateAfter(); hourly scheduled import. Dynamic groups on employeeType, department and a custom attribute (at most five custom attributes per group).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in JumpCloud | Notes |
|---|---|---|
identificationNo | employeeIdentifier | |
Roepnaam | firstname | |
Achternaam volgens naamgebruik | lastname | |
birthName en birthNamePrefix | username en Company email | Birth name, so the login stays the same |
type (0 Regular, 1 External) | employeeType | |
TeamAssignment (lopende teams) | Eigen kenmerk met teamcodes | With delimiters, for dynamic groups |
Team van het hoofdcontract | department | |
Begin eerste en einde laatste contract | State via manageUserState |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff