Identity and access management
Nedap ONS to Okta integration: care staff and teams as the source for Okta
With an integration between Nedap ONS and Okta, ONS becomes the source for care staff in Okta, with their teams and expertise as groups, so Okta gives the right apps to whoever works in which team. When a team assignment or the last contract in ONS ends, the related access in Okta lapses.
What the integration does
Organisations that use Nedap ONS for scheduling and records and Okta as the gateway to their care applications often arrange that access per request. Which applications someone needs depends on team and expertise, and after a team change the old access often remains.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- KoppelHet delivers the employees from ONS to Okta as an HR source, with teams and expertise as groups.
- Through your group rules Okta gives the applications that go with team and expertise.
- When a team assignment in ONS starts or ends, KoppelHet adjusts the group membership in Okta on that date.
- After the last contract KoppelHet removes the employee from the source and Okta deactivates the user.
What to watch for with Nedap ONS and Okta
- Access to care applications often depends on team and expertise, and both are recorded in ONS. KoppelHet delivers them to Okta as groups with their members, so the app rules in Okta work on the current planning.
- A team assignment in ONS has a start and end date. KoppelHet adds the employee to the group on the start date and removes them on the end date, so access to a team's records does not remain longer than needed.
- ONS distinguishes own employees from externals, such as flex workers and freelancers. That marking goes to Okta, so externals can get different policies, for example stricter sign-in conditions.
- The login follows the birth name from ONS, not the name someone uses. After a marriage the name in Okta changes, but the login stays the same, so linked applications keep recognising the same user.
- ONS expects a notification to be acknowledged within three seconds. KoppelHet acknowledges straight away and delivers to Okta afterwards, so ONS does not see the integration as failing and no notifications are lost.
- ONS also holds client data. The integration only requests access from Nedap to employees and their assignments, so no client data goes to Okta.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Nedap have to approve the integration?
Yes. The care organisation requests it through the Ons API Dashboard and Nedap reviews the request. KoppelHet works on behalf of the care organisation.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads employees and their assignments, no client data.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS is read through the Ons API with webhooks (CREATE, UPDATE and DELETE for Employee and the assignments; HMAC signature, acknowledgement with 200 within three seconds) and the updates endpoints as a safety net. Access with a client certificate signed by Nedap, requested through the Ons API Dashboard.
- Okta is fed through the Identity Sources API (custom identity source) with bulk-upsert for users, bulk-groups-upsert for teams and expertise, bulk-group-memberships-upsert and -delete on the dates of the assignments, and bulk-delete after the last contract.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Okta | Notes |
|---|---|---|
identificationNo | externalId en employeeNumber | |
Roepnaam | firstName | |
Achternaam volgens naamgebruik | lastName | |
birthName en birthNamePrefix | login | Birth name, so the login does not change on marriage |
type (0 Regular, 1 External) | userType | |
TeamAssignment (team, begin, einde) | Lidmaatschap teamgroep | |
ExpertiseProfileAssignment | Lidmaatschap deskundigheidsgroep | |
Team van het hoofdcontract | department | |
Einde laatste contract | Uit de bron, gebruiker gedeactiveerd |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff