OIIdentity and access management
Nedap ONS to One Identity Manager integration: care staff as Person, teams as department
With an integration between Nedap ONS and One Identity Manager, care staff from ONS arrive as Person in One Identity, with their teams, expertise and contract dates. KoppelHet converts the ONS data into a fixed CSV file that the One Identity Manager CSV connector synchronises, so accounts and rights follow the planning in ONS.
What the integration does
Organisations that have scheduling and records in Nedap ONS and manage rights with One Identity Manager often read employees from payroll. Who may view which record, however, depends on team and expertise in ONS, and that picture then lags behind in One Identity.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- KoppelHet keeps employees, contracts, teams and expertise from ONS current based on the notifications from ONS.
- KoppelHet writes a file with teams and a file with employees to a folder the One Identity synchronisation server can read.
- The CSV connector synchronisation project converts teams to Department and employees to Person.
- One Identity creates accounts and assigns rights based on department and expertise; after the end date One Identity blocks the accounts.
What to watch for with Nedap ONS and One Identity
- One Identity Manager has no connector for Nedap ONS, and the CSV connector has no project template. KoppelHet therefore supplies a fixed file structure and sets up the synchronisation project that writes teams to Department and employees to Person.
- Once the CSV file is configured as a data import from another system, One Identity does not allow the MarkAsOutstanding processing method. An employee who disappears from the file is then not parked. KoppelHet therefore keeps leavers in the file with an end date, so One Identity blocks them itself.
- A care employee often has several areas of expertise, such as medication or reserved procedures. These go to One Identity as one multi-value column with a fixed delimiter, so rights can be assigned on each area separately.
- On a change ONS only sends a notification with an id. KoppelHet fetches the current record and writes the file again, so One Identity always reads a complete picture and not a series of separate changes that arrived in the wrong order.
- If the same employee appears twice in the file by mistake, the CSV connector can take the first, the last or neither row, or stop. KoppelHet checks the key before the file is written, and we set the connector to stop with an error message.
- A team in ONS can sit under a location or cluster in the hierarchy. KoppelHet fills in the full path of each team, so the CSV connector creates the parent departments first and a new team does not land in One Identity without a parent.
- The file contains dates that One Identity reads according to the configured language. KoppelHet always writes dates in the same format and in UTF-8, so 1 March is not read as 3 January and names with accents stay intact.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Where is the file stored?
In a folder the One Identity synchronisation server can read. KoppelHet places it there with an agent or through SFTP; we choose this together with your IT team.
Is client data included?
No. The integration only reads employees, contracts, teams and expertise.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS through the Ons API with webhooks for employee, contract and team_assignment (metadata with id only, HMAC-SHA512, 200 within 3 seconds, kept for 24 hours) and /v0/xstream/api/employees/data for the complete picture. Access with a client certificate signed by Nedap.
- One Identity Manager CSV connector, mapping to the default tables Person and Department; key column identificationNo, multi-value column for expertise, hierarchical sort order on the team path (Department.FullPath), file encoding UTF-8, Report error on uniqueness violation. Synchronisation step with the Data import option; MarkAsOutstanding is then not available.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in One Identity | Notes |
|---|---|---|
identificationNo | Person.PersonnelNumber | Key column in the CSV file |
Roepnaam en achternaam volgens naamgebruik | Person.FirstName en Person.LastName | |
Begin eerste contract | Person.EntryDate | |
Einde laatste contract | Person.ExitDate | |
Team van de hoofdtoewijzing | Person.UID_Department | Reference to Department from the team file |
ExpertiseProfileAssignment | Eigen kolom met meerdere waarden | |
type (0 Regular, 1 External) | Person.IsExternal |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff