Identity and access management
Nedap ONS to OneLogin integration: care staff and team roles in OneLogin
With an integration between Nedap ONS and OneLogin, every care worker from ONS gets a OneLogin user, and the teams from ONS decide through mappings which roles and apps they get. When a team assignment ends, the role disappears; after the last contract KoppelHet sets the user to suspended.
What the integration does
Care organisations that use Nedap ONS and OneLogin as the sign-in portal for their applications often enter new colleagues and team changes in OneLogin by hand. Someone who moves to another team thus keeps access to the old team's applications.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- With the OneLogin administrator we define the custom fields for teams and worker type, and the mappings from team to role.
- For a new employee or a team change in ONS, KoppelHet creates or updates the OneLogin user and runs the mappings immediately.
- On the end date of a team assignment KoppelHet removes that team from the field, so the mapping removes the role.
- After the last contract KoppelHet sets the user to suspended.
What to watch for with Nedap ONS and OneLogin
- OneLogin has directories for Active Directory and Workday among others, but not for Nedap ONS. KoppelHet therefore writes through the OneLogin API itself, with the ONS number as external_id, so the same employee finds the existing user with every notification.
- Assigning roles directly to users requires the broad Manage All right in OneLogin. Creating and changing users only needs Manage Users. KoppelHet therefore puts the teams in a custom field and lets mappings in OneLogin grant the roles, so the integration can work with the narrower right.
- By default OneLogin runs mappings only after the response. On a team change KoppelHet asks for them to run immediately, so the new role is in place before the next notification from ONS is processed.
- A field name OneLogin does not know makes the whole creation or update fail. The fields for teams and worker type must therefore exist in OneLogin before the first care worker from ONS arrives; we arrange that with the administrator at the start.
- A username is unique within the subdomain in OneLogin. KoppelHet builds it from the birth name in ONS, with a sequence number for a duplicate name, so two colleagues with the same name each get their own login and a marriage does not change the login.
- Users created through the API get no invitation email from OneLogin. How a new care worker gets their first sign-in, for example through the manager or an activation link, is agreed in advance.
- ONS does not resend a failed notification and keeps it for a day. KoppelHet acknowledges every notification straight away and compares ONS with OneLogin daily, so a missed team change still reaches OneLogin the next day.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Nedap have to approve the integration?
Yes. The care organisation requests it through the Ons API Dashboard and Nedap reviews the request.
Who maintains the mappings from team to role?
Your OneLogin administrator. A new team in ONS therefore also needs a mapping in OneLogin; KoppelHet reports it when a team without a mapping appears.
Does client data go to OneLogin?
No. The integration only requests employees, contracts and team assignments from Nedap.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS through the Ons API with webhooks (CREATE, UPDATE and DELETE for employee, contract and team_assignment; HMAC-SHA512 in X-Signature-SHA512, acknowledgement with 200 within three seconds, no automatic retry) and /v0/xstream/api/employees/updates for the daily check. Access with a client certificate signed by Nedap, requested through the Ons API Dashboard.
- OneLogin API v2 with an API credential with Manage Users: POST /api/2/users and PUT /api/2/users/:id with username, email, firstname, lastname, department, external_id, custom_attributes and status (1 Active, 2 Suspended), with the parameter mappings=sync. Look-up with GET /api/2/users?external_id=…. Roles through mappings on the custom fields; POST /api/2/roles/:id/users would require Manage All and is not used.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in OneLogin | Notes |
|---|---|---|
identificationNo | external_id | |
Roepnaam | firstname | |
Achternaam volgens naamgebruik | lastname | |
birthName en birthNamePrefix | username en email | Unique within the subdomain |
TeamAssignment (lopende teams) | custom_attributes (teams) | Basis for mappings to roles |
type (0 Regular, 1 External) | custom_attributes (soort medewerker) | |
Team van het hoofdcontract | department | |
Einde laatste contract | status 2 (Suspended) |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff