Identity and access management
Nedap ONS to PingOne integration: care staff and teams as users and groups
With an integration between Nedap ONS and Ping Identity (PingOne), every care employee from ONS gets a user in PingOne, in the right population and in groups per team and expertise. When the last contract in ONS ends, KoppelHet disables the user in PingOne, so sign-in to the care applications stops.
What the integration does
Organisations that have Nedap ONS as the source for their care staff and PingOne as the access layer often create users and groups in PingOne by hand. As an HR source PingOne itself only reads a few large HR systems, and ONS is not one of them.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- At the start KoppelHet creates a population for own staff and one for externals in PingOne, with groups per team and expertise.
- A notification from ONS makes KoppelHet fetch the current record and create or update the user in PingOne.
- When a team assignment starts or ends, KoppelHet adjusts the membership of the team group on that date.
- After the last contract KoppelHet disables the user; deletion only follows after the retention period you choose.
What to watch for with Nedap ONS and Ping Identity
- PingOne's SCIM entry point has no endpoint for groups; a request to it returns 501. Teams and expertise from ONS therefore go through the regular PingOne API, and only the users themselves through SCIM.
- A list from PingOne's SCIM entry point returns at most 200 users and has no next page. With hundreds of care employees KoppelHet therefore cannot compare PingOne with ONS as a list. KoppelHet looks up each employee directly and keeps its own record of which users come from ONS.
- Every user in PingOne belongs to exactly one population. ONS distinguishes own employees from externals; KoppelHet puts each group in its own population, so a stricter sign-in policy can apply to flex workers and freelancers.
- A notification from ONS only carries an id and does not always arrive in order. KoppelHet fetches the current record on every notification, so PingOne never gets a change for an employee who does not exist yet.
- The username in PingOne follows the birth name from ONS. If someone uses a different surname after marriage, only the display name changes and the sign-in name for the care applications stays the same.
- A team assignment in ONS has an end date. KoppelHet removes the employee from the team group in PingOne on that day, even if the contract continues, so a relief worker no longer has access to that team's applications after their period.
- ONS does not retry a missed notification itself and keeps it for 24 hours. KoppelHet's nightly comparison catches what was not processed in that time, so a leaver does not stay active in PingOne.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can PingOne read Nedap ONS as an HR source itself?
No, not that we have found. KoppelHet delivers the ONS data through PingOne's SCIM and platform APIs.
Can PingOne then create accounts in care applications?
Yes, with PingOne's outbound provisioning, based on the groups KoppelHet fills.
Does client data go to PingOne?
No. The integration only reads employees, contracts and their assignments.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS through the Ons API with webhooks (metadata with id only, HMAC-SHA512 in X-Signature-SHA512, 200 within 3 seconds, no automatic retry, kept for 24 hours) and /v0/xstream/api/employees/data for the complete picture. Client certificate signed by Nedap.
- PingOne SCIM 2.0 (/v2/Users) for users, with userName required, population.id in the PingOne extension and active for enabled or disabled; no paging, at most 200 results, no sortBy or startIndex; /v2/Groups and /v2/Bulk return 501. Groups and memberships through the PingOne Platform API (groups and group memberships).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Ping Identity | Notes |
|---|---|---|
identificationNo | externalId | |
birthName en birthNamePrefix | userName | Required in PingOne; follows the birth name |
Roepnaam en achternaam volgens naamgebruik | name.givenName en name.familyName | |
type (0 Regular, 1 External) | population.id | Population for own staff or externals |
TeamAssignment (team, begin, einde) | Lidmaatschap teamgroep | |
ExpertiseProfileAssignment | Lidmaatschap deskundigheidsgroep | |
Einde laatste contract | active = false |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff