Identity and access management
Nedap ONS to SailPoint integration: care teams and expertise as the basis for roles
With an integration between Nedap ONS and SailPoint Identity Security Cloud, KoppelHet delivers the employees from ONS to SailPoint as an authoritative source, with their teams, expertise and contract dates. SailPoint assigns and revokes roles on that basis, so access to care applications follows the planning and deployment in ONS.
What the integration does
Anyone basing access to the electronic care record, the medication application and the network on roles in SailPoint finds the data for those roles in Nedap ONS: team and expertise are recorded there, not in the HR system. Without an integration this runs through a periodic export from ONS to SailPoint.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request.
- KoppelHet follows the notifications from ONS and keeps track per employee of which teams they currently work in and which expertise they have.
- KoppelHet delivers the employees to the SailPoint source and starts processing straight away.
- SailPoint assigns or revokes roles based on team and expertise, and creates or changes the accounts in the target systems.
- After the last contract KoppelHet delivers the employee as inactive, so SailPoint revokes all access.
What to watch for with Nedap ONS and SailPoint
- Roles in care often depend on team and expertise, not on the job on the payslip. KoppelHet delivers both as a list per employee to SailPoint, so a role such as "nurse in team North" can be made with one rule in SailPoint.
- A team assignment in ONS has a start and end date. KoppelHet only delivers the teams that apply at that moment, so SailPoint revokes access to a team's records as soon as the assignment ends.
- SailPoint normally collects sources at fixed times. KoppelHet delivers after a series of changes in ONS and starts processing in SailPoint straight away, so a new deployment does not wait until the next scheduled round.
- If SailPoint also wants to manage roles within ONS itself, that runs through the ONS authorisation entry point. It always overwrites the integration's full set of roles and cannot read them back, so SailPoint cannot see for itself what is in ONS. KoppelHet then keeps track of that set.
- ONS distinguishes own employees from externals. That marking goes to SailPoint, so flex workers and freelancers can get their own identity profile or lifecycle.
- SailPoint rejects an identity without a work email address or surname. If a new care worker has no work address yet, KoppelHet fills an address from the naming rule, so the identity still exists on time.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is ONS then the only source in SailPoint?
Not necessarily. Often the HR system is the source for joiners and leavers and ONS supplies teams and expertise. In SailPoint the order of the identity profiles decides which source wins.
Does Nedap have to approve the integration?
Yes, through the Ons API Dashboard. KoppelHet works on behalf of the care organisation.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS is read through the Ons API with webhooks (HMAC signature, acknowledgement with 200 within three seconds) and the updates endpoints, with a client certificate signed by Nedap. Roles in ONS itself run through the Ons Autorisatie provisioning API, with a whitelist; that API overwrites the full set and cannot read back.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the file through the import-accounts API, which starts aggregation straight away. teams and expertises are multi-valued attributes; required attributes uid, email and lastname.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in SailPoint | Notes |
|---|---|---|
identificationNo | uid en employeeNumber | |
Roepnaam | firstname | |
Achternaam volgens naamgebruik | lastname | Required in SailPoint |
Zakelijk e-mailadres of naamgevingsregel | email | Required in SailPoint |
Actuele TeamAssignments | teams (lijst) | |
ExpertiseProfileAssignments | expertises (lijst) | |
type (0 Regular, 1 External) | workerType | |
Begin eerste en einde laatste contract | startDate en endDate |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff