Identity and access management
Nmbrs to OneLogin integration: OneLogin users from payroll
With an integration between Nmbrs and OneLogin, a new employee from Nmbrs automatically gets a OneLogin user with job, department, company and manager, so the apps behind OneLogin are ready on the first working day. After the end date in Nmbrs, KoppelHet sets the OneLogin user to suspended, which stops access to all those apps.
What the integration does
Organisations that run payroll in Nmbrs and use OneLogin for single sign-on often create OneLogin users by hand after a message from HR. Roles that rely on department are then wrong, and after a departure the user stays active until someone remembers.
- An Nmbrs user with read-only rights gives one-time consent for the integration, for the companies involved.
- KoppelHet reads employees, employment, job and department from Nmbrs per company.
- For a new employee KoppelHet creates a OneLogin user with a username according to the agreed rule and the Nmbrs number as external ID.
- Mappings in OneLogin assign roles and apps based on department, job and company.
- After the end date KoppelHet sets the user to suspended and logs this per employee.
What to watch for with Nmbrs and OneLogin
- OneLogin has no directory for Nmbrs, as it does for Workday or Active Directory. KoppelHet therefore writes through the OneLogin API itself, with the Nmbrs number in external_id, so the same employee finds the existing OneLogin user in every run.
- OneLogin refuses a second user with the same username within the subdomain. Because employee numbers in Nmbrs are only unique per company, KoppelHet builds the username from name and domain and puts the company in front of the number in external_id.
- Fields OneLogin does not know by default, such as the start date from Nmbrs, must first exist as a custom field in OneLogin. An unknown field name makes the whole creation fail. KoppelHet defines those fields in advance together with the OneLogin administrator.
- The manager in OneLogin is a OneLogin ID, while Nmbrs refers to a colleague in payroll. KoppelHet looks up that colleague's OneLogin user through external_id and creates the manager link only after the employee itself when they start at the same time.
- Access to Nmbrs runs through consent from an Nmbrs user, and that user decides which companies the integration sees. When a new company is added in Nmbrs, the consent must be extended, otherwise employees of that company get no OneLogin user.
- By default OneLogin runs mappings only after a user has been created. KoppelHet asks for the mappings to run immediately on creation, so roles and apps are fixed before the integration processes the next employee.
- Nmbrs is a payroll package with BSN, pay and bank account. The integration only requests read rights on personal, employment and organisation data, so that payroll data does not end up in OneLogin or at KoppelHet.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does OneLogin send an invitation to the new employee?
Not for users created through the API. How the employee gets their first password or sign-in is agreed in advance.
What happens to the user after departure?
KoppelHet sets the user to suspended. We do not delete, so the history stays in OneLogin. A fixed period before deletion can be added later as an extension.
Can the work email go back to Nmbrs?
We keep that out of the integration at the start. Writing back needs write rights in Nmbrs and can be added later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nmbrs is read through the Nmbrs Payroll REST API with OAuth 2.0 (authorization code), with read scopes such as employee.employment.read; the user who gives consent determines the visible companies. The SOAP API stops on 1 March 2027 and is not used.
- OneLogin API v2 with an API credential with the Manage Users right: POST /api/2/users with username, email, firstname, lastname, title, department, company, external_id, manager_user_id and custom_attributes, with mappings=sync. Look-up with GET /api/2/users?external_id=… (50 per page, filter updated_since). Status 1 is Active, 2 is Suspended.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nmbrs | Field in OneLogin | Notes |
|---|---|---|
Bedrijfscode + personeelsnummer | external_id | Employee numbers are unique per Nmbrs company |
Roepnaam | firstname | |
Achternaam volgens naamstelling | lastname | |
Naamgevingsregel | username en email | Username must be unique within the OneLogin subdomain |
Functie | title | |
Afdeling | department | |
Nmbrs-bedrijf | company | |
Leidinggevende | manager_user_id | Looked up as OneLogin user |
Datum in en uit dienst | custom_attributes | |
Datum uit dienst verstreken | status = 2 (Suspended) |
Related
ADP Workforce Now → Nmbrs
ADP Workforce Now to Nmbrs integration: the Dutch payroll group from ADP in the right Nmbrs company
AlexisHR → Nmbrs
AlexisHR (Simployer One) to Nmbrs integration: Dutch employees into payroll
BambooHR → Nmbrs
BambooHR to Nmbrs integration: Dutch payroll next to a global HR system
Bullhorn → Nmbrs
Bullhorn to Nmbrs integration: placements with hourly pay and end date in payroll