Identity and access management
Oracle HCM to Active Directory integration: domain accounts from Oracle Fusion HR
With an integration between Oracle HCM Cloud and Active Directory, KoppelHet creates a domain account in the right OU for every new employee of the Dutch entity in Oracle, with job, department and line manager. Contingent workers get their projected end date as expiry date, and on the last working day the account is disabled.
What the integration does
Organisations where Oracle HCM Cloud is managed centrally and the local network runs on Active Directory often create accounts for their own staff and contractors by hand. Contractor accounts then stay active because nobody passes on the end date.
- IT installs a small KoppelHet program once on a server in the domain. It does not read Oracle directly.
- KoppelHet's platform follows the notifications from Oracle and fetches the employee as soon as they are hired at the Dutch legal employer.
- The program in the domain creates the account in the OU for employees or contingent workers, with job, department and line manager.
- New departments and locations in Oracle reach IT as a notification, so the OU and group layout is ready before the first employee arrives.
- On the last working day KoppelHet disables the account and moves it to the leavers OU.
What to watch for with Oracle HCM Cloud and Active Directory
- Oracle holds a projected end date per work relationship. For contingent workers it is usually filled. KoppelHet sets that date as the account's expiry date, so contractor accounts also stop when nobody reports the departure.
- Oracle distinguishes employees, contingent workers and hires that are not yet final. Employees and contingent workers each go into their own OU with their own group policy; for a hire that is not yet final KoppelHet only creates an account if you want it to.
- Active Directory has two fields for a number. KoppelHet puts the Oracle person number in one and the assignment number in the other. The account thus stays tied to the person, while IT can also see which assignment someone currently works on.
- Oracle reports new departments and locations separately from employees. KoppelHet notifies IT, so the translation to an OU and groups is in place before the first employee in that department starts.
- Next to the name in Latin letters, Oracle sometimes keeps a name in the person's own script. For the Active Directory logon name KoppelHet uses the Latin name, converted to plain letters and shortened to 20 characters.
- If an employee is transferred to another legal employer, Oracle records it as a new work relationship. If the new entity does not belong to this domain, KoppelHet treats it as a departure; otherwise the account moves to the new entity's OU.
- KoppelHet's platform follows Oracle; the program in the domain only collects instructions over an outbound connection. Nothing needs opening in the firewall and the domain needs no access to Oracle.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the program in our domain need access to Oracle?
No. KoppelHet's platform reads Oracle with its own integration user. The program in your domain only receives the instructions for Active Directory.
What if a contingent worker's projected end date is extended?
Then Oracle reports a change and KoppelHet moves the account's expiry date along.
Does this also work without Active Directory, with Microsoft 365 only?
Yes, we build that integration too.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Oracle HCM Cloud is read through the employee Atom feeds (newhire, empassignment, termination, cancelworkrelship) and the workstructures Atom feeds for departments and locations, then the workers resource with workRelationships (LegalEmployerName, PrimaryFlag, WorkerType E, C or P, ReadyToConvertFlag, ProjectedTerminationDate, TerminationDate), assignments, managers and names (KnownAs).
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), employeeNumber, employeeType, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Oracle HCM Cloud | Field in Active Directory | Notes |
|---|---|---|
PersonNumber | employeeID | Key per person; at most 16 characters |
AssignmentNumber (primair) | employeeNumber | |
KnownAs of FirstName | givenName | |
LastName | sn en displayName | |
Naamgevingsregel | sAMAccountName en userPrincipalName | At most 20 characters, plain letters only |
Job | title | |
Department | department en groepen | |
LegalEmployerName en WorkerType | OU en employeeType | |
Line manager | manager | The account with the manager's person number |
ProjectedTerminationDate | accountExpires | Mainly for contingent workers |
Related
Ashby → Oracle HCM Cloud
Ashby to Oracle HCM integration: an accepted offer on an opening becomes a pending worker
Bullhorn → Oracle HCM Cloud
Bullhorn to Oracle HCM integration: an approved placement of an employee becomes a pending worker
Carerix → Oracle HCM Cloud
Carerix to Oracle HCM integration: successful placement as a pending worker in Oracle HCM Cloud
Greenhouse → Oracle HCM Cloud
Greenhouse to Oracle HCM integration: accepted offer as a pending worker in Oracle HCM Cloud