Identity and access management
Oracle HCM to Okta integration: Oracle HCM Cloud as the HR source for Okta
With an integration between Oracle HCM Cloud and Okta, every new employee from Oracle automatically gets an Okta user with job title, department, legal employer and line manager, and access stops after departure or when a hire is cancelled. The Okta catalogue lists an Oracle HCM app by Okta, which mainly manages Oracle user accounts, and an HR source connector by Aquera; KoppelHet comes in when you want to use Oracle as a real HR source with your own rules for future-dated hires, transfers, contingent workers and multiple countries.
What the integration does
Organisations that use Oracle HCM Cloud worldwide and Okta for access have sign-in to Oracle covered by the Oracle app in Okta, but still create new colleagues in Okta by hand from a report. A candidate who drops out before starting sometimes remains a user in Okta.
- HR records a hire in Oracle with a start date in the future.
- Oracle reports the hire right away; KoppelHet stages the user in Okta, with the known-as name and a login following your convention.
- On the start date the user becomes active; groups for legal employer, department and job decide the apps.
- On a transfer to another legal employer KoppelHet keeps the same Okta user and adjusts groups and country.
- After termination the user is deactivated; for a cancelled hire the staged user is deleted.
What to watch for with Oracle HCM Cloud and Okta
- The Oracle HCM app that Okta ships mainly puts Okta users into Oracle as accounts and can import users with their role from Oracle. It is not described as an HR source for Okta, with job, department and manager from the worker data. For that the Okta catalogue lists Aquera's connector, or an integration like KoppelHet's.
- Aquera's Oracle connector is built and maintained by Aquera and runs in their own service on Amazon Web Services. A third party then sits between Oracle and Okta. Check in which region that data is held and with whom you sign the data processing agreement.
- Oracle reports a hire as soon as it is recorded with a future start date, and has a separate notification for a cancelled work relationship. KoppelHet stages the Okta user at the hire and deletes it again if the candidate withdraws before the start.
- An employee can have several managers in Oracle, such as a line manager and a project manager. Okta has one manager per user. KoppelHet takes the line manager of the primary assignment, so approvals in apps behind Okta reach the actual manager.
- On a transfer to another country Oracle creates a new work relationship with another legal employer. KoppelHet keeps the Okta user tied to the person number, so the colleague keeps their account and only groups and country change.
- Oracle also reports changes of contingent workers and of workers who have yet to start. The worker type goes to Okta, so group rules give contingent workers different apps and an end date of their own.
- Okta Workflows has an Oracle HCM connector to read, search and update workers, but without a card that reacts to changes in Oracle. A flow built with it therefore has to search on a schedule itself. KoppelHet reacts to Oracle's change feeds.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is the Oracle app in Okta still needed?
If employees sign in to Oracle through Okta or Okta manages their Oracle account, yes. KoppelHet then handles the flow from Oracle to Okta; the app remains the flow from Okta to Oracle.
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform, hosted in the EU and ISO 27001 certified. You are the controller and KoppelHet is the processor, under a data processing agreement. The integration runs next to Oracle Integration Cloud or another integration platform and asks nothing of it.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Okta's Oracle Human Capital Management app (OIN) works through Oracle's SCIM REST API, with push new users, push profile updates, push user deactivation, push password updates, import new users and import of the role attribute. The Aquera Oracle HCM Cloud Connector supports create, update, attribute sourcing, deactivate and schema discovery and runs in the Aquera User Import Bridge (AWS, SOC 2 Type II). The Okta Workflows connector has Read Worker, Search Workers and Update Worker.
- KoppelHet reads Oracle HCM Cloud through the employee Atom feeds newhire (also for a future-dated hire), empassignment, termination and cancelworkrelship, then the workers resource with names (KnownAs), workRelationships, assignments and managers. The work email goes back through the emails child.
- Okta is written through the Users API with an OAuth 2.0 service app (create without activation, activate, deactivate, delete for a cancelled hire) or through a Custom Identity Source with the Identity Sources API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Oracle HCM Cloud | Field in Okta | Notes |
|---|---|---|
PersonNumber | employeeNumber | |
names.KnownAs of FirstName | firstName | |
names.LastName | lastName | |
Naamgevingsregel | login en email | |
assignments.JobId (naam) | title | |
assignments.DepartmentId (naam) | department | |
workRelationships.LegalEmployerName | organization | |
managers (lijnmanager van de primaire assignment) | managerId en manager | |
WorkerType | userType | |
Feeds newhire, termination en cancelworkrelship | status (STAGED, ACTIVE, DEPROVISIONED) of verwijderen |
Related
Ashby → Oracle HCM Cloud
Ashby to Oracle HCM integration: an accepted offer on an opening becomes a pending worker
Bullhorn → Oracle HCM Cloud
Bullhorn to Oracle HCM integration: an approved placement of an employee becomes a pending worker
Carerix → Oracle HCM Cloud
Carerix to Oracle HCM integration: successful placement as a pending worker in Oracle HCM Cloud
Greenhouse → Oracle HCM Cloud
Greenhouse to Oracle HCM integration: accepted offer as a pending worker in Oracle HCM Cloud