Identity and access management
Oracle HCM to OneLogin integration: OneLogin users and roles from Oracle HCM Cloud
With an integration between Oracle HCM Cloud and OneLogin, every employee from Oracle becomes a OneLogin user with job title, department, legal employer and line manager, unactivated until the start date and suspended on departure. OneLogin has HR-driven provisioning for Workday and UKG among others, but not for Oracle; KoppelHet therefore writes through the OneLogin API and lets your mappings assign the roles.
What the integration does
Organisations with Oracle HCM Cloud as HR system and OneLogin as identity provider do see Oracle EBS and PeopleSoft as apps in OneLogin, but no Oracle HCM as a source. IT then creates users after an email from HR, and roles depend on who creates the user.
- In Oracle KoppelHet gets an integration user with read rights on workers and the employee Atom feeds.
- In OneLogin the administrator creates an API credential with Manage Users and the custom attributes the integration fills.
- Together with you we record which mappings in OneLogin give roles based on job, department, employer and worker type.
- On a hire KoppelHet creates the user as unactivated and runs the mappings straight away; on the start date the user is set to active.
- On termination KoppelHet sets the user to suspended on the last working day.
What to watch for with Oracle HCM Cloud and OneLogin
- For HR-driven provisioning OneLogin names Workday, UKG, Namely, BambooHR, HiBob and Sapling. On the directory page Oracle only appears as Oracle EBS and PeopleSoft, applications whose access OneLogin secures. The route from Oracle HCM Cloud therefore runs through the OneLogin API.
- Oracle reports a hire as soon as the future start date is set. OneLogin has status 0, unactivated. KoppelHet creates the user in that status with roles through the mappings, and sets it to 1, active, on the start date. A user created through the API gets no invitation email; you arrange the first sign-in yourselves.
- If HR cancels the work relationship before the start, Oracle sends a notification of its own. KoppelHet then sets the OneLogin user to suspended and tells IT, so the username is not silently taken. Usernames must be unique within the OneLogin subdomain.
- Oracle can have a line manager and other managers per assignment, while OneLogin has one manager_user_id holding a OneLogin ID. KoppelHet takes the line manager of the primary assignment, looks up their OneLogin user through external_id and only then fills the field.
- OneLogin rejects the whole user if the request contains a custom attribute that does not exist yet. The worker type from Oracle, needed to give contingent workers different roles, is therefore created first as a custom attribute by the administrator before KoppelHet fills it.
- A transfer to another legal employer is a new work relationship in Oracle with the same PersonNumber. KoppelHet only changes company and reruns the mappings, so the colleague keeps their OneLogin user and MFA and only gets the roles of the new employer.
- OneLogin allows 5,000 API calls per hour per account, for all integrations together. A reorganisation in Oracle with one effective date can change hundreds of assignments at once. KoppelHet spreads such a wave over several hours and watches the remaining allowance OneLogin returns in every response.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Who decides the roles in OneLogin?
Your mappings in OneLogin. KoppelHet supplies the fields from Oracle and runs the mappings straight away on every change.
Is a leaver deleted from OneLogin?
No, the user is set to suspended. Deleting after the retention period remains IT's choice.
Does the integration write anything back to Oracle?
Not by default. Writing the work email back to Oracle can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Oracle HCM Cloud: employee Atom feeds newhire, empassignment, termination and cancelworkrelship; workers resource with names, workRelationships (LegalEmployerName, PrimaryFlag), assignments (JobName, DepartmentName) and managers; pagination with limit, offset and hasMore.
- OneLogin API v2 with a token from a credential with Manage Users: POST /api/2/users?mappings=sync and PUT /api/2/users/{id} with username, email, firstname, lastname, title, department, company, external_id, manager_user_id, custom_attributes and status (0 Unactivated, 1 Active, 2 Suspended); an unknown custom attribute returns 400, a duplicate username 422; 5,000 calls per hour per account (X-RateLimit-Remaining).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Oracle HCM Cloud | Field in OneLogin | Notes |
|---|---|---|
PersonNumber | external_id | |
names (KnownAs of FirstName, LastName) | firstname, lastname | |
Naamgevingsregel | username en email | |
assignments: JobName | title | |
assignments: DepartmentName | department | |
workRelationships: LegalEmployerName | company | |
Lijnmanager van de primaire assignment | manager_user_id | |
WorkerType | custom_attributes.worker_type | |
Feeds newhire, termination en cancelworkrelship | status (0, 1 of 2) |
Related
Ashby → Oracle HCM Cloud
Ashby to Oracle HCM integration: an accepted offer on an opening becomes a pending worker
Bullhorn → Oracle HCM Cloud
Bullhorn to Oracle HCM integration: an approved placement of an employee becomes a pending worker
Carerix → Oracle HCM Cloud
Carerix to Oracle HCM integration: successful placement as a pending worker in Oracle HCM Cloud
Greenhouse → Oracle HCM Cloud
Greenhouse to Oracle HCM integration: accepted offer as a pending worker in Oracle HCM Cloud