Identity and access management
Oracle HCM to Ping Identity integration: Oracle HCM Cloud as the source for the PingOne directory
With an integration between Oracle HCM Cloud and Ping Identity, every new employee from Oracle gets a user in PingOne, in the population of their legal employer and with job title, preferred name and worker type. PingOne cannot import Oracle HCM Cloud itself; KoppelHet delivers the users through the SCIM entry point, enables them on the start date and disables them on the end date.
What the integration does
Organisations that use PingOne for single sign-on and MFA and Oracle HCM Cloud as their HR system look in PingOne for an Oracle source and only find Workday. Advanced Identity Cloud does have Oracle templates, but those are for E-Business Suite and PeopleSoft. Without an integration IT creates users based on an email from HR, and a cancelled hire stays as an active user.
- In Oracle we create an integration user with read rights on the employee feeds and on workers.
- In PingOne the administrator creates a Worker app with the Identity Data Admin role, limited to the populations of this integration.
- KoppelHet follows the Oracle feeds and reads the person with their primary work relationship for each notification.
- A new employee becomes a disabled user in the population of their legal employer; on the start date KoppelHet enables them.
- On a transfer KoppelHet moves the user to the new population, and on the end date KoppelHet disables them.
What to watch for with Oracle HCM Cloud and Ping Identity
- PingOne can only use Workday, an LDAP gateway and SCIM as inbound sources. Ping Advanced Identity Cloud has templates for Oracle E-Business Suite and Oracle PeopleSoft, but not for Oracle HCM Cloud. KoppelHet therefore delivers itself through PingOne's SCIM API, which Ping recommends for importing identities.
- A user created in PingOne is enabled by default. Oracle reports a hire as soon as HR records it with a future start date. KoppelHet therefore explicitly creates such a person disabled and only enables them on the start date, so a new colleague cannot sign in weeks before their first working day.
- Every PingOne user belongs to one population, and it can only be changed with a separate call. In Oracle a transfer to another legal employer means a new work relationship. KoppelHet moves the existing user with that separate call to the new employer's population, so login and MFA registration stay.
- Oracle stores a preferred name next to the official first name. PingOne has both a given name and a nickname for a user. KoppelHet fills both, so apps behind PingOne can show the name colleagues use, while the official name remains available for apps that need it.
- The worker type from Oracle, such as employee or contingent worker, fits PingOne's type attribute, which Ping itself describes with examples such as Employee and Contractor. KoppelHet puts it there, so policies in PingOne can give contractors a shorter session, for example.
- If a candidate drops out before the start, Oracle sends a cancellation of the work relationship. The prepared PingOne user then never signed in. KoppelHet deletes it, instead of leaving it disabled, so the username is free if the same person starts later after all.
- Lists through PingOne's SCIM API stop at two hundred results with no next page. A daily check of all Oracle employees against PingOne therefore cannot use one list. KoppelHet searches per person on externalId and reports differences.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in PingOne?
A Worker app with the Identity Data Admin role for the populations of this integration. No rights on policies or applications.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Oracle HCM Cloud through the employee Atom feeds (newhire, also future-dated, empassignment, termination, cancelworkrelship) and the workers resource with names (KnownAs), emails, workRelationships (PrimaryFlag, LegalEmployerName, WorkerType) and assignments.
- PingOne through a Worker app with the Identity Data Admin role: SCIM /v2/Users with externalId, userName, one email value, nickName, title, userType, active and population.id in the extension urn:pingidentity:schemas:extension:2.0:PingOneUser; lists up to 200 results without paging; changing population through PUT /users/{id}/population of the Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Oracle HCM Cloud | Field in Ping Identity | Notes |
|---|---|---|
PersonNumber | externalId | Fixed key, up to 1,024 characters |
FirstName, LastName | name.givenName, name.familyName | |
KnownAs | nickName | |
Naamgevingsregel | userName | |
Werk-e-mailadres (emails) | emails (één waarde) | |
JobName (primaire assignment) | title | |
WorkerType | userType | For example Employee or Contractor |
LegalEmployerName | population.id | |
StartDate en TerminationDate | active (enabled) |
Related
Ashby → Oracle HCM Cloud
Ashby to Oracle HCM integration: an accepted offer on an opening becomes a pending worker
Bullhorn → Oracle HCM Cloud
Bullhorn to Oracle HCM integration: an approved placement of an employee becomes a pending worker
Carerix → Oracle HCM Cloud
Carerix to Oracle HCM integration: successful placement as a pending worker in Oracle HCM Cloud
Greenhouse → Oracle HCM Cloud
Greenhouse to Oracle HCM integration: accepted offer as a pending worker in Oracle HCM Cloud