Identity and access management
Oracle HCM to SailPoint integration: Oracle HCM Cloud as the HR source, with the SailPoint connector or custom
With an integration between Oracle HCM Cloud and SailPoint, SailPoint knows every hire, change and termination from Oracle, so roles and access follow automatically and lapse after departure. SailPoint has its own Oracle HCM Cloud connector that reads workers in full and through Oracle's change feeds; KoppelHet comes in for what that connector, by its own documentation, only partly covers, such as multiple work relationships, changes of primary relationship, non-workers and back-dated changes.
What the integration does
Anyone using Oracle HCM Cloud and SailPoint Identity Security Cloud often already runs SailPoint's Oracle connector. Employees with a second work relationship, such as a permanent job plus an on-call contract with another legal employer, and contractors who move to permanent employment then get stuck in the interim processing.
- HR records a hire, transfer or new work relationship in Oracle.
- KoppelHet reads the change through the feeds and retrieves the whole person, with all work relationships and assignments.
- Using your rule, KoppelHet picks which work relationship and assignment count for roles.
- KoppelHet delivers the identity to SailPoint and starts the aggregation; SailPoint adjusts roles and access.
- Only when the last work relationship ends does the identity get an end date.
What to watch for with Oracle HCM Cloud and SailPoint
- SailPoint's Oracle connector takes the data of the primary work relationship, with the assignment whose effective date is closest to the aggregation date. If you want a different choice for roles, for example the work relationship at the Dutch legal employer, you have to adjust the mapping yourself. KoppelHet records that choice as a rule per country.
- According to SailPoint, intermediate processing through Oracle's change feeds only partly supports multiple work relationships, because the feeds do not return which work relationship an assignment belongs to. If the primary work relationship changes, that is not picked up in between. KoppelHet retrieves the whole person after each notification, so those changes are right straight away too.
- According to SailPoint, a contractor with a primary contingent relationship and a second relationship as employee is only converted correctly in a full aggregation, not in between. KoppelHet processes such a conversion when Oracle reports it.
- According to SailPoint, non-workers, such as contractors without a work relationship or interns recorded that way, are not included in intermediate processing. KoppelHet includes them in the delivery, so they too gain and lose access on time.
- On a manager change, SailPoint's intermediate processing only includes the line manager. If your roles or approvals also use a project manager or HR partner from Oracle, KoppelHet delivers that as a separate attribute.
- Back-dated changes, such as a termination HR enters later with a past date, are only partly supported by the SailPoint connector in between. KoppelHet compares the full state in Oracle with SailPoint every day, so such a termination does not stay unprocessed.
- Writing back to Oracle is only possible with the SailPoint connector for username and work email. That is usually exactly what is needed; KoppelHet leaves it to SailPoint if the connector is running anyway.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we have to switch off the SailPoint connector?
No. KoppelHet can run next to the connector for part of the workforce. We agree with the SailPoint team which source leads for whom.
What about audit logging, GDPR and our integration platform?
Every delivery and every error is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; salary from Oracle does not go to SailPoint. Oracle Integration Cloud or another integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- The SailPoint Oracle HCM Cloud connector (SaaS) supports full, single and delta aggregation, discover schema and update account (USER_NAME and WORK_EMAIL only, with attribute synchronisation). Delta through the Atom feeds newhire, empassignment, empupdate, termination, cancelworkrelship and workrelshipupdate, or through the Worker CSV Extractor (HCM Extract, change-only). Primary relationship on workRelationships.PrimaryFlag.
- KoppelHet reads the same Atom feeds and then retrieves the workers resource per person with workRelationships, assignments and managers. Delivery as CSV to a Delimited File source through the import-accounts API, which starts the aggregation right away.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Oracle HCM Cloud | Field in SailPoint | Notes |
|---|---|---|
PersonNumber | uid (User Name) | |
names.KnownAs of FirstName | firstname | |
names.LastName | lastname | |
emails (werk) of naamgevingsregel | email (Work Email) | |
assignments.JobCode | jobCode | |
assignments.DepartmentName | department | |
workRelationships.LegalEmployerName | legalEmployer | |
managers (lijnmanager) | manager | |
WorkerType | workerType | Employee, contingent worker or non-worker |
Begin en einde van de laatste arbeidsrelatie | startDate en endDate (lifecycle state) |
Related
Ashby → Oracle HCM Cloud
Ashby to Oracle HCM integration: an accepted offer on an opening becomes a pending worker
Bullhorn → Oracle HCM Cloud
Bullhorn to Oracle HCM integration: an approved placement of an employee becomes a pending worker
Carerix → Oracle HCM Cloud
Carerix to Oracle HCM integration: successful placement as a pending worker in Oracle HCM Cloud
Greenhouse → Oracle HCM Cloud
Greenhouse to Oracle HCM integration: accepted offer as a pending worker in Oracle HCM Cloud