Identity and access management
Rippling to Okta integration: Okta users from Rippling, with effective dates and rehires
With an integration between Rippling and Okta, every new employee in Rippling becomes an Okta user with job title, department, entity, manager and employment type, and that user is deactivated after departure. KoppelHet also handles changes with an effective date, rehires, withdrawn hires and a fixed division of tasks between Rippling and Okta.
What the integration does
Organisations that use Rippling for HR and Okta as identity provider have two systems that can both manage accounts in applications. Without an agreement Rippling creates an account in an app while Okta does the same, and a promotion with an effective date moves in Okta on the day HR enters it.
- Together with you we record which applications Okta manages and which Rippling manages, so each account has one owner.
- Rippling gets an API token on an admin account that is not tied to one employee; Okta gets a service app with OAuth.
- For a hire KoppelHet creates the Okta user without activation, with the Rippling user ID as the key.
- On the start date KoppelHet activates the user; scheduled changes go through on their effective date.
- After the end date KoppelHet deactivates the user; immediately for a dismissal that takes effect right away.
What to watch for with Rippling and Okta
- Rippling is an identity provider itself and can create and revoke accounts in applications. Okta can do so as well. KoppelHet only touches the Okta user and their groups, and the agreement per application prevents Rippling and Okta from managing the same account.
- In Rippling the user is the person and the worker a period of work. Someone who returns gets a new worker under the same user. KoppelHet uses the user ID as the key in Okta and reactivates the existing user, so a returning colleague does not get a second Okta account.
- A worker in Rippling goes through INIT, HIRED, ACCEPTED, ACTIVE and TERMINATED. At HIRED or ACCEPTED KoppelHet creates an Okta user without activation and activates them on the start date, so IT can prepare and the colleague can only sign in on day one.
- On a termination Rippling passes a type, such as voluntary, involuntary, offer declined or rescinded. If the hire never started, KoppelHet deletes the staged Okta user instead of deactivating them as a leaver. On an involuntary departure KoppelHet deactivates immediately.
- Rippling records for each change when it was saved and when it takes effect, and filtering on effective date misses future changes. KoppelHet follows changes on the moment they are saved and only puts a new job or department into Okta on the effective date, so groups do not switch too early.
- A Rippling API token expires when its creator leaves or when it has not been used for thirty days, and an Okta token also expires after thirty days without use. KoppelHet creates the Rippling token on an admin account and uses a service app with OAuth in Okta, so the integration does not stop when an administrator leaves.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Should Rippling or Okta manage the applications?
You choose that per application. What matters is that each account has one owner; KoppelHet records that choice at the start.
Is a leaver deleted from Okta?
No, deactivated. KoppelHet only deletes a staged user of a hire that did not go ahead.
Does the integration read salaries in Rippling?
No. The token only gets scopes for workers, users, departments and changes, not for compensation.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Rippling through the REST API (rest.ripplingapis.com: /workers with expand user and manager; status, start_date, end_date, termination_details, employment_type, department, legal_entity_id) and the Worker Changes API (applied_on and effective_on; scope worker-changes.read, entitlement through Rippling), plus webhooks.
- To Okta through the Users API with an OAuth 2.0 service app (scopes okta.users.manage and okta.groups.manage): create without activation, activate, deactivate and reactivate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Rippling | Field in Okta | Notes |
|---|---|---|
user_id | employeeNumber | Stays the same on rehire |
Voornaam en achternaam | firstName en lastName | |
work_email | login en email | |
title | title | |
department.name | department | |
legal_entity_id | organization | |
manager_id | managerId en manager | |
employment_type.type (EMPLOYEE, CONTRACTOR) | userType | |
status, start_date en end_date | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Carerix → Rippling
Carerix to Rippling integration: successful match as a hire for review in Rippling
Greenhouse → Rippling
Greenhouse to Rippling integration: every hire straight into Rippling for review
Recruitee → Rippling
Recruitee to Rippling integration: hired candidates ready to hire
Rippling → 4PS Construct
Rippling to 4PS Construct integration: own employees of the construction entity in 4PS, with department as a dimension