Identity and access management
Rippling to Ping Identity integration: employees and contractors from Rippling as users in PingOne
With an integration between Rippling and Ping Identity, every employee and contractor from Rippling becomes a user in PingOne, in the population of their work location and with job title, worker type, country and manager. On a departure in Rippling the user can no longer sign in to PingOne, immediately for an involuntary departure and otherwise on the end date.
What the integration does
Organisations with Rippling for HR and PingOne for single sign-on and MFA have two systems that can both manage accounts in apps. Without a fixed flow from Rippling to PingOne, new colleagues are created by hand, and a leaver stays active in PingOne until someone notices.
- Rippling gets an API token on an admin account with read scopes only; PingOne gets a Worker app with the Identity Data Admin role.
- Together with you we record per app whether Rippling or PingOne creates the account.
- At HIRED or ACCEPTED KoppelHet creates the PingOne user in the population of the work location, with sign-in blocked.
- On the start date KoppelHet enables sign-in and the department's groups.
- On a termination KoppelHet blocks sign-in according to the type of departure; deletion follows after the retention period.
What to watch for with Rippling and Ping Identity
- PingOne supports LDAP Gateway, SCIM and Workday as inbound provisioning sources. Rippling is not among them and Rippling describes no outbound flow to PingOne. KoppelHet therefore writes the users through PingOne's API, with the Rippling user ID as externalId.
- Rippling and PingOne can both create accounts in apps such as Google Workspace or Slack. If they do so at the same time, duplicate or conflicting accounts appear. Together with you we divide the apps per system, and in PingOne KoppelHet only touches the user, population and groups.
- A worker in Rippling works at a fixed work location or remotely. PingOne puts every user in one population, which can only be changed with a separate call. KoppelHet chooses the population by work location, or by country for remote work, and moves the user with that separate call when it changes.
- Rippling distinguishes EMPLOYEE and CONTRACTOR as well as part-time, full-time and temporary. The type field in PingOne has no fixed meaning and takes up to 256 characters. KoppelHet fills it with a fixed combination, so sign-in policies in PingOne can treat temporary staff and contractors more strictly.
- PingOne ignores a custom attribute whose name or capitalisation is not exactly right, without an error. KoppelHet reads every new user back after creation and reports it if an attribute such as the legal entity from Rippling is missing.
- On a termination Rippling passes a type, including involuntary, offer declined and rescinded. KoppelHet blocks sign-in to PingOne immediately for an involuntary departure, on the end date for a regular departure, and deletes a staged user whose hire did not go ahead.
- If PingID runs in the PingOne environment, a username can no longer change after creation. A rehire gets a new worker under the same user in Rippling. KoppelHet searches by externalId and enables the existing user again, so the colleague gets their username and MFA device back.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does PingOne have a provisioner for Rippling?
No. PingOne only lists Workday as an HR source. KoppelHet delivers Rippling through PingOne's API.
Who creates the accounts in apps, Rippling or PingOne?
We record that per app. KoppelHet makes sure the users in PingOne are right, the division prevents duplicate accounts.
Does pay data go to PingOne?
No. The Rippling token has no scopes on compensation.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Rippling through the REST API (rest.ripplingapis.com: /workers with expand user, manager and department; status, start_date, end_date, termination_details.type, employment_type with type and amount_worked, country, location with type REMOTE or WORK) and webhooks. API token on an admin account with read scopes only.
- PingOne with a Worker app with the Identity Data Admin role: users through /v1/environments/{envID}/users with externalId (1 to 1024 characters), username unique and case-insensitive (at most 128 characters, immutable with PingID), title and type (at most 256 characters), address.countryCode (ISO 3166-1 alpha-2 in upper case); population.id only through the population sub-resource; enabled only through the separate enabled call. Custom attributes must match exactly on name and case.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Rippling | Field in Ping Identity | Notes |
|---|---|---|
user_id | externalId | |
Voornaam en achternaam | name.given en name.family | |
work_email | email en username | |
title | title | |
employment_type (type en amount_worked) | type | |
country | address.countryCode | |
location.work_location_id of country | population | |
department.name | Groep | |
status en termination_details.type | Aanmelden aan of uit |
Related
Carerix → Rippling
Carerix to Rippling integration: successful match as a hire for review in Rippling
Greenhouse → Rippling
Greenhouse to Rippling integration: every hire straight into Rippling for review
Recruitee → Rippling
Recruitee to Rippling integration: hired candidates ready to hire
Rippling → 4PS Construct
Rippling to 4PS Construct integration: own employees of the construction entity in 4PS, with department as a dimension