Identity and access management
SAP SuccessFactors to OneLogin integration: Employee Central as the source for users in OneLogin
With an integration between SAP SuccessFactors and OneLogin, every new employee from Employee Central gets a user in OneLogin, with company, department, job title and manager, so OneLogin's mappings assign the right roles and apps. KoppelHet reads Employee Central and prepares the users through the OneLogin API, active on the start date and suspended on the end date.
What the integration does
Organisations that use OneLogin for single sign-on to SuccessFactors and other apps often create new colleagues in OneLogin by hand, and leavers stay active until someone suspends them.
- In SuccessFactors we create an API user with read-only rights and an OAuth client application with a certificate.
- In OneLogin the administrator creates an API credential with Manage Users and the custom attributes the mappings need.
- KoppelHet reads changes in person, employment, job and email from Employee Central, as they apply on the effective date.
- A new employee becomes an unactivated user in OneLogin; on the start date KoppelHet sets them to active.
- On a change KoppelHet updates the user and runs the mappings straight away; on the end date KoppelHet suspends them.
What to watch for with SAP SuccessFactors and OneLogin
- KoppelHet fills OneLogin through the OneLogin API, so OneLogin gets its users from the same source it already provides the login for.
- OneLogin has a standard external_id field and can search users on it. KoppelHet puts the personIdExternal from SuccessFactors there, not the userId. In SuccessFactors the userId is case-sensitive and can change, while the personIdExternal stays with the person; that way a changed username does not lead to a second OneLogin user.
- SuccessFactors stores several email addresses per person, and for a new employee there is often only the private address. OneLogin requires a username and an email address on creation. KoppelHet only uses the business type from SuccessFactors and otherwise the address from the naming rule, so no private address becomes a login in OneLogin.
- SuccessFactors shows a hire with a future start date with today's data by default. KoppelHet requests job and department as they apply on the start date and creates the OneLogin user with the status unactivated. On the start date KoppelHet sets it to active, so the mappings give the roles of the new job.
- OneLogin expects the manager as a OneLogin user ID, while SuccessFactors gives the manager's userId in EmpJob. KoppelHet first looks up the manager through their external_id and then fills manager_user_id. If a manager is hired at the same time as the team, KoppelHet creates the manager first.
- A custom attribute in OneLogin only exists once someone has created it, with a short name of letters, digits and underscores. KoppelHet creates the employee class from SuccessFactors, which mappings for contractors need, once as a custom attribute before the first user is filled.
- OneLogin allows five thousand API calls per hour per account, regardless of the number of tokens. A large restructuring in SuccessFactors can produce thousands of changes in one run. KoppelHet follows the remaining capacity in the headers and spreads such a run, so other integrations on the same OneLogin account keep working.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a new colleague get an invitation from OneLogin?
No, OneLogin sends no invitation through the API. How the first login works, we agree with you beforehand.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Employee Central through the OData API v2 with OAuth 2.0 (SAML bearer), on lastModifiedDateTime per entity (PerPerson, PerPersonal, PerEmail, EmpEmployment, EmpJob) and with asOfDate on the start date.
- OneLogin API v2 with a token from an API credential with Manage Users: POST /api/2/users?mappings=sync and PUT /api/2/users/{id} with username, email, firstname, lastname, company, department, title, manager_user_id, external_id, status (0 unactivated, 1 active, 2 suspended) and custom_attributes; GET /api/2/users with external_id or updated_since, 50 per page; POST /api/2/users/custom_attributes; 5,000 calls per hour per account (X-RateLimit-Remaining).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in OneLogin | Notes |
|---|---|---|
personIdExternal | external_id | Fixed key, also if the userId changes |
firstName, lastName (PerPersonal) | firstname, lastname | |
Zakelijk e-mailtype (PerEmail) of naamgevingsregel | email en username | |
company (EmpJob) | company | |
department (EmpJob) | department | |
jobTitle (EmpJob) | title | |
managerId (EmpJob) | manager_user_id | After looking up the OneLogin ID |
Soort medewerker | custom_attributes.employee_class | |
startDate en endDate (EmpEmployment) | status (0, 1 of 2) |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central