Identity and access management
SAP SuccessFactors to Ping Identity integration: Employee Central as the source for the PingOne directory
With an integration between SAP SuccessFactors and Ping Identity, every new employee from Employee Central gets a user in PingOne, in the population of their company and with department, job title and manager. PingOne cannot import SuccessFactors itself; KoppelHet delivers the employees and disables a leaver on the end date, so the apps behind PingOne close.
What the integration does
Organisations that use PingOne for single sign-on and MFA and SAP SuccessFactors as their HR system find a built-in connection with Workday in PingOne, but not with SuccessFactors. Users are then created by hand or through a separate export, and leavers stay active until someone notices.
- In SuccessFactors we create an API user with read-only rights and an OAuth client application with a certificate.
- In PingOne the administrator creates a Worker app with the Identity Data Admin role, limited to this integration's populations.
- KoppelHet reads changes in person, employment, job and email from Employee Central, as they apply on the effective date.
- A new employee becomes a disabled user in the population of their company; on the start date KoppelHet enables them.
- On a transfer KoppelHet moves group memberships, and on the end date KoppelHet disables the user.
What to watch for with SAP SuccessFactors and Ping Identity
- As a source PingOne can only import Workday, an LDAP gateway and SCIM. SuccessFactors is not on that list. KoppelHet therefore delivers the employees itself through PingOne's SCIM interface.
- Ping also has PingOne Advanced Identity Cloud, and there a SuccessFactors template does exist, with full and incremental reconciliation and a private key to sign tokens. If your organisation uses that product, that template is the route and KoppelHet only sets up the SuccessFactors side.
- SuccessFactors stores several email addresses per person, PingOne accepts only one through SCIM. KoppelHet sends only the business type, so a private address never becomes the address in PingOne that MFA and recovery emails go to.
- Every PingOne user belongs to a population. KoppelHet creates a population per SuccessFactors company, so password policy and apps can differ per country. A transfer to another company moves the user on the effective date.
- PingOne's SCIM interface does not manage groups. KoppelHet sets the groups per department through the regular PingOne API, so a department change in SuccessFactors also shifts application access in PingOne.
- SuccessFactors shows a new employee with a future start date with today's data by default. KoppelHet requests the job data as it applies on the start date and creates the user disabled, so they can only sign in on the first working day.
- PingOne returns at most 200 users through SCIM and does not page. A full comparison of all SuccessFactors employees with PingOne therefore does not work through a list; KoppelHet searches per employee on the external key.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in PingOne?
A Worker app with the Identity Data Admin role, limited to this integration's populations. No rights on policies or applications.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Employee Central through the OData API v2 with OAuth 2.0 (SAML bearer), on lastModifiedDateTime per entity (PerPerson, PerPersonal, EmpEmployment, EmpJob, PerEmail) and with asOfDate on the start date.
- PingOne through a Worker app with the Identity Data Admin role: SCIM /v2/Users with externalId, one email value, population.id in the urn:pingidentity:schemas:extension:2.0:PingOneUser extension and active for enabled; lists up to 200 results without paging; groups (501 on /v2/Groups) through the PingOne Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in Ping Identity | Notes |
|---|---|---|
personIdExternal | externalId | Fixed key in PingOne |
firstName, lastName (PerPersonal) | name.givenName, name.familyName | |
Naamgevingsregel | userName | |
Zakelijk e-mailtype (PerEmail) | emails (één waarde) | |
jobTitle (EmpJob) | title | |
department (EmpJob) | Groep per afdeling | |
company (EmpJob) | population.id | |
managerId (EmpJob) | Leidinggevende (eigen attribuut) | |
Einddatum dienstverband | enabled = false |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central