Identity and access management
Sympa to Active Directory integration: domain accounts in the right OU from Sympa
With an integration between Sympa and Active Directory, every new employee from Sympa gets a domain account in the right OU and groups, and the account is disabled after the employment ends. KoppelHet processes the changes with its own program in the domain, also with multiple entities, your own OU rules and departures on the day itself.
What the integration does
Anyone with Sympa as HR system and their own Active Directory has to process the changes from Sympa in the domain itself. When the script for that fails, often nobody notices.
- HR records a new employee in Sympa at the Dutch entity.
- KoppelHet reads the change within the hour and instructs the program in the domain to create a new account.
- The account is created disabled in the OU of entity and department, with the groups that belong to the job.
- On the start date the account is enabled; on a transfer it moves to the new OU.
- The end date is set straight away as the account expiry date, and after departure the account is disabled and moved to the leavers' OU.
What to watch for with Sympa and Active Directory
- Something in your network has to process the changes from Sympa in the domain. KoppelHet supplies that part with its own program in the domain, so there is no loose script that nobody maintains.
- A change can be left behind if processing fails once. KoppelHet also compares the active employees in Sympa with the domain every day, so a missed departure is still picked up.
- KoppelHet's program in the domain only fetches instructions over an outbound connection. No open firewall port is needed.
- KoppelHet includes several Sympa entities and records the OU per entity and department, so each entity and department sits in its own part of the domain.
- KoppelHet sets the end date from Sympa straight away as the account expiry date. If the connection stops for a day, the account still stops on time.
- An organisation unit in Sympa can be deeply nested. For the OU and groups KoppelHet uses the level that fits your domain structure, so a reorganisation of teams does not move accounts every time.
- Names in Sympa can contain characters Active Directory does not allow in a logon name, such as ä or ø for Scandinavian colleagues. KoppelHet converts them with a fixed table, and the display name keeps the original spelling.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What has to run in our network?
A small KoppelHet program on a Windows server in the domain, with an outbound connection. No open port.
What about audit logging, GDPR and our integration platform?
Every action in the domain is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; the Sympa interface only contains the fields in the design. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (OData v4) on its own interface with X-ApiKey, with $filter on modified and on the entity.
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), employeeNumber, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, company, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in Active Directory | Notes |
|---|---|---|
Personeelsnummer | employeeID en employeeNumber | |
Roepnaam of voornaam | givenName | |
Achternaam | sn | |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
Functie | title | |
Organisatie-eenheid | department en OU | |
Entiteit | company | |
Leidinggevende | manager | |
Einddatum dienstverband | accountExpires |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension