Identity and access management
Sympa to Okta integration: Okta users from Sympa, also for multiple entities
With an integration between Sympa and Okta, every new employee from Sympa gets an Okta user with job title, organisational unit, legal entity and manager, and access closes when the employment in Sympa ends. KoppelHet includes multiple entities in one integration, lets a departure take effect on the end date itself and writes the Okta address back to Sympa.
What the integration does
Organisations that use Sympa as their HR system and Okta as their identity provider often set up signing in to Sympa with Okta first. They then find that this sign-in does not transfer employees.
- The Sympa administrator composes an interface with only the fields for Okta, without salary or national ID.
- Every hour KoppelHet reads the changed employees and stages new colleagues in Okta, without them being able to sign in yet.
- On the start date KoppelHet activates the user; groups per entity and organisational unit decide the apps.
- The Okta address goes back to Sympa, so the username for the Okta sign-in to Sympa is right.
- After the end date of the employment KoppelHet deactivates the Okta user.
What to watch for with Sympa and Okta
- If a group has a Dutch and a German entity in Sympa and one Okta environment, KoppelHet reads all entities in one integration, with a naming rule and groups per entity.
- For the Okta sign-in to Sympa, the username in Sympa must be a UPN. KoppelHet writes the Okta address back to Sympa after creation, so the username and Okta login are the same from the first working day.
- KoppelHet deactivates the Okta user on the end date from Sympa and logs every deactivation, so you can see when access was closed.
- Sympa answers read requests from a reporting database that can lag up to half an hour. An employee who was just entered can therefore still be missing there. KoppelHet never deactivates in Okta because someone drops out of a read run, only on an end date that Sympa returns.
- An Okta Custom Identity Source accepts up to two hundred profiles per request, with string values only. Sympa allows one hundred requests per hour per interface by default. KoppelHet reads Sympa in a few large pages, sends the organisational unit as a text path and delivers the whole hourly run in one Okta session.
- A transfer is often in Sympa weeks ahead, with a validity date. KoppelHet requests today's state, so Okta only assigns the groups of the new unit on the effective date and the employee keeps their old apps until then.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is signing in to Sympa with Okta part of the integration?
No, that is set up separately. KoppelHet does make sure the username in Sympa equals the Okta login, so that sign-in works.
Does the integration see salaries in Sympa?
No. The interface for KoppelHet only contains the fields Okta needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (OData v4) on a dedicated interface with X-ApiKey, with $filter on modified, $top and $skip, at= for the valid state and a target field on the manager; writing back with PATCH on the unique key. By default 100 requests per hour per interface.
- To Okta through a Custom Identity Source (Identity Sources API; session, bulk upsert of up to 200 profiles per request and 50 requests per session, bulk delete for deactivation) or through the Users API with an OAuth 2.0 service app.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in Okta | Notes |
|---|---|---|
Personeelsnummer | employeeNumber | |
Roepnaam of voornaam | firstName | |
Achternaam | lastName | |
Naamgevingsregel per entiteit | login en email | |
Functie | title | |
Organisatie-eenheid | department en groepen | |
Entiteit | organization | |
Leidinggevende (e-mail via doelveld) | managerId en manager | |
Begin- en einddatum dienstverband | status (STAGED, ACTIVE, DEPROVISIONED) | |
login (Okta) | Werk-e-mail en gebruikersnaam in Sympa |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension