OIIdentity and access management
Sympa to One Identity integration: employees and organisation from Sympa in One Identity Manager
With an integration between Sympa and One Identity Manager, all employees from Sympa are in fixed files every day, with entity, organisation path, manager, entry date and exit date as valid today, which One Identity Manager's CSV connector reads. One Identity Manager uses them to assign rights per entity and department, and processes a departure on the end date from Sympa.
What the integration does
Organisations with Sympa and One Identity Manager have no connector between the two. Sympa does sell a nightly CSV with changes, but it is meant to be processed by hand, and One Identity Manager needs the full state instead.
- In Sympa the administrator composes a dedicated API interface with only the fields for One Identity Manager.
- KoppelHet reads today's state and creates a persons file and a departments file.
- The One Identity Manager administrator sets up the CSV connector with both files, the employee number as key and the department path as hierarchical sort order.
- Before placing the files KoppelHet checks whether the number of rows matches the count Sympa reports.
- A leaver stays in the file with the end date as exit date, until after the retention period.
What to watch for with Sympa and One Identity
- Sympa sells an Automated Data Change Export: CSV files with changes every night on a Sympa SFTP folder, for € 86 per month. Sympa adds that the files are meant to be processed by hand and are not guaranteed to fit third-party software. KoppelHet instead delivers the full state in the form One Identity Manager's CSV connector expects.
- Besides personal and organisational data, that Sympa export also contains files with pay, allowances and one-off payments. One Identity Manager does not need those. KoppelHet's interface only contains name, organisation, manager and dates, so no pay data ends up on the synchronisation server.
- Organisational units are stored in Sympa as a tree field. The CSV connector can use one column as hierarchical sort order. KoppelHet builds the full path per department from the tree, so One Identity Manager only loads a new unit after its parent exists.
- With at Sympa returns the state of a table with validity on a chosen day. KoppelHet builds the nightly file with today's state, so a transfer HR enters in advance only gives different rights in One Identity Manager on its effective date.
- With $count Sympa returns the total number of matches, regardless of $top and $skip. KoppelHet compares the number of rows in the file with that figure and does not place the file if they differ, so One Identity Manager never reads half a file.
- Read requests to Sympa go to a reporting database that can lag up to half an hour. KoppelHet creates the nightly file well after the last changes of the day, and keeps an employee who is missing from an hourly run in the file until Sympa gives an end date.
- One Identity Manager cannot mark a row that disappears from another system's file as outstanding. KoppelHet therefore keeps leavers in the file with their end date from Sympa, so the Person in One Identity Manager is handled through the exit date.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can we not use Sympa's Data Change Export?
It only contains changes and is meant for manual work. One Identity Manager needs the full state, which KoppelHet supplies.
Does pay data end up in the files?
No. The interface in Sympa only contains the fields for accounts and rights.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (part of OData v4) on a dedicated interface on api.sympahr.net with X-ApiKey or Basic (key and secret): $filter on modified, $top, $skip, $count, at for the valid state, and a target field on the manager. By default 100 requests per hour per interface; GET from the reporting database (up to 30 minutes delay).
- One Identity Manager reads two files in one system connection through the CSV connector (UTF-8, header row, delimiter, text qualifier, language for dates), with PersonnelNumber as key column and Department.FullPath as hierarchical sort order. Synchronisation step with Data import, without MarkAsOutstanding; read-only access to the files.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in One Identity | Notes |
|---|---|---|
Personeelsnummer (uniek veld van de interface) | Sleutelkolom PersonnelNumber | |
Roepnaam en achternaam | FirstName en LastName | |
Organisatie-eenheid (boomveld) | Department.FullPath | |
Entiteit | Kolom bedrijf | |
Leidinggevende (doelveld personeelsnummer) | Kolom leidinggevende | |
Begindatum dienstverband (at=vandaag) | EntryDate | |
Einddatum dienstverband | ExitDate | |
Werk-e-mail | Kolom werkadres |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension