Identity and access management
Sympa to Ping Identity integration: PingOne users per Sympa entity
With an integration between Sympa and Ping Identity, every employee from Sympa gets a user in PingOne, in the population of their legal entity and with job title, organisational unit and manager. On the end date of the employment in Sympa, KoppelHet disables sign-in in PingOne.
What the integration does
Organisations that use Sympa for HR and PingOne as their identity provider enter new colleagues in PingOne by hand, and a departure only arrives when HR remembers to pass it on.
- The Sympa administrator creates an interface for KoppelHet with only name, work email, job title, unit, entity, manager and the employment dates.
- PingOne gets a Worker app with the Identity Data Admin role, and a population per Sympa entity.
- Every hour KoppelHet reads the changed employees and creates new colleagues with sign-in disabled until the start date.
- Organisational units become groups in PingOne; a transfer changes the membership on the effective date.
- After the end date of the employment KoppelHet disables sign-in and records that in the log.
What to watch for with Sympa and Ping Identity
- A Sympa environment can contain several legal entities, and PingOne places every user in exactly one population. KoppelHet links each entity to its own population. When an employee moves to another entity, the same PingOne user moves to the new population instead of a second user being created.
- Sympa allows one hundred requests per hour per interface by default. The PingOne SCIM entry point returns lists of at most two hundred users without a next page. KoppelHet only asks Sympa for changes since the previous run and keeps its own record of which PingOne user belongs to which employee number, instead of reading both sides in full every run.
- Read requests to Sympa are served from a reporting database that can lag up to half an hour. KoppelHet never disables sign-in in PingOne because someone is missing from a read run; only an end date that Sympa returns leads to disabling.
- The standard PingOne profile has no department or manager. KoppelHet records those as custom attributes in the PingOne schema. KoppelHet requests the manager in Sympa through a target field with their email address, so the attribute points to an existing PingOne user.
- The PingOne SCIM entry point does not manage groups. Organisational units in Sympa form a tree under the entity. KoppelHet uses the PingOne Platform API to create a group per unit and also puts the employee in the groups of the parent units, so an app for a whole division needs one assignment.
- Transfers are often in Sympa weeks ahead with a validity date. KoppelHet uses the at parameter to request today's state, so the groups in PingOne only change on the effective date.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the integration see salaries in Sympa?
No. The interface for KoppelHet only contains the fields PingOne needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sympa Integration API (OData v4) on a dedicated interface with X-ApiKey: $filter on modified, $top and $skip, at= for the valid state, target field on the manager. By default 100 requests per hour per interface; GET reads from the reporting database (delay up to 30 minutes).
- PingOne with a Worker app (Identity Data Admin): users through the SCIM API (/v2/DirectMappedUsers, population.id as UUID, unique username, one email value, lists of at most 200 without paging), custom attributes in the user schema, groups and members through the Platform API, sign-in disabled through enabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in Ping Identity | Notes |
|---|---|---|
Personeelsnummer | externalId | Key between Sympa and PingOne |
Roepnaam of voornaam | name.given | |
Achternaam | name.family | |
Werk-e-mail of naamgevingsregel | username en email | |
Functie | title | |
Organisatie-eenheid | Groep per eenheid en eigen attribuut afdeling | |
Entiteit | population.id | |
Leidinggevende (e-mail via doelveld) | Eigen attribuut leidinggevende | |
Begin- en einddatum dienstverband | enabled |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension