OIIdentity and access management
Unit4 HR to One Identity integration: identities from Unit4 ERPx in One Identity Manager
With an integration between Unit4 HR and One Identity Manager, employees, companies and organisational units from Unit4 ERPx are ready in fixed files that One Identity Manager's CSV connector reads. The main employment determines department and job title, and after termination in Unit4 One Identity Manager gets an exit date on which it locks the accounts.
What the integration does
Organisations with Unit4 ERPx for HR and One Identity Manager for accounts and rights often load Unit4 through a manual export. Departments then lag behind, a transfer arrives too early, and a terminated employee stays active in One Identity until someone runs the file again.
- KoppelHet gets a machine client in Unit4 Identity Services; One Identity Manager gets a system connection with the CSV connector on the folder with files.
- KoppelHet fetches the changed employees and keeps a full state, with all employments and relations.
- Before every synchronisation KoppelHet writes the department file and the employee file with the values that apply that day.
- One Identity Manager first reads the departments, parents first, and then the employees.
- On the exit date One Identity Manager locks the identity and its accounts according to its own policy.
What to watch for with Unit4 HR and One Identity
- One Identity Manager has templates for cloud HR systems such as SuccessFactors, Workday and Dayforce, but not for Unit4. KoppelHet therefore delivers Unit4 through the CSV connector, which One Identity itself names for import from another system.
- A personId in Unit4 is only unique within one company, and a tenant can have several companies. The CSV connector allows several key columns. KoppelHet delivers company and person number as two columns, so One Identity Manager only treats a record as the same person when both match.
- An employee can have several employments at once in Unit4. KoppelHet puts the main employment in the regular columns and the job titles of the other employments in a multi-value column, which the CSV connector reads with its own delimiter. That way the administrator can also grant rights for a second job.
- Relations such as organisational unit and cost centre have a date from and to in Unit4. KoppelHet only writes the relation valid on that day into each file, so One Identity Manager only grants rights of a new department on the day of the transfer.
- On an import from a secondary system, One Identity Manager does not mark a missing record as outstanding. A terminated employee gets the status Terminate in Unit4; KoppelHet keeps them in the file with that date as exit date, instead of dropping the record.
- Besides the official first name, Unit4 has a preferred name. KoppelHet puts the preferred name in the first-name field when present, so One Identity Manager builds account names and display names on the name colleagues know someone by.
- A new employee can wait for approval in a workflow in Unit4. KoppelHet only writes them into the file once the workflow is complete, so One Identity Manager does not create a central account for an entry HR still reverses.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does One Identity Manager need to reach our Unit4 environment?
No. Only KoppelHet talks to Unit4; One Identity Manager reads the files.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx through the employees API and the ObjectAPI with OAuth 2.0 client credentials via Unit4 Identity Services (scope u4erp, M2M user with SUPER or SYSTEM role). Fields include companyId, personId, status, nameInformation (firstName, surname, aliasName), employments and relatedValues with dateFrom and dateTo; 202 for an entry in workflow; DELETE sets status Terminate.
- One Identity Manager through the CSV connector: two files in one system connection (departments and employees), fixed header line, two key columns, an MVP column with its own delimiter, Hierarchical sort order on the department path, Read-only access and Data import in the synchronisation step (no MarkAsOutstanding).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in One Identity | Notes |
|---|---|---|
companyId | Sleutelkolom 1 | |
personId | Sleutelkolom 2 | |
aliasName of firstName | FirstName | Preferred name where present |
surname | LastName | |
Bedrijf en organisatie-eenheid (relatie op datum) | Afdelingspad | |
Kostenplaats (relatie op datum) | Kostenplaats | |
Functie van het hoofddienstverband | Functie | |
Functies van overige dienstverbanden | MVP-kolom | |
Startdatum eerste dienstverband | EntryDate | |
Einddatum laatste dienstverband of status Terminate | ExitDate |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position