Identity and access management
Unit4 HR to Ping Identity integration: PingOne users from Unit4 ERPx
With an integration between Unit4 HR and Ping Identity, every approved employee from Unit4 ERPx becomes a PingOne user in their company's population, with a group for their organisational unit. A transfer takes effect in PingOne on the date Unit4 records, and after termination KoppelHet disables the user.
What the integration does
Organisations that keep HR in Unit4 ERPx and use PingOne for sign-in now put new colleagues into PingOne with a CSV import or by hand. Someone who moves to another company or department within the tenant often keeps the groups of their old place in PingOne.
- Unit4 Identity Services gets a machine client for KoppelHet, and PingOne a Worker app with the Identity Data Admin role.
- KoppelHet fetches the changed employees, merges duplicates and waits for completed workflows.
- A new employee becomes a PingOne user in the population of the company of their main employment.
- On the effective date of a new relation KoppelHet puts the user in the new unit's group and removes them from the old one.
- After termination KoppelHet sets enabled to false and deletes the user after the agreed period.
What to watch for with Unit4 HR and Ping Identity
- For HR sources Ping has a ready-made inbound provisioner for Workday, not for Unit4. For importing identities Ping points to the SCIM Users API; KoppelHet writes the Unit4 employees into PingOne along that route.
- A Unit4 tenant can have several companies, and in PingOne a user belongs to exactly one population. KoppelHet gives each company a population and chooses it by the company of the main employment, so password policy and sign-in rules can differ per company.
- Groups cannot go through PingOne's SCIM entry point. KoppelHet manages a group per Unit4 unit through the Platform API, and gives a second employment an extra group, so someone with two jobs gets the applications of both.
- Unit4 recommends fetching changes from the start of the previous round, so nothing is missed but some employees return twice. A list from PingOne SCIM stops at 200 users without a next page. KoppelHet merges the duplicates and looks up each user specifically by the external key.
- Organisational unit and cost centre are stored in Unit4 as relations with a date from and to. KoppelHet only switches the group in PingOne on the date the new relation takes effect, so the new department's applications are not already open while someone still works in their old place.
- Unit4 provides a preferred name next to the official first name. KoppelHet puts the preferred name as first name in PingOne when present, so the sign-in screen and applications behind PingOne address someone the way colleagues do.
- In Unit4 a machine client only comes through a user with the SUPER or SYSTEM role, and a tenant has at most ten. On the PingOne side KoppelHet works with its own Worker app. Each side thus has its own key you can revoke separately, and the integration uses only one of the ten Unit4 clients.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does PingOne have a provisioner for Unit4?
Not that we have found; Ping's ready-made HR provisioner is for Workday. KoppelHet uses PingOne's SCIM and Platform API.
Does financial data from Unit4 go to PingOne?
No. Only name, company, unit, work email and the status of the employment.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx through the employees API and the ObjectAPI with OAuth 2.0 client credentials via Unit4 Identity Services (scope u4erp, token 3600 seconds, M2M user with SUPER or SYSTEM role, at most ten per tenant). Incremental on lastUpdated from the start of the previous round; fields include companyId, personId, status, nameInformation (firstName, surname, aliasName), employments and relatedValues with dateFrom and dateTo; 202 for workflow; DELETE sets Terminate.
- PingOne through a Worker app with the Identity Data Admin role: users through the SCIM API (population per company, externalId, userName required, a single email value, active mapped to enabled; lists at most 200 without paging; /v2/Groups returns 501), groups and memberships through the PingOne Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in Ping Identity | Notes |
|---|---|---|
companyId + personId | externalId | |
Naamgevingsregel | username | |
aliasName of firstName | name.given | |
surname | name.family | |
Naamgevingsregel met domein per bedrijf | email | |
Bedrijf van het hoofddienstverband | population.id | |
Organisatie-eenheid (relatie op datum) | Groep (Platform API) | |
Overige dienstverbanden | Extra groepen (Platform API) | |
Status Terminate of einddatum | enabled = false |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position