Identity and access management
YouForce to OneLogin integration: OneLogin users from Visma YouForce
With an integration between Visma YouForce and OneLogin, every employee from YouForce gets a OneLogin user with department, job title and manager, on which OneLogin's mappings assign roles and apps. Only when the last employment in YouForce has ended does KoppelHet set the user to suspended.
What the integration does
Organisations that use YouForce for HR and payroll and OneLogin for single sign-on often manage the users in OneLogin separately from HR. The service desk creates accounts from a form, and because YouForce does not store the manager on the employee, it is usually empty in OneLogin.
- In Visma Connect KoppelHet gets an application with only the read scope for basic data of the Youforce IAM API.
- In OneLogin we create an API credential to manage users and a custom attribute for the person number.
- KoppelHet fetches persons, employments and role assignments and determines department, job title and manager per person.
- New employees become OneLogin users; changes go to the same user, found through the person number.
- After the end date of the last employment KoppelHet sets the status to suspended.
What to watch for with Visma Raet YouForce and OneLogin
- YouForce stores the manager as a role on the department, and OneLogin wants a OneLogin user id for the manager. KoppelHet derives the manager per employee from the role assignment and then looks up that person's OneLogin user through the person number.
- A manager who works in their own department would become their own manager according to the role assignment. In that case KoppelHet takes the manager of the parent department, so approvals in apps behind OneLogin do not end up with the requester.
- Someone with several employments appears in YouForce with several departments, while OneLogin has one department and one job title per user. KoppelHet uses the main employment for the mappings and only suspends once the last employment is over.
- YouForce no longer returns leavers whose end date falls outside the historicalDays. KoppelHet remembers which OneLogin users came from YouForce and keeps treating them as suspended in the nightly comparison, even when YouForce no longer mentions them.
- Both sides have a limit. YouForce allows 30,000 calls per day per domain and tenant, OneLogin 5,000 per hour per account. KoppelHet only requests changes since the previous round in YouForce and only writes OneLogin users where something actually changed.
- The person number has no standard field in OneLogin and therefore goes into a custom attribute. KoppelHet uses it to find a returning employee, so they get their old user and roles back instead of a new user with a sequence number.
- With a separate write scope the identity from OneLogin can go back to the YouForce account, so employees work in YouForce with the same login. That is not part of the basic set-up and can follow later as an extension.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does OneLogin get to see BSN or home address?
No. KoppelHet does not request the scope for private data.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce through the Youforce IAM API (api.youforce.com/IAM), token from Visma Connect with client_credentials and scope Youforce-IAM:Get_Basic: GET /v1.0/persons, /v1.0/employments and role assignments with from/to on latestSync, take up to 1000 and nextLink; historicalDays per subscription. Limits 60 per second, 2,500 per minute and 30,000 per day. Writing back the identity with Youforce-IAM:Update_Identity (PATCH /v1.0/users(employeeId=…)/identity).
- OneLogin API v2 (API credential with Manage Users): POST /api/2/users and PUT /api/2/users/{id} with title, department, manager_user_id, status and custom_attributes; lookup with custom_attributes.{name}. Limit 5,000 calls per hour per account (X-RateLimit-Remaining).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in OneLogin | Notes |
|---|---|---|
Persoonsnummer | custom_attributes.employeenumber | Custom attribute in OneLogin |
Naamgevingsregel | username | |
Zakelijk e-mailadres | email | |
Roepnaam, voorvoegsel en achternaam | firstname en lastname | |
Functie van het hoofddienstverband | title | |
Afdeling van het hoofddienstverband | department | |
Leidinggevende-rol op de afdeling | manager_user_id | |
Einddatum laatste dienstverband | status 2 (Suspended) |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce