Identity and access management
YouForce to Ping Identity integration: Visma Raet as the HR source for users and groups in PingOne
With an integration between Visma Raet YouForce and Ping Identity, every new employee from YouForce automatically gets a user in PingOne, in the right population and with department, job and manager. Departments become groups in PingOne, and after the end date of the last employment the user can no longer sign in.
What the integration does
Organisations that record HR and payroll in YouForce and use PingOne for single sign-on and MFA often put employees into PingOne with a periodic CSV import. A department change then only reaches the groups later, and the import removes nobody who leaves.
- The organisation grants KoppelHet read access to YouForce through Visma, and in PingOne its own application with admin rights on identity data.
- In PingOne the administrator creates custom attributes for department, job, manager and employee number.
- KoppelHet fetches the changed persons and employments and creates or updates the PingOne user in the population of their employer.
- Each department becomes a group in PingOne, and the employee becomes a member of their department's group.
- After the end date of the last employment KoppelHet disables the user, so they can no longer sign in.
What to watch for with Visma Raet YouForce and Ping Identity
- The username in PingOne is required and cannot change after creation. KoppelHet therefore does not build it from the surname, which can change on marriage, but from a fixed rule you choose, for example the person number or the work email without the domain.
- Each user belongs to exactly one population in PingOne. An organisation with several employers in YouForce gets one population per employer, and a move to another employer moves the user instead of creating a second user.
- PingOne's standard profile has no field for department or manager. KoppelHet writes them to custom attributes in the PingOne schema, so policies and applications can act on them. The whole profile may not exceed 16 kB, so we only include fields an application uses.
- PingOne's SCIM entry point has no groups and returns a list of at most 200 users without a next page. KoppelHet therefore manages groups and memberships through the regular PingOne API and keeps its own record of which users come from YouForce.
- YouForce's basic data does not include the work email; it falls under the same separate permission as private data such as the BSN. If the email address is created in Microsoft 365, KoppelHet does not request that permission and takes the address from the naming rule.
- YouForce shows planned changes to department, job and hours before they take effect. KoppelHet moves the user into the new group on the effective date, so someone transferring on the first of the month does not reach their new team's applications a month too early or too late.
- In PingOne disabling means the user can no longer authenticate; the user and their data remain. KoppelHet disables after the last working day and only deletes after the retention period you choose.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can PingOne then create accounts in applications?
Yes, with PingOne's outbound provisioning. KoppelHet delivers the HR data; PingOne passes it on to the applications.
What happens to PingOne users who do not come from YouForce?
The integration leaves them alone, such as contractors and service users in their own population.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API (OAuth 2.0 through Visma Connect) with the Youforce-IAM:Get_Basic scope for Persons, Employments, Employment Planned Changes, Organization Units, Role Assignments and Job Profiles, on latestSync with the from parameter and paging through take, skip and nextLink. The work email needs Youforce-IAM:GetPrivateContactDetails.
- PingOne is written with a Worker app with the Identity Data Admin role: users through the SCIM API (/v2/Users or /v2/DirectMappedUsers for custom attributes, with urn:pingidentity:schemas:extension:2.0:PingOneUser for population.id), groups and memberships through the PingOne Platform API (POST /v1/environments/{envID}/groups) and disabling through the user's enabled setting. Custom attributes live in the user schema; a profile is at most 16 kB.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in Ping Identity | Notes |
|---|---|---|
Persoonsnummer | externalId en eigen attribuut personeelsnummer | Fixed key |
Naamgevingsregel | username | Cannot be changed after creation |
Roepnaam en achternaam volgens gebruik | name.given en name.family | |
Zakelijk e-mailadres | email | Needs a separate scope in YouForce |
Functie (job profile) | title | |
Organisatie-eenheid | Eigen attribuut afdeling en groep | |
Rolverdeling op de organisatie-eenheid | Eigen attribuut leidinggevende | |
Werkgever | population.id | |
Einddatum laatste dienstverband | enabled |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce