This site requires JavaScript to be enabled
Customer Service > General > BambooHR Directory Integration
BambooHR Directory Integration
Article: KB0010024 Published: 05/25/2023 Last modified: 05/25/2023

This article describes how to import users from BambooHR to OneLogin using the BambooHR directory connector, essentially treating BambooHR as your user directory of record.

Prerequisites:
  • A permanent access token for the BambooHR API. To learn more about how to generate a permanent access token, see BambooHR API authentication documentation.


    Note:     The BambooHR administrator account used to generate the permanent access token should have permission to view only the users and user attributes you want to import to OneLogin.

  1. Sign in to the OneLogin admin portal and go to Users > Directories. If you have previously configured a directory, click New from your directories list. Otherwise, you're taken directly to the Select a Directory Type page. Choose BambooHR from the list of available directory types.
  2. Name your directory. OneLogin supports the simultaneous integration of multiple directories as long as they each have a unique name. You'll use these names often, so choose something simple and descriptive.
  3. Select which directory you want to Authenticate users in. You can select OneLogin to manage user authentication (in which case you manage and store encrypted passwords in OneLogin), or you can select any third-party directory (Active Directory, for example) that you have integrated with OneLogin to store passwords and manage authentication. If you select another integrated directory, you must configure OneLogin to export new users to that directory. For more information, see the OneLogin documentation for your directory integration.
  4. Click Save to enable additional configuration fields and tabs.
  5. Check that Importing Users is enabled. (Enabled by default).
  6. (Optional) Under Disabled Users, you can choose how users who are terminated in BambooHR are handled in OneLogin.
    • Sync user status: Select to sync any user status changes made in BambooHR to OneLogin.
    • Do not create terminated users: Select to prevent terminated BambooHR users from being imported to OneLogin when you initially set up the integration.

      Note: This option is not supported if custom strings for various termination statuses are being used. When you use custom strings for various termination statuses, instead of using the Do not create terminated users option, instead create a mapping that recognizes these values (when imported to a custom attribute) and then unlicenses the user.

  7. API Settings: Enter the API settings required to connect to BambooHR. The Subdomain is the yourcompany part of https://yourcompany.bamboohr.com. Click Authorize. You will be redirected to the BambooHR website, where you'll be asked for your BambooHR credentials.

    Note: If you are not prompted to enter your credentials, navigate to yourcompany.bamboohr.com, log out of BambooHR, then return to OneLogin and retry this step.

    If your BambooHR directory is already authenticated in OneLogin, you will see Clear API Token instead of Authorize. To authorize a new account, click Clear API Token and complete the API Settings as described above.

  8. Choose how OneLogin should handle users that have been deleted in BambooHR under Deleted Users

    Note: Admin users aren't created in OneLogin if they are marked as terminated in BambooHR.

  9. Real-time updates can push user changes in BambooHR to OneLogin at regular intervals. If this feature is enabled for your BambooHR account, you can use the URL in this section in your BambooHR webhooks setup.
  10. Click Save to connect to the API. Waite a few seconds for authentication to finish.
  11. Click the Directory Attributes tab and map the BambooHR fields that you want to import to OneLogin.

    Note: OneLogin’s built-in manager field is tied directly to OneLogin directory or Active Directory, so BambooHR’s manager field can’t map directly to it. Instead, map the manager username or email to a custom field, then map the custom field to OneLogin’s manager field.

    Note: BambooHR requires that you map firstName, lastName, and either email or username, or a red error is displayed at the top of the screen.

    Note: The selections employmentStatus and jobInfo in the dropdown list, and sub-selections like jobInfo_actual.jobTitle (for example), reflect the user's current status. The previous values for these two selections are not exported into OneLogin.

    BambooHR Teams and Groups: OneLogin imports a user's BambooHR team and group memberships as semicolon-delimited lists. If you create a custom field in OneLogin for BambooHR teams and a custom field for BambooHR groups and map the BambooHR fields to those custom fields on this tab, you can then use BambooHR team and group membership to create mappings that assign OneLogin attributes, like Roles. You can also use rules to provision app attributes based on BambooHR team or group membership; for apps that support Group creation, you can even use rules to create a Group in an app (like Google G Suite, for example) based on a user's BambooHR team or group membership.For more information, see Mappings and Rules.

  12. Click Save.
  13. Click More Actions > Synchronize Users (Force) to initiate the user import. The directory connector also synchronizes users automatically every six hours.

Refresh Schema pulls any available fields from BambooHR and propagates them to OneLogin. If any fields were changed in BambooHR, use Refresh Schema to export them to OneLogin.

Note: If you complete the steps above and only one user (yourself) is synced verify that you have the correct permissions.

Expand/Collapse Comments
:     
Was this helpful?
YesYesNoNo