• HelloID-Conn-Prov-Target-Ecare-PUUR
  • Table of contents
  • Introduction
  • Getting started
    • Provisioning PowerShell V2 connector
      • Field mapping
      • Correlation configuration
    • Connection settings
    • Remarks
      • Employee account required
      • Concurrent actions
      • Additional mapping
      • Correlation by externalId
      • Limited error handling
        • Error handling function
      • Roles can only be revoked
      • Static permissions
      • Email address and userName have some requirements that are unknown.
      • Unique fields
      • employeeNumber and id can be the same.
  • Setup the connector
  • HelloID docs

HelloID-Conn-Prov-Target-Ecare-PUUR is a target connector. Ecare PUUR provides a set of REST API's that allow you to programmatically interact with its data. The HelloID connector uses the API endpoints listed in the table below.

The API specification can be found on: https://service-scim-o.ecare.nu/swagger

The following lifecycle actions are available:

The field mapping can be imported by using the fieldMapping.json file. See the description of each field in this file (or in the HelloID Fields tab after import).

The correlation configuration is used to specify which properties will be used to match an existing account within Ecare PUUR to a person in HelloID.

To properly setup the correlation:

1. Make sure the Field mapping is configured first.

2. Open the Correlation tab.

3. Specify the following configuration:

   Setting	Value
   Enable correlation	True
   Person correlation field	ExternalId (field from Fields tab)
   Account correlation field	employeeNumber (field from Fields tab)

The following settings are required to connect to the API.

Note that an employee account is required before a user account can be created. If the employee doesn't exist, a 500 internal server error will be returned. The employee account is not managed by HelloID. Employee accounts are created by an external synchronization.

Make sure you set the number of concurrent actions (configuration tab) on 1. The external Api does at the moment not support simultaneous actions on the same user.

For some user properties as defined in the Field mapping, there is some additional mapping required and performed in the PowerShell scripts itself to create the actual the SCIM message.

At the moment, correlation is done by means of the externalId. The id that will be returned if an account is retrieved or created will be used as the account reference by HelloId.

The API returns limited error information when an error occurs, often resulting in an error 400 or 500 without additional information. For instance; creating an account with a username which already is used, will result in an error 500. A request lacking mandatory properties will result in an error 400.

Because error handling is limited within the API, the Resolve-EcareError function is still our basic / un-modified implementation.

The permission scripts are used to grant or revoke roles (i.e group memberships) to a user. Roles can only be revoked, when at least once a role has been granted by means of the API for the particular user.

The list of possible roles (groups) is provided by the permissions.ps1 script, which currently contains a statically defined list within the script. Any roles not recognized by this list will be ignored by the API when attempting to grant or revoke roles.

During testing, we encountered situations where the email address and username provided during the account creation process were not accepted, resulting in a '500 Internal Server Error'. This suggests there may be hidden requirements or constraints that we are unaware of.

The fields: userName, WorkEmail, employeeNumber and ExternalId are required to be unique.

How to setup the connector in HelloID. Are special settings required. Like the primary manager settings for a source connector.

The official HelloID documentation can be found at: https://docs.helloid.com/