--- title: One Identity Manager Integration | Physical Access Governance | Key2XS description: What One Identity Manager is, and how Key2XS turns its roles and attestations into key rights on iLOQ, ASSA ABLOY CLIQ and ABLOY PULSE, audit-ready for NIS2 and CER. image: https://key2xs.com/hubfs/img/og-image.png --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=en) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) [CER Directive](https://key2xs.com/cer-directive?hsLang=en) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) Industries [Government](https://key2xs.com/sectors/government?hsLang=en) [Utilities](https://key2xs.com/sectors/utilities?hsLang=en) [Water management](https://key2xs.com/sectors/water-management?hsLang=en) [Transport](https://key2xs.com/sectors/transport?hsLang=en) [Telecom](https://key2xs.com/sectors/telecom?hsLang=en) Platform [Product](https://key2xs.com/products?hsLang=en) [How it works](https://key2xs.com/?hsLang=en#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=en) [One Identity](https://key2xs.com/partners/one-identity?hsLang=en) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=en) [Okta](https://key2xs.com/partners/okta?hsLang=en) [OpenText](https://key2xs.com/partners/opentext?hsLang=en) [iLOQ](https://key2xs.com/partners/iloq?hsLang=en) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=en) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=en) Resources [Resource center](https://key2xs.com/resources?hsLang=en) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) [Events](https://key2xs.com/events?hsLang=en) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=en) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=en) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) [FAQ](https://key2xs.com/?hsLang=en#faq) [News](https://key2xs.com/news-archive?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Home](https://key2xs.com?hsLang=en) > Identity platforms # One Identity Manager and Key2XS: keys as a governed entitlement One Identity Manager is a full identity governance suite: business roles, request and approval workflows, attestation campaigns and separation of duties. Key2XS makes physical keys one more entitlement inside that model, governed on iLOQ, ASSA ABLOY CLIQ and ABLOY PULSE by the same roles and the same recertification. [Request a demo](https://key2xs.com/contact?hsLang=en) ## What One Identity Manager is One Identity Manager is the identity governance and administration platform of One Identity, a Quest Software business. It is the heavier end of the identity market: not just an authentication layer, but a system of record for who may have what, why they may have it, and who signed off. It is generally deployed by organizations that have to defend their access model to an auditor. The parts that matter for access decisions: - **Identities and business roles.** Entitlements are derived from what a person is, so a role change reshapes access without anyone filing a ticket. - **The IT Shop.** Self-service requests routed through the approval chain the policy demands, with the decision retained. - **Attestation and recertification.** Periodic campaigns in which owners confirm, or withdraw, the access they are accountable for. - **Separation of duties.** Rules that prevent toxic combinations of entitlements from coexisting on one identity. - **Target system synchronization.** Connectors that project the governed model outward onto directories, applications and infrastructure. - **REST API.** The programmable surface used to extend the model to systems without a native connector. The wider One Identity portfolio surrounds this with privileged access management (Safeguard), access management (OneLogin) and Active Directory administration (Active Roles). Physical keys have never been part of any of it. ## Mature governance, ungoverned keys Organizations running One Identity Manager tend to take governance seriously. Access is modeled in business roles, requests pass through approval workflows, and assignments are periodically attested. Auditors get answers from the system, not from memory. Physical keys usually live outside that model: issued at a service desk, tracked in a separate application or a spreadsheet, disconnected from the role model that governs everything else. - Key possession that no longer matches anyone's current role - Leavers processed perfectly in One Identity Manager while their keys stay active - Approval and attestation discipline for applications, but not for doors - Physical access evidence assembled manually every audit cycle For critical entities under [NIS2](https://key2xs.com/nis2-directive?hsLang=en) and the [CER Directive](https://key2xs.com/cer-directive?hsLang=en), physical access to premises is explicitly in scope. A governance model that ends at the login screen leaves exactly the gap those directives target. ## How Key2XS connects to One Identity Manager Key2XS ships a companion application for One Identity Manager that exchanges assignments over REST. Synchronization runs on a polling cycle you configure, sixty seconds by default, so a revocation reaches the keys within a minute rather than overnight. Nothing in your role model has to be rebuilt. ProtocolBidirectional REST API through a Key2XS companion app AuthenticationSHA-256 hashed API key DirectionBidirectional: entitlements in, provisioning status back SynchronizationPolling, configurable, 60 seconds by default ### Connect, map, orchestrate, prove 1. **Connect.** The Key2XS companion app connects to your One Identity Manager environment over REST, and Key2XS connects to each key system over its own API. A standard integration is live in under two hours, with no custom development. 2. **Map.** Business roles, application roles and entitlements are mapped to key rights and lock groups. A role like “Plant Engineer, Site South” can correspond to exactly the production halls, switch rooms and perimeter gates that role requires. 3. **Orchestrate.** When an assignment is created, changed or removed, whether directly or through the IT Shop and its approval chain, Key2XS applies the matching change to the person's key rights on the next polling cycle. Deprovisioning a leaver withdraws their physical access in the same movement. 4. **Prove.** Every key right traces back to an identity, a role and an approval decision, in one tamper-evident audit trail. Because key rights follow your roles, an attestation campaign that recertifies a role recertifies the physical access it grants. ### What moves between One Identity Manager and Key2XS | From One Identity Manager | To your key systems via Key2XS | | --- | --- | | Identities (joiners, movers, leavers) | Key holders created, updated or deactivated | | Business role and entitlement assignments | Key rights and access to lock groups | | Deprovisioning and expirations | Withdrawal of key rights on the next cycle | | IT Shop approval decisions | Documented authorization behind every key | ## One source of truth, every key system The point of connecting One Identity Manager to Key2XS is not a single lock brand. One Identity Manager becomes the one place where physical access is decided, and Key2XS carries that decision to whichever key systems your sites actually run. Most organizations have more than one: a digital locking system at the head office, electronic keys on the network, mechanical high-security cylinders on the perimeter. | Key system under governance | How Key2XS drives it | | --- | --- | | **iLOQ S5 and S50** Self-powered digital cylinders (S5) and Bluetooth/NFC phone keys (S50). | REST API. Key holders, key rights and key validity provisioned per person, with 29 independent sync operations. | | **ASSA ABLOY eCLIQ** Electronic cylinders, padlocks and programmable keys. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY PROTEC2 CLIQ** High-security locking combining rotating disc technology with electronic identification. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY CLIQ Remote** Remote key updates through wall programmers, desktop units or the CLIQ Connect Bluetooth app, so keys never have to come back to a desk. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Validity windows refreshed in the field. | | **ABLOY PULSE** Self-sustaining locks that harvest their energy from key insertion. No batteries, no wiring. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | Key2XS is **certified by ASSA ABLOY** for its locking system integrations. One mapping in One Identity Manager can therefore span brands: a single role or group grants the iLOQ cylinders in one building and the eCLIQ padlocks on a remote site, revoked together the moment One Identity Manager says so. The same holds on the identity side. Key2XS also connects to SailPoint Identity Security Cloud, Microsoft Entra ID, Okta and OpenText Identity Manager, and to any system that can speak SCIM 2.0, so a landscape with more than one identity platform still resolves to one physical access model. See the [integrations overview](https://key2xs.com/integrations?hsLang=en) for the full picture. ## Built for critical environments Key2XS is used where physical access affects public safety, service continuity or regulatory compliance: utilities, government, transport, healthcare and industry. - **NIS2 and CER ready.** A continuous, tamper-evident audit trail links every physical access right to an identity and a policy decision. - **Built for continuity.** The Key2XS platform is engineered for 99.99% availability, matching the uptime expectations of critical infrastructure operations. - **Security by design.** Traffic between Key2XS, One Identity Manager and every connected key system is encrypted in transit with TLS 1.3, and data at rest is protected with AES-256. - **Non-disruptive.** Key2XS orchestrates rights through each system's own management interface. Your One Identity Manager configuration stays as it is, and so do your locking plans, locks and keys. ## Why not extend One Identity Manager yourself? One Identity Manager is famously extensible, and building a custom connector toward a locking system is conceivable. It is also a multi-month project that must be maintained across upgrades on both sides, hardened for edge cases in the leaver flow, equipped with its own audit layer, and repeated for every key system brand on your sites. Key2XS delivers this as a maintained platform: - **Live in under 2 hours.** A standard One Identity Manager integration is up and running in under two hours, not weeks or months - Maintained connectors that absorb API changes on the identity side and on every key system - Purpose-built audit and reporting for physical access governance - Certified by ASSA ABLOY for its locking system integrations, and a certified SailPoint Technology Alliance Partner on the IAM side - One platform across identity platforms and key system brands, so your architecture is not locked to a single vendor pairing ## Frequently asked questions One Identity Manager and Key2XS, answered. What is One Identity Manager? One Identity Manager is an identity governance and administration platform from One Identity, a Quest Software business. It models access in business roles, routes requests through the IT Shop and its approval chains, enforces separation of duties, runs attestation campaigns, and provisions the resulting entitlements to connected target systems. Does Key2XS replace One Identity Manager? No. Key2XS is middleware. One Identity Manager remains your governance platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back. Which key systems can One Identity Manager govern through Key2XS? iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single business role can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations. Can key access follow our existing request and approval workflows? Yes. Key2XS acts on the assignments that exist in One Identity Manager. If a role or entitlement is granted through the IT Shop, the mapped key rights follow that assignment automatically, and the approval remains part of the documented trail. Can physical access be included in an attestation campaign? Yes, through the roles that carry it. Because key rights are derived from roles and entitlements in One Identity Manager, recertifying a role recertifies the physical access attached to it. How quickly does a revocation reach the keys? Synchronization runs on a configurable polling cycle, sixty seconds by default. A deprovisioning in One Identity Manager therefore reaches every connected key system within about a minute, not overnight. How long does implementation take? A standard integration is live in under two hours. Key2XS connects through a companion app and pre-built key system connectors, so no custom development is required. Is this suitable for NIS2 and CER compliance? Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects your One Identity Manager governance to physical keys. ## See One Identity Manager governing your keys Get a guided walkthrough of how roles, approvals and physical keys come together in one auditable flow. [Request a demo](https://key2xs.com/contact?hsLang=en) [See all integrations](https://key2xs.com/integrations?hsLang=en) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) - [Product](https://key2xs.com/products?hsLang=en) - [Integrations](https://key2xs.com/integrations?hsLang=en) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=en) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=en) - [Resource center](https://key2xs.com/resources?hsLang=en) - [Events](https://key2xs.com/events?hsLang=en) - [News](https://key2xs.com/news-archive?hsLang=en) - [Contact](https://key2xs.com/contact?hsLang=en) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=en) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=en) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "One Identity Manager is an identity governance and administration platform from One Identity, a Quest Software business. It models access in business roles, routes requests through the IT Shop and its approval chains, enforces separation of duties, runs attestation campaigns, and provisions the resulting entitlements to connected target systems." }, "name" : "What is One Identity Manager?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Key2XS is middleware. One Identity Manager remains your governance platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back." }, "name" : "Does Key2XS replace One Identity Manager?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single business role can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations." }, "name" : "Which key systems can One Identity Manager govern through Key2XS?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Key2XS acts on the assignments that exist in One Identity Manager. If a role or entitlement is granted through the IT Shop, the mapped key rights follow that assignment automatically, and the approval remains part of the documented trail." }, "name" : "Can key access follow our existing request and approval workflows?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, through the roles that carry it. Because key rights are derived from roles and entitlements in One Identity Manager, recertifying a role recertifies the physical access attached to it." }, "name" : "Can physical access be included in an attestation campaign?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Synchronization runs on a configurable polling cycle, sixty seconds by default. A deprovisioning in One Identity Manager therefore reaches every connected key system within about a minute, not overnight." }, "name" : "How quickly does a revocation reach the keys?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A standard integration is live in under two hours. Key2XS connects through a companion app and pre-built key system connectors, so no custom development is required." }, "name" : "How long does implementation take?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects your One Identity Manager governance to physical keys." }, "name" : "Is this suitable for NIS2 and CER compliance?" } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://key2xs.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://key2xs.com/integrations", "name" : "Integrations", "position" : 2 }, { "@type" : "ListItem", "name" : "One Identity Manager", "position" : 3 } ] } ```