Connect to SAP Fieldglass

This article provides a step-by-step walkthrough for connecting EmpowerID to SAP Fieldglass, enabling seamless integration and management of your external workforce. By establishing this connection, you can efficiently synchronize worker data between the two systems, streamline access management, and maintain compliance with organizational policies.

Prerequisites

To create an account store with the SAP Fieldglass Connector, the following parameters must be provided:

• ServiceUrl: The base URL of the SAP Fieldglass API.

• ApiKey: The API key used for authenticating requests to the SAP FieldGlass system.

• serviceUserName: The username for the service account to connect to SAP FieldGlass system.

• servicePassword: The password for the service account to connect to SAP FieldGlass system.

• baseUrl: The base URL of the Microservice.

• clientID: The client ID for OAuth authentication of the Microservice.

• clientSecret: The client secret for OAuth authentication of the Microservice.

• accessTokenUrl: The URL to obtain the access token for OAuth authentication of the Microservice.

Procedure

Step 1 – Register a service principal application in Entra ID

1. Log in to your Azure portal as a user with the necessary permissions to create an application in Entra ID.

2. In Azure, navigate to your Microsoft Entra ID.

3. Navigate to Manage > App registrations and click New registration.
   

   

    

4. Name the application, select the scope for the application (single or multitenant), and click Register.

5. Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used when configuring the SCIM app service.
   

   

Step 2 – Create an app service to host the SuccessFactors SCIM microservice

1. Log in to your Azure portal as a user with the necessary permissions to create an App Service.

2. In Azure, navigate to All Services > App Services and create a new App service.

3. Under Project Details, select a Subscription and then create a Resource Group for the App Service.

4. Under Instance Details, do the following:

   • Name – Enter a name.

   • Publish – Select Code.

   • Runtime Stack – Select .Net Core 8.

   • Operating System – Select Linux.

   • Region – Select the appropriate region.

5. Click Review + Create.

6. Click Create.

7. After the deployment of the app service completes, click Go to resource.

8. Change the platform for the app service to 64 Bit by doing the following:

   1. On the app service navbar, under Settings, click Configuration.

   2. On the Configuration blade, select the General settings tab.

   3. Under Platform settings, change the Platform to 64 Bit and click Save.

   4. Click Continue to confirm you want to save the changes.

9. Copy and save the URL on the app service's overview page. You will need it when configuring Entra ID Auth for the app service.

Step 3 – Configure authentication for the app service

1. Navigate to Settings > Authentication and click Add identity provider.
   

   

2. Select Microsoft.
   

   

3. Add the following identity provider information:

   1. Choose a tenant for your application and its users – Select Workforce configuration (current tenant)

   2. App registration type – Select Pick an existing app registration in this directory.

   3. Name or app ID – Select the service principal application you created to provide Entra ID authentication for the microservice.

   4. Issuer URL – Replace the default value with https://login.microsoftonline.com/<Your Tenant ID>

   5. Client application requirement – Select Allow requests only from this application itself

   6. Identity Requirement – Select Allow requests from any identity

   7. Tenant requirement – Select Allow requests from specific tenants

      • Allowed tenants – Ensure the Tenant ID matches the specific tenant

   8. Restrict access – Select Require authentication.

   9. Unauthenticated requests – Select HTTP 401 Unauthorized: recommended for APIs.

   10. Token Store – Leave selected.

   11. Click Add.
       

       

4. After adding the Identity provider, click the Edit link.
   

   

5. Set the Issuer URL to https://login.microsoftonline.com/<Your Tenant ID>.

6. Under Allowed token audiences, enter the URL for the app service.

7. Click Save.
   

   

8. Go to the App Service Overview page and click Download publish profile. You will need this file when you publish the Fieldglass microservice to Azure.
   

   

Step 4 – Publish the Fieldglass Microservice to Azure

1. Copy the below PowerShell script into the text editor of your choice and save it as zipdeploy_appService.ps1.

   param(
       $pubProfileFilePath
       ,$zipFilePath
   )
   $ErrorActionPreference = "Stop"
   $pubProfile = [xml](gc $pubProfileFilePath)
   $zipPubProfile = $pubProfile.publishData.publishProfile | where { $_.publishMethod -eq "zipdeploy" }
   $userAgent = "powershell/1.0"
   $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $zipPubProfile.userName, $zipPubProfile.userPWD)))
   $zipdeployUrl = "https://$($zipPubProfile.publishUrl)/api/zipdeploy"
   $deploymentsUrl = "https://$($zipPubProfile.publishUrl)/api/deployments"
   Invoke-RestMethod -Uri $zipdeployUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Post -InFile $zipFilePath
   Invoke-RestMethod -Uri $deploymentsUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Get

    

2. Open an administrative PowerShell session.

3. Navigate to the directory where you saved the script and execute the script, passing in the values of the pubProfilePath and zipFilePath parameters via the command line, where the value of pubProfilePath is the path to the Fieldglass App Service Publisher Profile Settings file you downloaded from Azure, and the value of zipFilePath is the path to the microservice ZIP file you received from EmpowerID.

   The command to execute the script should look similar to that shown in the below image.
   

   

    

Step 5 – Create an account store for SAP Fieldglass

1. On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.

2. Select the Actions tab and then click Create Account Store.
   

   

    

3. Under System Types, search for SAPFieldGlass.

4. Click the record for SAPFieldGlassConnector to select the type and then click Submit.

    

   

   
   This opens the connection details form for the account store.
   

   

5. Enter the following information in the form:

   • Name: Unique name for the account store

   • ServiceUrl: The base URL of the SAP Fieldglass API.

   • Api Key: The API key used for authenticating requests to the SAP FieldGlass system.

   • Service UserName: The username for the service account to connect to SAP FieldGlass system.

   • Service Password: The password for the service account to connect to SAP FieldGlass system.

   • Base URL: The base URL of the Microservice.

   • Client ID: The client ID for OAuth authentication of the Microservice.

   • Client Secret: The client secret for OAuth authentication of the Microservice.

   • Access Token URL: The URL to obtain the access token for OAuth authentication of the Microservice.

6. When ready, click Submit to create the account store.

Step 6 – Configure Attribute Flow

1. Return to the Find Account Stores page and search for the account store you just created.

2. Click the Account Store link for the account store to navigate to the details page.
   

   

3. On the Account Store Details page, select the Attribute Flow Rules tab.
   

   

4. Review the attribute flow and revise as needed.

5. To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

Step 7 – Configure the Fieldglass account store

1. Click the Edit link on the Account Store Details page for the Fieldglass account store to put the account store in Edit mode.
   

   

2. Edit the settings shown below as needed and save your changes.

Step 8 – Enable Inventory on the account store

1. On the Account Store Settings page, select the Inventory tab.

2. Change the Inventory Schedule Interval as needed. By default, EmpowerID inventories account stores once every 10 minutes.

3. Toggle Inventory Enabled.

4. Click Save to save your changes to the account store.

Now that inventory is enabled for the account store, the next step is to turn on the Account Inbox permanent workflow. This workflow is responsible for fetching and processing new user accounts.

Step 9 – Enable the Account Inbox Permanent Workflow

1. On the navbar, expand Infrastructure Admin > EmpowerID Server and Settings and select Permanent Workflows.

2. On the Permanent Workflows page, click the Display Name link for Account Inbox.
   

   

   
   

3. On the Permanent Workflow Details page that appears, click the pencil icon to put the workflow in edit mode.
   

   

4. Check Enabled.
   

   

   
   

5. Click Save to save your changes.