Connect to SAP SuccessFactors

Connecting EmpowerID to your SAP SuccessFactors system allows you to automate your Joiner, Mover, and Leaver functions seamlessly. This article provides the information needed to connect EmpowerID to SAP SuccessFactors.

Prerequisites

To connect EmpowerID to SuccessFactors, Read permissions for the following SuccessFactors objects along wih their mentioned attributes are required:

Procedure

Step 1 – Generate a self-signed certificate in EmpowerID

1. Expand Apps and Authentication > SSO Connections on the EmpowerID Web interface's navbar and select SSO Components.

2. Select the Certificates tab and click the Add button in the grid header.
   
   

   Open

   

    

3. Select Generate Self-Signed Certificate.
   
   

   Open

   

    

4. Enter the following information:

   • Certificate Owner – Leave empty

   • Prefer Local Machine Store – Leave empty

   • Subject Name – Enter something suitable to the purpose of the certificate, such as CN=AzureCertificate

   • Requires Password – Select this option; this adds a private key to the certificate

   • Certificate Password – Enter a password for the certificate

5. Click Save to create the certificate.
   
   

Step 2 – Download the certificate in Base64 format

1. From the Certificate Details page, return to the SSO Components page by clicking the Find Certificates breadcrumb.

2. On the SSO Components page, select the Certificates tab and search for the certificate you just created.
   
   

    

3. Click the Name link for the certificate to navigate to the View page for the certificate.

4. On the View page for the certificate, click Export Certificate.
   
   

    

5. Select the desired location to save the certificate and click Save.

Step 3 – Register a service principal application in Entra ID

1. Log in to your Azure portal as a user with the necessary permissions to create an application in Entra ID.

2. In Azure, navigate to your Microsoft Entra ID.

3. Navigate to Manage > App registrations and click New registration.
   
   

    

4. Name the application, select the scope for the application (single or multitenant), and click Register.

5. Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used when configuring the SCIM app service.
   
   

    

6. Navigate to the Certificates & secrets blade for the application and click Upload certificate.
   
   

    

7. Select the base-64 encoded certificate you downloaded from EmpowerID and click Add.
   
   

Step 4 – Create an app service to host the SuccessFactors SCIM microservice

1. Log in to your Azure portal as a user with the necessary permissions to create an App Service.

2. In Azure, navigate to All Services > App Services and create a new App service.

3. Under Project Details, select a Subscription and then create a Resource Group for the App Service.

4. Under Instance Details, do the following:

   • Name – Enter a name.

   • Publish – Select Code.

   • Runtime Stack – Select .Net Core 8.

   • Operating System – Select Linux.

   • Region – Select the appropriate region.

5. Click Review + Create.

6. Click Create.

7. After the deployment of the app service completes, click Go to resource.

8. Change the platform for the app service to 64 Bit by doing the following:

   1. On the app service navbar, under Settings, click Configuration.

   2. On the Configuration blade, select the General settings tab.

   3. Under Platform settings, change the Platform to 64 Bit and click Save.

   4. Click Continue to confirm you want to save the changes.

9. Copy and save the URL on the app service's overview page. You will need it when configuring Entra ID Auth for the app service.
   
   

Step 5 – Configure authentication for the app service

1. Navigate to Settings > Authentication and click Add identity provider.
   
   

2. Select Microsoft.
   
   

3. Add the following identity provider information:

   1. Choose a tenant for your application and its users – Select Workforce configuration (current tenant)

   2. App registration type – Select Pick an existing app registration in this directory.

   3. Name or app ID – Select the service principal application you created to provide Entra ID authentication for the microservice.

   4. Issuer URL – Replace the default value with https://login.microsoftonline.com/<Your Tenant ID>

   5. Client application requirement – Select Allow requests only from this application itself

   6. Identity Requirement – Select Allow requests from any identity

   7. Tenant requirement – Select Allow requests from specific tenants

      • Allowed tenants – Ensure the Tenant ID matches the specific tenant

   8. Restrict access – Select Require authentication.

   9. Unauthenticated requests – Select HTTP 401 Unauthorized: recommended for APIs.

   10. Token Store – Leave selected.

   11. Click Add.
       
       

        

4. After adding the Identity provider, click the Edit link.
   
   

    

5. Set the Issuer URL to https://login.microsoftonline.com/<Your Tenant ID>.

6. Under Allowed token audiences, enter the URL for the app service.

7. Click Save.
   
   

8. Under Settings, select Identity.

9. Turn on system assigned managed identity and click Save.
   
   

10. Click Yes to confirm you want to enable system assigned managed identity and register the App Service with Azure Active Directory.
    
    

11. Go to the App Service Overview page and click Download publish profile. You will need this file when you publish the SuccessFactors microservice to Azure.
    
    

Step 6 – Publish the SuccessFactors Microservice to Azure

1. Copy the below PowerShell script into the text editor of your choice and save it as zipdeploy_appService.ps1.

   param( $pubProfileFilePath ,$zipFilePath ) $ErrorActionPreference = "Stop" $pubProfile = [xml](gc $pubProfileFilePath) $zipPubProfile = $pubProfile.publishData.publishProfile | where { $_.publishMethod -eq "zipdeploy" } $userAgent = "powershell/1.0" $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $zipPubProfile.userName, $zipPubProfile.userPWD))) $zipdeployUrl = "https://$($zipPubProfile.publishUrl)/api/zipdeploy" $deploymentsUrl = "https://$($zipPubProfile.publishUrl)/api/deployments" Invoke-RestMethod -Uri $zipdeployUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Post -InFile $zipFilePath Invoke-RestMethod -Uri $deploymentsUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Get

    

2. Open an administrative PowerShell session.

3. Navigate to the directory where you saved the script and execute the script, passing in the values of the pubProfilePath and zipFilePath parameters via the command line, where the value of pubProfilePath is the path to the SuccessFactors App Service Publisher Profile Settings file you downloaded from Azure, and the value of zipFilePath is the path to the microservice ZIP file you received from EmpowerID.

   The command to execute the script should look similar to that shown in the below image.

    

Step 7 – Create an account store for SuccessFactors

1. On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.

2. Select the Actions tab and then click Create Account Store.
   
   

    

3. Under System Types, search for Success Factor Scim.

4. Click the record for Success Factor Scim Connector to select the type and then click Submit.

    

   
   This opens the SuccessFactors SCIM form.
   
   

5. Enter the following information in the SuccessFactors SCIM form:

   • Account Store Name – Name of the account store

   • App Service Base URL – The URL to the app service hosting the SuccessFactors SCIM microservice

   • User Name – The username for the SuccessFactors API user

   • Password – The password for the SuccessFactors API user

   • Company ID – The Company ID for SuccessFactors, e.g. SFEDU0323232

   • Microservice Base URL – The URL for the SCIM Microservice deployed in the Azure tenant

   • Azure App ID – The Client ID / Application ID for SCIM Microservice deployed in the Azure Tenant

   • Azure Directory (Tenant ID) – The TenantID in which the SCIM Microservice is Deployed

   • Certificate Thumbprint – The thumbprint of the certificate used in Azure for authentication
     
     

6. When ready, click Submit to create the account store.

    

Step 8 – Verify resource system parameters

1. Return to the Find Account Stores page and search for the SuccessFactors account store you just created.

2. Click the Account Store link.

3. Select the Resource System tab and then expand the Configuration Parameters accordion at the bottom of the page.
   
   

4. Verify the following parameters have the correct value. These values were added to the form when the account store was created.

   • AzureAppID – The Client ID / Application ID for SCIM Microservice deployed in the Azure Tenant

   • AzureTenantID – The TenantID in which the SCIM Microservice is Deployed

   • certificateThumbprint – The thumbprint of the certificate used in Azure for authentication

   • ServiceUrl – The URL for the SCIM Microservice deployed in the Azure tenant

   • SFBaseURL – The base URL for calling SuccessFactor’s API

   • SFCompanyId – The Company ID for SuccessFactors

   • SFUsername – The username for the SuccessFactors API user

Step 9 – Configure Attribute Flow

1. On the Account Store Details page for the Workday account store, select the Attribute Flow Rules tab.

2. Review the attribute flow and revise as needed. EmpowerID translates the attributes in Workday to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in Workday flow to the EmpowerID Person, as well as any other user accounts owned by the Person.

3. To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

Step 10 – Create Dynamic Hierarchy policies to generate roles and location (Optional)

If desired, you can use Dynamic Hierarchy policies to generate external roles and locations based on specific user attributes, such as Job Title and Department. The external roles and locations can then be used to map corresponding EmpowerID logical locations. Please see Use Dynamic Hierarchy Policies to Create External Roles and Locations for information on setting this up. When completed, return to this article and complete steps 10 and 11.

Step 11 – Configure the SuccessFactors account store

1. Click the Edit link on the Account Store Details page for the SuccessFactors account store to put the account store in Edit mode.

2. Edit the settings shown below as needed and save your changes.

Step 12 – Enable Inventory on the account store

1. On the Account Store Settings page, select the Inventory tab.

2. Change the Inventory Schedule Interval as needed. By default, EmpowerID inventories account stores once every 10 minutes.

3. Toggle Inventory Enabled.

4. Click Save to save your changes to the account store.

Now that inventory is enabled for the account store, the next step is to turn on the Account Inbox permanent workflow. This workflow is responsible for fetching and processing new user accounts.

Step 13 – Enable the Account Inbox Permanent Workflow

1. On the navbar, expand Infrastructure Admin > EmpowerID Server and Settings and select Permanent Workflows.

2. On the Permanent Workflows page, click the Display Name link for Account Inbox.

3. On the Permanent Workflow Details page that appears, click the pencil icon to put the workflow in edit mode.

4. Check Enabled.

5. Click Save to save your changes.

Step 14 - Map Role and Locations

1. On the navbar, expand Identity Lifecycle and select Role and Location Mapper.

2. Select the Role Mapper tab.

3. In the External Source Business Role pane of the Role Mapper tab, do the following:

   1. In the first (upper) field - Search for and select the external directory containing the role you want to map, and

   2. In the second (lower) field - Enter the name of the external role you want to map and press ENTER to load the role.

   3. Select the role from the tree.

4. Select the Location Mapper tab.

5. In the External Source Location pane of the Location Mapper tab, do the following:

   1. In the first (upper) field - Search for and select the external directory containing the location you want to map and

   2. In the second (lower) field - Enter the name of the external location you want to map and press ENTER to load the location.

   3. Select the location from the tree.
      
      

       

6. In the Internal Destination Location pane, enter the name of the EmpowerID location to which you want to map the external directory location and then select the location from the tree.
   
   

    

7. Click Save to save the mapping.

8. Repeat for any other mappings you wish to create.

Use Dynamic Hierarchy Policies to Create External Roles and Locations