Set up a SAP SuccessFactors SCIM connector

Capabilities

Resource	Sync	Provision
Users
Groups

Gather SAP SuccessFactors credentials

Configuring the connector requires you to pass in credentials generated in SAP SuccessFactors. Gather these credentials before you move on.

A user with Admin permissions in SAP SuccessFactors must perform this task.

Register an OAuth application

Log into your SAP SuccessFactors account and navigate to the Admin Center.

Search for the API Center module.

Click OAuth Configuration for OData, or search directly for Manage OAuth2 Client Applications.

Click Register Client Application.

Enter the Application Name, the Application URL, and provide your X.509 Certificate without the header or footer.

Do not use the certificate generated by SAP SuccessFactors. The private key generated by the built-in capability is corrupted. Use your own X.509 certificate.

Click Register.

Find the application you just created in the list and click View.

Copy the value in the API Key field. This will be used as the SAML API Key when configuring the connector.

Grant the admin user the necessary permissions

Navigate to Admin Center > Manage Permission Groups and create a new permission group that includes the admin user.

Navigate to Manage Permission Roles and create a new permission role.

Grant the permission role the following Manage Identity Account and Group permissions:

Read Access to SCIM User API
Read Access to SCIM Group API

Assign the newly created permission role to the permission group you created.

Look up your Company ID

Navigate to your profile menu and select Show version information.

Carefully copy and save the Company ID.

Look up your Instance URL

Refer to the SAP SuccessFactors documentation and look up your API server.

Carefully copy and save the API server URL (for example, https://api4.successfactors.com).

That’s it! Next, move on to the connector configuration instructions.

Configure the SAP SuccessFactors SCIM connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in ConductorOne
Access to the set of SAP SuccessFactors credentials generated by following the instructions above

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

In ConductorOne, navigate to Integrations > Connectors and click Add connector.

Search for SAP SuccessFactors and click Add.

Choose how to set up the new SAP SuccessFactors connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

Click Next.

Find the Settings area of the page and click Edit.

Fill in the following fields:

Company ID: Your SAP SuccessFactors company ID
SAML API Key: The API key from your registered OAuth application
Certificate: Your X.509 certificate (without header/footer)
Private Key: The private key corresponding to your X.509 certificate
Instance URL: Your SAP SuccessFactors API server URL
Issuer URL: Your SAML issuer domain
Admin user ID: The ID of the admin user configured with SCIM permissions

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your SAP SuccessFactors SCIM connector is now pulling access data into ConductorOne.

Follow these instructions to use the SAP SuccessFactors SCIM connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Resources

GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new SAP SuccessFactors SCIM connector

In ConductorOne, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new SAP SuccessFactors SCIM connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. You’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your SAP SuccessFactors SCIM connector deployment:

Secrets configuration

# baton-successfactors-scim-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-successfactors-scim-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>

  # SAP SuccessFactors credentials
  BATON_COMPANY_ID: <SAP SuccessFactors company ID>
  BATON_SAML_API_KEY: <SAML API key>
  BATON_CERTIFICATE: <X.509 certificate>
  BATON_PRIVATE_KEY: <X.509 private key>
  BATON_INSTANCE_URL: <SAP SuccessFactors API server URL>
  BATON_ISSUER_URL: <SAML issuer URL>
  BATON_ADMIN_ID: <Admin user ID>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-successfactors-scim.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-successfactors-scim
  labels:
    app: baton-successfactors-scim
spec:
  selector:
    matchLabels:
      app: baton-successfactors-scim
  template:
    metadata:
      labels:
        app: baton-successfactors-scim
        baton: true
        baton-app: successfactors-scim
    spec:
      containers:
      - name: baton-successfactors-scim
        image: ghcr.io/conductorone/baton-successfactors-scim:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-successfactors-scim
        envFrom:
        - secretRef:
            name: baton-successfactors-scim-secrets

Step 3: Deploy the connector

Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In ConductorOne, click Apps. On the Managed apps tab, locate and click the name of the application you added the SAP SuccessFactors SCIM connector to. SAP SuccessFactors data should be found on the Entitlements and Accounts tabs.

That’s it! Your SAP SuccessFactors SCIM connector is now pulling access data into ConductorOne.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a SAP SuccessFactors SCIM connector

Capabilities

Gather SAP SuccessFactors credentials

Register an OAuth application

Grant the admin user the necessary permissions

Look up your Company ID

Look up your Instance URL

Configure the SAP SuccessFactors SCIM connector

Resources

Step 1: Set up a new SAP SuccessFactors SCIM connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

​Capabilities

​Gather SAP SuccessFactors credentials

​Register an OAuth application

​Grant the admin user the necessary permissions

​Look up your Company ID

​Look up your Instance URL

​Configure the SAP SuccessFactors SCIM connector

​Resources

​Step 1: Set up a new SAP SuccessFactors SCIM connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather SAP SuccessFactors credentials

Register an OAuth application

Grant the admin user the necessary permissions

Look up your Company ID

Look up your Instance URL

Configure the SAP SuccessFactors SCIM connector

Resources

Step 1: Set up a new SAP SuccessFactors SCIM connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector