SuccessFactors
OpenIAM is implementing SuccessFactors Connector to connect with OpenIAM to perform following operations:
- Save. Handles both create users and update existing user's functions to in the system.
- Search. Allows searching the users based on given filter criteria.
- Delete. Makes the user inactive in SFSF, because delete operation is not supported in the system.
- Reset password. Resets the given user password.
- Suspend. Makes the user inactive in SFSF.
- Resume. Makes the user active in SFSF.
- Import Users. Enables search operation from SFSF to get users data with entitlement like permissions, groups and roles.
Connection information
To make an OData API connection observe the required items from SuccessFactors. They are given in the table below.
| Name | Sample values |
|---|---|
| Datacenter API URL | https://apisalesdemo8.successfactors.com/ |
| Company Id | SFPART060810 |
| Username | sfadmin |
| client_id | NDJjMDlkMGFiYzc2NWNmMjM1MjZlNzY |
| token_url | https://apisalesdemo8.successfactors.com/oauth/token |
| private_key | xxxx |
| grant_type | urn:ietf:params:oauth:grant-type:saml2-bearer |
Data mapping
User entity in SFSF requires some information. The table below gives the data for required fields and filterable fields.
| Field name | Required | Filterable |
|---|---|---|
| addressLine1 | false | false |
| addressLine2 | false | false |
| addressLine3 | false | false |
| businessPhone | false | false |
| cellPhone | false | false |
| citizenship | false | false |
| city | false | false |
| companyExitDate | false | false |
| country | false | false |
| dateOfBirth | false | false |
| dateOfPosition | false | false |
| department | false | true |
| division | false | true |
| false | false | |
| empId | false | false |
| fax | false | false |
| firstName | false | true |
| gender | false | false |
| hireDate | false | false |
| homePhone | false | false |
| jobCode | false | true |
| jobTitle | false | false |
| lastModified | false | true |
| lastModifiedDateTime | false | true |
| lastName | false | true |
| location | false | true |
| manager | false | true |
| hr | false | true |
| married | false | false |
| mi | false | false |
| nationality | false | false |
| ssn | false | false |
| timeZone | false | false |
| title | false | false |
| userId | true | true |
| status | true | true |
| username | false | true |
| password | false | false |
| zipCode | false | false |
Note: Last Modified fields are not for save and update.
SuccessFactors Connector C# Module Information
Create SFSF connector in C# .net framework 4.5 class library project. The purpose of this library is to maintain connection with SFSF with required parameters.
| Class Name | Parameters | Description |
|---|---|---|
| Connection | 1. URL; 2. client_id; 3. username; 4. token_url; 5. private_key; 6. company_id; 7. ConnectorFolder | Makes connection with SFSF and all the parameters, which will be passed by OpenIAM Rabbit IMQ in the form of JSON. After making a successful connection, this class returns a bearer token to perform further operations. |
| GetUsers | 1. URL; 2. client_id; 3. username; 4. token_url; 5. private_key 6. company_Id; 7. fields 8. filter; 9. ConnectorFolder. | Makes connection with SFSF and all the parameters, as well as fields and filters to get user data from SFSF to send back to OpenIAM. This method can be used for importing existing users from SFSF, entitlements like group and simply sending groups and roles as fields from OpenIAM need roles. |
| Upsert | 1. URL; 2. access_token; 3. Json; 4. ConnectorFolder. | This method will call for saving new and existing users in SFSF as well as other operations. |
| It will receive the JSON from PowerShell and send it to SuccessFactors. |
PowerShell Information
In PowerShell already has predefined methods such as calling C# module functions.
Get-SAPData: Calling in SEARCH predefined function to get data from SFSF. Save-SAPData: Calling in SAVE, SUSPEND, RESET-PASSORD and RESUME predefined functions.
Security Considerations
SuccessFactors needs to have below permissions to do API operations.
- SF API user Security roles:
- Administrator Permissions -> Employee Central API -> Employee Central HRIS OData API (editable).
- Administrator Permissions -> Employee Central API -> Employee Central HRIS SOAP API.
- To get permissions related to groups and roles, it is needed to add an API user in the section below.
Filter Query
Find by single field: username eq 'sfadmin' Find by status field get all active users: status eq 't' Find by delta: lastModified ge '2022-01-01T00:00:00'
Additional notes
If API users will not have required permissions, then nothing will work. Before starting, please make sure API users will have all the required permissions as mentioned above.
Additionally, one need to consider the following when working with suspend users in SuccessFactors:
- SEARCH after SUSPEND.
Question: I’m trying to get a user after sending SUSPEND - I got an empty value. In SFSF if the user is inactive, it will not appear in the query. Is it the limit of SuccessFactors? Why cannot we return a user with status = f?
Answer: This is a SFSF limitation.
Search is used to detect whether a user exists before saving.
- Provisioning of a new user in OpenIAM.
SuccessFactors have user with userId = test01 and status =f (suspended)
OpenIAM has no such user. A new user is created with userId = test01 and sent provision to the connector.
Question: What are connector actions for this? Got an error? Override suspended users in SuccessFactors?
Answer: It will be active because the user ID is already there and the status is sent = t means 'make him active'.
- Synchronization
Question: We search users in SuccessFactors and create users in OpenIAM. We can't synchronize a suspended user. And in OpenIAM their status was not changed (We don't know if their status is suspended or such user does not exist).
Answer: Nothing can be said here due to SFSF limitations.
- Reconciliation
Question: We have different action for different cases, for example:
- Users exist in OpenIAM and SuccessFactors - one action (for example update user on OpenIAM from SuccessFactors or update user in SuccessFactors from OpenIAM.)
- Users exist in OpenIAM but do not exist in SuccessFactors - other actions.
Do we create users in SuccessFactors, or delete users in OpenIAM?
We need to have information if a user exists but has a disabled status.
Answer: Nothing can be said here due to SFSF limitations.