This guide explains how to configure the SuccessFactors connector in One Model to ingest data from a SuccessFactors OData API. It is intended for Data Admins setting up a new SuccessFactors data source using either standard OAuth 2.0 or OAuth 2.0 with a self-signed certificate. By the end you will have created the data source, configured your credentials, and selected the OData entities ready for data loading.
Before you start setting up a connector, ensure:
- You have Data Admin permissions in One Model.
- You can access Data > Sources from the One Model menu.
- You have the API reference information for your SuccessFactors instance, including the endpoint URI and nominated user (see Finding Your SuccessFactors Connection Details below).
- If using standard OAuth 2.0, your SuccessFactors instance has been configured for OAuth 2.0. See Setting Up OAuth 2.0 Credentials below, and refer to SAP SuccessFactors help for further information on configuring OAuth in your SuccessFactors instance.
- If using OAuth 2.0 with a self-signed certificate, you have One Model admin permissions to create or download keys, and access to a SuccessFactors administrator who can register a client application in your SuccessFactors instance. Refer to OAuth 2.0 with Self-Signed SAML Assertion below for the steps required.
Note: SuccessFactors LMS data is not available via the SuccessFactors API and cannot be configured in this connector. LMS data must be requested from SAP SuccessFactors Professional Services via SAP SuccessFactors Learning Data Services.
Securing Sensitive Data
HR systems that record and transact employee data will naturally contain highly sensitive information, such as social security numbers, national identification numbers, passport numbers, and bank account details. One Model does not typically use or require this information, so it's important to restrict sensitive employee data within SuccessFactors to ensure it is never retrievable via the API and never leaves SuccessFactors.
You can restrict individual fields or columns within SuccessFactors entities entirely by ensuring the field is not permissioned in SuccessFactors, and by not selecting it in the One Model OData Entities list. Population restrictions set in SuccessFactors are not recognized by the API, so they will not filter the restricted population from the data sent to One Model. If you need to exclude certain populations from One Model, please discuss file-based delivery methods with your Customer Success Team.
Setting Up OAuth 2.0 Credentials
The SuccessFactors connector authenticates using OAuth 2.0. You can set up your client credentials one of two ways: with a standard secret key, or with a self-signed SAML assertion that removes the need to store a secret key at all. Both options produce an API Key for the connector, only the standard option produces a Secret Key.
Standard OAuth 2.0 (Secret Key)
Ensure your SuccessFactors instance has been configured for OAuth 2.0 by following the steps in the SuccessFactors Authentication Using OAuth 2.0 documentation. During configuration, you'll be asked for:
- Application Unique Name: This is whatever you want it to be, it will only show in your SuccessFactors instance. We recommend ‘One Model’. ‘One Model Production’, or another name that identifies the application as being used by One Model.
- Application URL: Any URL in your One Model instance. We recommend your home page.
- X.509 Certificate: SuccessFactors offers two options for generating this certificate: Creating a X.509 Certificate Using Your Own Tools, or Creating an X.509 Certificate in SAP SuccessFactors. A secret key is created when you generate the X.509 certificate. Keep note of it as you'll need it when configuring the connector, and it will not be shown again after this step.
Once you've completed OAuth registration in SuccessFactors, an API key is generated. Make a note of this key. Both it and the secret key created with the X.509 certificate are required when configuring your One Model SuccessFactors connector.
OAuth 2.0 with Self-Signed SAML Assertion
This option uses a self-signed certificate instead of a secret key. One Model generates an RSA public/private key pair and a self-signed X.509 certificate, and stores them securely against your One Model company. You register the public key in SuccessFactors as a client application, and SuccessFactors returns an API key. When a SuccessFactors extraction runs, One Model builds a SAML assertion and signs it with the private key. It then exchanges the signed assertion and the API key for an access token.
The certificate is self-signed (One Model issues it rather than a certificate authority) and the assertion is signed by the matching private key. In the connector configuration, this method is activated by enabling Use Self-Signed SAML Assertion.
Step 1: Generate the key in One Model
- Navigate to Admin > Company > SuccessFactors Key Configuration.
- Click Create Key. One Model generates an RSA public/private key pair and a self-signed X.509 certificate, and stores them against your One Model company record.
- Review the PEM-formatted certificate in the Public Key field, and check the Valid From Date and Valid To Date below it.
- Click Download Key and store it securely.
If no key exists yet, the Public Key field is empty and Download Key is unavailable until you create one. The key pair is stored against your company record, so a single key serves every SuccessFactors data source in your One Model instance. To confirm the key downloaded intact, paste it into any X.509 certificate decoder and check that it parses.
Note: Creating a key replaces the existing one. Any SuccessFactors data source already authenticating with the old key will fail until you register the new public key in SuccessFactors and update the API key.
Step 2: Register the key in SuccessFactors
- In SuccessFactors, navigate to Admin Center > API Center > OAuth Configuration for OData > Register Client Application.
- Paste the downloaded public key into the X.509 Certificate field, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
- Save the client application. SuccessFactors will generate an API key for it.
- Copy the API key and return to One Model.
Finding Your SuccessFactors Connection Details
Before configuring the connector, gather the following from your SuccessFactors instance:
- Endpoint Base Uri: SAP publishes a list of OData API server URLs by data center. Find the one matching your instance's subdomain eg: an instance at https://salesdemo4.successfactors.com uses the API server for the salesdemo4 environment (typically something like https://api4.successfactors.com). Your SuccessFactors administrator can confirm which server your instance uses.
- Company: Your SuccessFactors Company ID. In SuccessFactors, click your profile image in the upper right, then select Show Version Information. Your Company ID is listed there.
-
User: The nominated SuccessFactors user for this connection. Click your profile image in the upper right to view the username shown in parentheses. We recommend using a dedicated service or integration user rather than a personal login.
Add a SuccessFactors Connector
Navigate to Data > Sources, then from the Add a Data Source menu, select the SuccessFactors tile.
Configure Connector Details
| Config | Value | Notes |
|---|---|---|
| Name | SuccessFactors | Or other meaningful label that will identify this data source. |
| Data Loads Should Process Data | Optional | Defaults to On. You may prefer to leave this Off until the data source configuration is finished and tested. |
| Enable Debug Mode | No | Allows logging of the API request and response. If debug mode is required, One Model will organize activating it and retrieving the logs. |
| Restricted Data | No | Restricts downloading of the data files produced by this data source. Typically used with sensitive data (e.g. survey data) to prevent access before processing and aggregation. If required, One Model will organize activating this. |
| Message Queue Capacity | 10 | Sets the maximum number of Simple Queue Service (SQS) messages the API service's queue can process at a time. No change needed by default — One Model will manage capacity changes if required. |
| Schema | successfactors | Or other meaningful label that will identify this data source schema. |
| Processed To | Auto-populates with the most recent date the data source was run. No configuration required. | |
| Endpoint Base Uri | The API server URL for your SuccessFactors instance. See Finding Your SuccessFactors Connection Details above. | |
| Company | Your SuccessFactors Company ID. See Finding Your SuccessFactors Connection Details above. | |
| User | Your nominated SuccessFactors user. See Finding Your SuccessFactors Connection Details above. | |
| API Key | Required for both authentication options. Enter the API key generated when registering the application in SuccessFactors. | |
| Secret Key | Required for Standard OAuth 2.0 | Enter the secret key generated in Standard OAuth 2.0 (Secret Key). |
| Use Self-Signed SAML Assertion | Required for OAuth 2.0 with Self-Signed SAML Assertion | Enable this to activate self-signed SAML bearer authentication. See OAuth 2.0 with Self-Signed SAML Assertion above. |
| Require Secret Key Confirmation | Optional | Set On to require the secret key to be re-entered for any future updates to this connector. This ensures additional SuccessFactors OData entities can only be added by users with the appropriate SuccessFactors credentials. |
Selecting OData Entities to Retrieve
The OData Entities list shows the data entities available to the user configured in the connector details (example list picture below). Select the entities you need retrieved by the SuccessFactors connector. If you only need specific columns within an entity, expand the entity and select the required columns.
Next Steps
You have now configured your SuccessFactors connector. You can:
- Perform a destructive API run from the Data Source page.
- Monitor your API run from Data Sources > View API Runs. See Understanding the API Run Page for more information.
- Monitor successful API runs as they transition into Data Loads. See Data Loads for more information.
-
Reach out to your One Model Customer Success team with any questions.
Comments
0 comments
Article is closed for comments.