{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":21584,"path":"integrate-applications/integration-hub/setup-successfactors.md","title":"Set up the SuccessFactors spoke v4.x.x","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up the SuccessFactors spoke v4.x.x\n\nIntegrate the ServiceNow instance with your SuccessFactors instance using OAuth client application and API key.\n\n## Before you begin\n\n- Request an Integration Hub subscription.\n- Activate the SuccessFactors spoke.\n- Enable these system properties:\n - **glide.pf.rest.response\\_payload\\_max\\_size**: The maximum value is, `10240`.\n - **com.snc.process\\_flow.reporting.serialized.val\\_size\\_limit**: The maximum value is, `16384`.\n - **com.glide.transform.json.max-partial-length**: The maximum value is, `65536`.\n- Role required: admin.\n\n**Note:** This procedure is applicable if you are setting up the SuccessFactors spoke v4.12.0 for the first time. If you are using an earlier version of the SuccessFactors spoke, see [Migrate to SuccessFactors spoke v4.12.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/migrate-successfactors.md) for the migration procedure.\n\nFor more information about setting up the spoke, see [SAP SuccessFactors Spoke - OAuth Setup & Migration - Pre-Tokyo, Tokyo and beyond](https://www.servicenow.com/community/knowledge-managers/sap-successfactors-spoke-oauth-setup-amp-migration-pre-tokyo/ta-p/2468046) in [ServiceNow Community](https://www.servicenow.com/community/).\n\n## Register OAuth client application in SuccessFactors\n\nEnable client certificate authentication for the outbound communication by generating the keystore.jks and keystore.cer files.\n\n### Before you begin\n\n- Generate a valid JKS certificate. For information about creating a JKS certificate, see [Creating Java Keystore\\(JKS\\) with Private Key and Certificate Chain](https://help.sap.com/docs/SAP_Cloud_Platform_Master_Data_for_Business_Partners/246fb358c1c7413289c03b8c72734209/18f5bae37a664396b2ebbc1b3c384c53.html) in [SAP Help Portal](https://help.sap.com/docs/), or, do the steps.\n 1. Use the command `openssl genrsa -out private.key 2048` to generate the private.key file.\n 2. Use the private.key to create x.509 certificate \\(.cer file\\) that contains your public key.\n\n Use the command `openssl req -new -x509 -key private.key -out publickey.cer -days 365`\n\n- Convert the public and private key to a .p12 file.\n\n Use the command to do the above step `openssl pkcs12 -export -in publickey.cer -inkey private.key -out successfactors.p12 -name \"\".`\n\n- Convert the .p12 file to .jks\n\n Use the command to do the above step `keytool -importkeystore -srckeystore successfactors.p12 -srcstoretype pkcs12 -destkeystore successfactors.jks`.\n\n- Role required: admin.\n\n### Procedure\n\n1. Log in to the SuccessFactors account as an admin.\n\n2. Navigate to **Admin Centre** and click **Company Settings**.\n\n3. Click **Manage OAuth2 Client Applications**.\n\n4. Click **Register Client Application**.\n\n \\[Omitted image \"sapsf-oauth-app.png\"\\] Alt text: Register a client application.\n\n5. Provide the required details on the form.\n\n In the **X.509 Certificate** field, provide contents of the cert.pem file \\(public key\\) without the headers.\n\n6. Click **Submit**.\n\n **API Key** is generated and displayed. Copy and record the value for later use.\n\n\n## Upload the JKS certificate in your ServiceNow instance\n\nEnable client certificate authentication for the outbound communication by uploading the JKS certificate in your ServiceNow instance.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1. Log in to your ServiceNow instance as an admin.\n\n2. Upload the JKS certificate to your ServiceNow instance.\n\n For instructions to upload the JKS certificate, see [Upload a certificate to an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_UploadACertificateToAnInstance.md) .\n\n \\[Omitted image \"sapsf-cert.png\"\\] Alt text: Upload JKS certificate.\n\n\n## Register SuccessFactors as an OAuth provider\n\nUse the API key generated during the client application configuration to register the application as an OAuth provider.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1. In your ServiceNow instance, navigate to **System OAuth** > **Application Registry**.\n\n2. Click **New**.\n\n3. In the form, fill in these fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nUnique name to identify the certificate. For example, `SuccessFactors SAML`.\n\n
\n\nClient ID\n\n\n\nValue of the API key you had copied after registering the OAuth client application in SuccessFactors.\n\n
\n\nClient Secret\n\n\n\n**Note:** Client secret is not needed to register the application as an OAuth provider. You can provide any value for this field.\n\n
\n\nOAuth API Script\n\n\n\nName of the OAuth API script. Search for `OAuthUtilSuccessFactors` and select it from the list.\n\n
\n\nDefault Grant Type\n\n\n\nDefault grant type used to establish the token. Select **SAML2 Bearer**.\n\n
\n\nToken URL\n\n\n\nSuccessFactors OAuth server endpoint URL that includes the Company ID in this format: `https:///oauth/token?company_id=`. For example, `https://example.successfactors.eu/oauth/token?company_id=SFCPART123456`.\n\n
\\[Omitted image \"sapsf-app-reg.png\"\\] Alt text: Application registry record.\n\n4. Click **Submit**.\n\n\n## Create the SAML2 assertion producer record\n\nCreate a SAML2 assertion record to generate the SAML2 assertion and exchange the assertion for the access tokens with the provider.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1. Create a SAML2 assertion producer record in your ServiceNow instance.\n\n 1. Navigate to **All** > **System OAuth** > **SAML2 Assertion Producers**.\n\n 2. Click **New**.\n\n 3. On the form, fill these values.\n\n |Field|Description|\n |-----|-----------|\n |Name|Unique name to identify the SAML2 assertion producer record. For example, `Successfactor SAML OAuth`.|\n |Issuer|Unique identifier for the assertion issuing entity. Provide the ServiceNow instance URL.|\n |Subject NameID|User name to log in to the SuccessFactors instance. For example, `sfadmin`.|\n |Audience|Intended audience for the assertion. Enter the value, `www.successfactors.com`.|\n |Recipient|Intended recipient for the assertion. Enter URL in this format, `https:///oauth/token`.|\n\n \\[Omitted image \"successfactors-saml2-assertion-prod.png\"\\] Alt text: SAML2 assertion producer record.\n\n 4. Right-click the form header and click **Save**.\n\n 5. Under the **SAML2 Assertion Keystores** tab, click **New**.\n\n 6. On the form, fill these values.\n\n |Field|Description|\n |-----|-----------|\n |Name|Unique name to identify the SAML2 assertion keystore record. For example, `sap_successfactor`.|\n |Signing Key Alias|Alias of key entry stored in the Keystore used to sign the assertion. For example, `1`.|\n |Signing Key Password|Password of the key entry stored in the keystore used to sign the assertion.|\n |Signing Keystore|Required X.509 certificate record. Select the X.509 certificate record that you had earlier created. For more information, see [Upload the JKS certificate in your ServiceNow instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).|\n\n \\[Omitted image \"sapsf-assertion-ks.png\"\\] Alt text: SAML2 assertion keystore record.\n\n 7. Click **Submit**.\n\n 8. Navigate to **All** > **System OAuth** > **SAML2 Assertion Producers**.\n\n 9. Open the SAML2 assertion producer record that you had created.\n\n For example, **Successfactor SAML OAuth**.\n\n 10. Under the **SAML2 Assertion Attributes** tab, click **New**.\n\n 11. On the form, fill these values.\n\n |Field|Description|\n |-----|-----------|\n |Name|Name to identify the SAML2 assertion attribute record. Enter `api_key`.|\n |Type|Type of the **Value** field. Select **String**.|\n |Value|API key generated after the OAuth client application is created in SuccessFactors.|\n\n \\[Omitted image \"sapsf-assertion-attribute.png\"\\] Alt text: SAML2 assertion attribute record.\n\n 12. Click **Submit**.\n\n2. Associate the SAML2 assertion producer with the application registry record.\n\n 1. Navigate to **System OAuth** > **Application Registry**.\n\n 2. Open the application registry record that you had created.\n\n For example, **SuccessFactors OAuth Reg**. For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).\n\n 3. Under the **OAuth Entity Profiles** tab, open the default OAuth entity profile record.\n\n For example, **Successfactor SAML default\\_profile**.\n\n 4. For the **Assertion Producer** field, select the SAML2 assertion producer record you had created.\n\n For example, **Successfactor SAML OAuth**.\n\n \\[Omitted image \"sapsf-assertion-oauth.png\"\\] Alt text: OAuth entiy profile record.\n\n 5. Click **Update**.\n\n\n## Create Credential record for the OData API\n\nCreate Credential record for the OData APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the OData API.\n\n### Before you begin\n\nRole required: admin.\n\n### Procedure\n\n1. Navigate to **All** > **Connections & Credentials** > **Credentials**.\n\n2. Click **New**.\n\n The system displays the message **What type of Credentials would you like to create?**.\n\n3. Select **OAuth 2.0 Credentials**.\n\n An empty OAuth 2.0 Credentials form is displayed.\n\n4. On the form, fill these values.\n\n\n
\n\nField\n\n\n\nValue required\n\n
\n\nName\n\n\n\nName to uniquely identify the record. For example, enter `SAML_SuccessFactors_OData_Cred`.\n\n
\n\nOAuth Entity Profile\n\n\n\nOAuth entity profile record that is associated with the OAuth application registry you had created. For example, `Successfactor SAML default_profile`.For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).\n\n
\n\nActive\n\n\n\nOption to actively use the credential record.\n\n
\n\nOrder\n\n\n\nOrder to apply this credential. For example, enter `100`.\n\n
\\[Omitted image \"sapsf-odata-cred.png\"\\] Alt text: OData credential record.\n\n5. Click **Submit**.\n\n\n### Result\n\nThe credential record to authorize actions using the OData API is created.\n\n## Create Credential record for the SOAP API\n\nCreate Credential record for the SOAP APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the SOAP APIs.\n\n### Before you begin\n\nRole required: admin.\n\n### Procedure\n\n1. Navigate to **All** > **Connections & Credentials** > **Credentials**.\n\n2. Click **New**.\n\n The system displays the message **What type of Credentials would you like to create?**.\n\n3. Select **OAuth 2.0 Credentials**.\n\n An empty OAuth 2.0 Credentials form is displayed.\n\n4. On the form, fill these values.\n\n\n
\n\nField\n\n\n\nValue required\n\n
\n\nName\n\n\n\nName to uniquely identify the record. For example, enter `SAML_SuccessFactors_SOAP_Cred`.\n\n
\n\nOAuth Entity Profile\n\n\n\nOAuth entity profile record associated with the OAuth application registry you had created. For example, `Successfactor SAML default_profile`.For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).\n\n
\n\nActive\n\n\n\nOption to actively use the credential record.\n\n
\n\nOrder\n\n\n\nOrder to apply this credential. For example, enter `100`.\n\n
\\[Omitted image \"sapsf-soap-cred.png\"\\] Alt text: SOAP credential record.\n\n5. Click **Submit**.\n\n\n### Result\n\nThe credential record to authorize actions using the SOAP API is created.\n\n## Create Connection record for the OData API\n\nCreate a Connection record for the OData API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.\n\n### Before you begin\n\nRole required: admin.\n\n### Procedure\n\n1. Navigate to **All** > **Connections & Credentials** > **Connection & Credential Aliases**.\n\n2. Open for the record for **SuccessFactors OData**.\n\n For example, **SuccessFactors\\_OData**.\n\n3. From the **Connections** tab, click **New**.\n\n The system displays an empty HTTP\\(s\\) Connection form.\n\n4. On the form, fill these values.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName to uniquely identify the record. For example, `SAML_SuccessFactors_OData_Conn`.\n\n
\n\nCredential\n\n\n\nCredential record you created for the REST API. For example, `SAML_SuccessFactors_OData_Cred`.\n\n
\n\nConnection URL\n\n\n\nSuccessFactors service root URL in this format: `https:///odata/v2`. For example, `https://example.successfactors.eu/odata/v2`.**Note:** If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server.\n\n
\n\nActive\n\n\n\nOption to actively use the connection record.\n\n
\\[Omitted image \"sapsf-odata-conn.png\"\\] Alt text: OData connection record.\n\n5. Click **Submit**.\n\n\n### Result\n\nThe connection record for the REST API in SuccessFactors is created.\n\n## Create Connection record for the SOAP API\n\nCreate a Connection record for the SOAP API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.\n\n### Before you begin\n\nRole required: admin.\n\n### Procedure\n\n1. Navigate to **All** > **Connections & Credentials** > **Connection & Credential Aliases**.\n\n2. Open for the record for **SuccessFactors SOAP API**.\n\n For example, **SuccessFactors\\_Comp\\_Emp**.\n\n3. From the **Connections** tab, click **New**.\n\n The system displays an empty HTTP\\(s\\) Connection form.\n\n4. On the form, fill these values.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName to uniquely identify the record. For example, `SAML_SuccessFactors_SOAP_Conn`.\n\n
\n\nCredential\n\n\n\nCredential record you created for the SOAP API. For example, `SAML_SuccessFactors_SOAP_Cred`.\n\n
\n\nConnection URL\n\n\n\nSuccessFactors connection URL. For example, `https:///sfapi/v1/soap`. For example, `https://example.successfactors.eu/sfapi/v1/soap`.**Note:** If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server.\n\n
\n\nActive\n\n\n\nOption to actively use the connection record.\n\n
5. In the **Attributes** tab, provide these fields.\n\n |Field|Description|\n |-----|-----------|\n |Company Id|Immutable Company ID of your SuccessFactors instance.|\n |Flow Timeout \\(seconds\\)|Maximum time in seconds up to which data can be received from SuccessFactors during the flow execution. If the time taken to retrieve data from SuccessFactors exceeds the timeout duration, the flow or subflow is cancelled. Default value is, `30`.|\n\n \\[Omitted image \"sapsf-soap-conn.png\"\\] Alt text: SOAP connection record.\n\n6. Click **Submit**.\n\n\n### Result\n\nThe connection record for the SOAP API in SuccessFactors is created.\n\n## Synchronize data between SuccessFactors and ServiceNow\n\nCustomise the sample flows as per your requirement to synchronize data between your SuccessFactors and ServiceNow instances.\n\n### Todo entity\n\nThe SuccessFactors spoke provides sample flows to synchronize data bi-directionally for the todo entity. The sample flow, Run SuccessFactors Integration Flow can customised to retrieve data from SuccessFactors, while the Create Todo and Update Todo flows creates or updates the todo records in SuccessFactors when events occur in ServiceNow. While customising the sample flows, ensure that you provide appropriate triggers to retrieve and save future updates using transform maps.\n\n### Other default entities\n\nFor these entities, the sample flow, Run SuccessFactors Integration Flow, can be customised to retrieve data from SuccessFactors:\n\n- Department\n- Location\n- Job Profile\n- Workers Profile\n- Effective Workers Profile\n- Job History Including Secondary Assignments\n\nTo create or update records in SuccessFactors for these entities when events occur in ServiceNow:\n\n- Create flows or subflows as per your choice or customise the sample flows and subflows.\n- Use Metadata Retrieval and Record Management actions in your flows.\n- Ensure that you provide appropriate triggers to retrieve and save future updates using transform maps.\n\n### Other SuccessFactors entities\n\nDepending on the SuccessFactors permissions and configurations, you can also synchronize data of other entities as per your requirement.\n\n"}}