Integrate with SuccessFactors

Integrate JumpCloud and SAP SuccessFactors (SuccessFactors) to unify user identities and centralize user lifecycle management. Users will automatically be created, updated, and suspended in JumpCloud based on their user data in SuccessFactors, saving you time and avoiding mistakes, as well as potential security risks, related to manually creating and updating users Users will be able to access all their work resources with a single user identity. Their access and permissions to resources can automatically change based on updates made in SuccessFactors, ensuring they always have access to the resources they need and nothing else.

Read this article to learn how to setup the SuccessFactors integration using a custom API integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO add-on feature
• A SuccessFactors administrator account
• Your SuccessFactors domain and company names
• Your SuccessFactors API server name

Considerations

• The Identity Management integration uses the SuccessFactors SCIM API
• The attributes that are returned from the SAP SuccessFactors SCIM API can be controlled in the SCIM API configuration within the SAP SuccessFactors admin console
• Syncing groups and custom attributes is not supported

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Navigate to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.

7. Optionally, expand Advanced Settings to specify a value for the SSO IdP URL. If no value is entered, it will default to https://sso.jumpcloud.com/saml2/<applicationname>.

8. Click Save Application.
9. If successful, click:
   • Configure Application and go to the next section
   • Close to configure your new application at a later time

Configuring the Identity Management Integration

To configure SuccessFactors

Follow the prerequisites in the Overview of SAP SuccessFactors Workforce System for Cross-Domain Identity Management API article.

Enable the SCIM API user attributes

Control which SCIM user attributes are returned from the SuccessFactors SCIM API. Read Managing Workforce SCIM API Attributes to learn more.

1. Log in to SuccessFactors as an admin for your organization.
2. Go to Admin Center >Manage Workforce SCIM API Attributes.
3. In the User Attributes category, enable the attributes you want returned from the SCIM API. At a minimum, ensure the following attributes are enabled:
   • externalId
   • locale
   • firstName
   • lastName
   • displayName
   • nickName
   • title
   • phoneNumbers
   • personIdExternal
   • employeeNumber
   • emails
   • department
   • division
   • manager
   • empId
4. Save your changes

Create an account for the integration

1. Create an account for the integration.
2. Assign Read Users role to the account.
3. Set the authorization method to Basic Authentication.
4. Securely store the user credentials, like in the JumpCloud Password Manager.

Base64 encode the credentials

1. Access the credentials for the integration account.
2. Use a tool or commands to base64 encode the credentials:
   • Mac – run the following command in the terminal:
     base64 <<< <username>@<companyID>:<password>
   • Windows – run the following command in PowerShell:
     $Text = ‘<username>@<companyID>:<password>’
     $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
     $EncodedText =[Convert]::ToBase64String($Bytes)
     $EncodedText
3. Securely store the encoded credentials, like in the JumpCloud Password Manager. This value will be needed when configuring JumpCloud.

To configure JumpCloud

1. In JumpCloud, create a new application or select it from the Configured Applications list.
2. Select the Identity Management tab.
3. Configuration settings > Service Provider Configuration
   • API Type – select Custom API
   • Authentication method – select API Key
   • Base URL – enter https://{api server}/rest/iam/scim/v2
     Reference List of SAP SuccessFactors API Servers
4. Configuration settings > Service Provider Configuration>Authentication Header
   • Header Name – enter Authorization
   • Header Value – enter Basic <base64 encoded value>
5. Configuration settings > Service Provider Configuration>Authentication Header
   • Click + Add Header
   • Header Value – enter application/scim+json
6. Endpoint Configuration > List users > Location:
   • Resource Location – Enter Resources
   • Method – This field is not changeable and is always set to GET.
   • Endpoint Path – enter /users
7. Endpoint Configuration > List users > Total count:
   • Response Parameter Location – select body.
   • Response Body JSON Path – enter totalResults
8. Endpoint Configuration > List users > Pagination:
   • Limit Name field – Enter limit
   • Offset Name field – Enter skip
9. Scroll back up to the top of the Configuration settings section and click Test Connection.
   • If successful – you will receive a success message and the fields for attribute mapping will appear
   • If unsuccessful – you will receive a failure notification that slides out from the right of the panel and the full error responses received from the service provider will be shown at the bottom of the Configuration Settings section

User Schema Attribute Mapping

Once the connection and credentials have been tested and verified, the user schema mapping section will open. The mappings outlined below are recommended mappings.

1. Unique ID – enter id.
2. User Status – enter active.
3. Inactive Status Values – enter false.
4. Complete the two required field mappings by entering the following values in the Service provider attribute JSON path column:
   • Company email – enter userName if that has the user’s work email. Otherwise, enter emails[0].value
   • Username – enter userName if that has the user’s work email. Otherwise, enter emails[0].value
5. Click Preview to see the SAP employee schema and how the mappings will be applied in JumpCloud. 

6. Click ok to close the User schema preview window.
7. Complete the optional mappings:
   • Enter name.givenName for First Name
   • Enter name.familyName for Last Name 
   • Enter title for Job Title
   • Enter [urn:ietf:params:scim:schemas:extension:enterprise:2.0:User].department for Department
   • Enter [urn:ietf:params:scim:schemas:extension:enterprise:2.0:User].employeeNumber for Employee Identifier
   • Enter phoneNumbers[0].value for Work Phone

8. Click Preview again to verify the mappings.
9. Click ok to close the User schema preview window.
10. Click Activate.

11. If successful, you will receive a message saying the Identity Management integration has been successfully verified.
12. Click save.

Importing Users from SuccessFactors to Jumpcloud

To import with the JumpCloud Admin Portal

1. Log in to the JumpCloud Admin Portal.
2. Navigate to USER AUTHENTICATION > SSO.
3. Search for SuccessFactors and click to open its configuration panel. 
4. Select the Identity Management tab.

5. There are several settings available for importing users from SuccessFactors to JumpCloud.

Import Users

1. Manual Import – clicking the Start Manual Import button kicks off the process flow for doing an immediate and one-time import of users from SuccessFactors to JumpCloud. 
2. Scheduled Imports (hourly) – enabled by default for all new connectors. The first scheduled import will start within an hour after the new connector is saved. Scheduled imports will then run at the same time every hour as the initial scheduled import.

3. Selecting the Receive summary email after each scheduled import results in user import complete emails being sent after each hourly import.

Import Settings

1. Allow reactivation of users on update – checking the box for this setting will result in the user state changing from Suspended to Active in JumpCloud when a user is terminated in SuccessFactors.
2. Apply Advanced Filters on import (optional) – see SuccessFactor’s API documentation for available filters.

To start a manual import

1. Expand the Import Users section and click Start Manual Import.
2. Select one of the following options: 
   • Import new users and user updates
   • Only import user updates
   • View and select specific new users to import (updates not supported)

3. Click Continue.
4. If you selected the View and select specific new users to import (updates not supported).
5. Select the users you want to import.

6. The count of users to be imported will show at the bottom left hand of the list. If this is correct, click Import. 
7. Review the information in the results modal.
8. Click one of the tiles to navigate to the Users page, User Groups page, or Device Groups page or close the modal.​

9. You will receive a User Import Complete email with a summary of the import results and a link for downloading a copy of the import results.
10. You can now connect users to all their JumpCloud resources. Learn more in the Authorize Users to an Application and Connecting Users to Resources articles.

To import users with the JumpCloud API

There are 2 ways to get the application ID for your integration:

1. Retrieve the application ID from URL in the JumpCloud Admin Portal:
   • Log in to JumpCloud Admin Portal.
   • Go to USER AUTHENTICATION > SSO.
   • Open the SuccessFactors application by clicking on it.
   • Note the ID from the URL which is just before “/details”:  https://console.jumpcloud.com/#/sso/{222220da1f777fbe7502cde}/details
2. Retrieve the application ID by making a GET /applications request:

curl command example:   

3. To do a manual import, make a POST /applications/{application_id}/import/jobs request using the application ID from the preceding steps.

curl command example for importing new users and user updates with reactivation of users allowed:

curl command example for importing only user updates:

To run scheduled hourly imports

curl command that allows reactivation, sends an advanced import filter, and sends the user import complete email after the hourly sync occurs:

Updating the SuccessFactors Identity Management Integration in JumpCloud

1. Log in to JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO.
3. Search for and select SuccessFactors from the Configured Applications list.
4. Select the Identity Management tab.
5. Change the desired values
6. Click Update.

Configuring the SSO Integration

To configure JumpCloud

1. Create a new application or select it from the Configured Applications list.
2. Select the SSO tab.
3. Replace any instances of YOURDOMAIN and YOURCOMPANY with your SuccessFactors values.
4. Add or change any attributes.
5. Click save.

Download the JumpCloud metadata file

1. Find your application in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Select the SSO tab and click Export Metadata.
3. The JumpCloud-<applicationname>-metadata.xml will be exported to your local Downloads folder.

To configure SuccessFactors

1. Contact SuccessFactors’ Customer Support and ask them to enable SAML 2.0 Single Sign-On.
2. Include the following information with your request:
   • Sign-In Page URL – copy the JumpCloud IDP URL
   • Sign-Out Page URL – enter https://console.jumpcloud.com/userconsole/
3. Attach the metadata file you exported from JumpCloud and send.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the group of users you want to give access.
5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Validating SSO authentication workflow(s)

IdP-initiated

• Access the JumpCloud User Console
• Select the application’s tile
• The application will launch and login the user

SP-initiated

• Navigate to your Service Provider application URL
• You will be redirected to log in to the JumpCloud User Portal
• The browser will be redirected back to the application and be automatically logged in

Removing the Integration

To deactivate the IdM Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Under the company name and logo on the left hand panel, click the Deactivate IdM connection link.
5. Click confirm. 
6. If successful, you will receive a confirmation message.

To deactivate the SSO Integration or Bookmark

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO or Bookmark tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO or Deactivate Bookmark. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.