HR Mini Master Integration
SuccessFactors to CPI Connectivity
Configuration at SuccessFactors level:
User Creation (API user creation is required, and we can use the same in CPI for
accessing/sending data from/to Employee Central) and Admin Center (Resetting User
Passwords: Reset the password to new which can be referenced in SAP CPI while creating
Security Artifact).
Maintain Permission Groups (for the API user) and Permission Roles (to grant security access to
the SAP API user ID created).
Also, provide Odata API and compound employee access to the API user.
Set API Login Exceptions: Here in Password & Login Policy settings, we have to make the
password non-expiring for the API user and put IP Address (public IP Address range of CPI
tenant) restrictions for API User.
SAP CPI End-to-End Configurations
Pre-packaged flow alignment:
As we are using a pre-packaged configuration and after checking an IFlow, we can only configure
sender and receiver adapter configuration.
According to the flow, we are receiving a proxy from S/4HANA, and using the OData query we
are fetching the information from SF; that’s why we will need the details for configuring the same
in CPI.
If any customization is required, in that case:
We will create the IFlow from scratch, and Message Mapping/Transformation logic is required:
Mapping will be completed by interfacing source fields to target structure fields through intuitive
select, click, and connect features.
SuccessFactors (Odata V2) adapter configuration
From the connectivity point of view cloud connector is already configured between CPI and
S/4HANA.
S/4HANA Configurations
SOAMANAGER Configurations.
Configuration at CPI level:
Login into SAP CPI tenant and navigate to Monitoring Manage Security Material to create a
credential that is later used in SOAP adapter of S4 , a technical S4 user (S4_SERVICE ) created
in S4 and used for this credential
In CPI, create key pair in security material & make sure to add common Name as
userid(usoninteg) in SF,
After key pair is created, Keystore Click on the action button against Certificate
Download. We need to register this certificate in SF, once registered in SF copy the value of
API Key
Go to SuccessFactors and access the “Admin Center” Manage OAuth2 Client
Applications”.
Click on the “Register Client Application” and enter the details given below and “Register”.
• We can see the applications once created and click on the “View” option and retrieve the “API
key” which we will need in the next step.
Create OAuth2 Credentials in CPI
Monitor Manage Security Security Material.
Click on the “Create” button OAuth2 SAML Bearer Assertion.
Fill out the fields:
Name: your unique name for this key/credentials
Grant Type: OAuth2SAMLBearerAssertion
Audience: www.successfactors.com
Client Key: API Key (retrieved from SF)
Token Service URL: https://######.successfactors.com/oauth/token
Target System Type: SuccessFactors
Company ID: your SF company ID
User ID: Key Pair Common Name (CN)
Key Pair Alias: your unique name created in earlier instruction (found in Keystore),
Download and configure the CPI package related to Employee master data and organizational from the
Discover menu.
Below Pre-Packages are used for this Integration.
SAP ERP or SAP S/4HANA Integration with SAP SuccessFactors Employee Central:
Confirmation v2
SAP SuccessFactors Employee Central Integration with SAP ERP or SAP S/4HANA: Employee
and Organizational Data
Copy the package to Design tab and configure the sender and receiver adapter details in the artifact.
Click on Configure and update the connection parameters.
Similarly, Copy the package SAP SuccessFactors Employee Central Integration with SAP ERP or SAP
S/4HANA: Employee and Organizational Data and configure the Artifacts
Save and deploy the artifacts.
SAP S∕4HANA and Employee Central need to know the specific endpoint URL for each integration flow
instance they are to call in the middleware. The endpoint URLs are needed here:
In the employee master data and organizational assignment integration flow, SAP S∕4HANA needs to
address the middleware since it triggers the replication.
The confirmation is also sent by SAP S∕4HANA to the middleware and from there to Employee Central.
To get the complete endpoint URL, configure and deploy the integration flow first, then copy the URL from
Manage Integration Content.
Go to Manage Integration Content in SAP Cloud Integration and copy the URL shown in the Endpoints
section.
The URL looks like this: https://<runtime URL of your SAP Cloud Integration environment>/cxf/<sender
address>.
SOAMANAGER Configurations (S4 Basis) :
Login into SAP S4 system Tcode- SOAMANAGER
We need to activate below outbound webservices (to establish connection from SAP to Middleware)
getEmployeeMasterDataAndOrgAssignmentBundleReplication
getOrganisationalObjectReplicationQuery_Out
Choose Web Service Configuration
Click in the internal name of the webservice and create manual configuration for logical port.
Give a Valid logical Port name and click in Next
Select the authentication level and click on next
Here the username and password are from the CPI tenant, Client ID and Secret generated from Process
integration runtime Service key
Go to HTTP settings and give the endpoint URL copied from the CPI iflow after deploying and click on
Finish
Now ping webservice and check the connection.
Repeat the steps for other outbound proxy.
Authentication
Even if we use basic authentication for integration, certificates are needed to enable a secure HTTPS
communication between SAP S∕4HANA and SAP Cloud Integration
Add the root certificate from SAP Cloud Integration in the Trust Manager (STRUST) transaction in your
SAP S∕4HANA system, for connections initiated by the SAP S∕4HANA system to SAP Cloud Integration.
Verify that the root certificate from your SAP S∕4HANA system was added in the keystore in your SAP
Cloud Integration tenant, for connections initiated by SAP Cloud Integration to the SAP S∕4HANA system.
Make sure that the SAP Cloud Integration user that is used to trigger calls from outside the middleware to
SAP Cloud Integration has the necessary permission for sending messages.
