Identity and access management
SAP SuccessFactors to JumpCloud integration: employees from SuccessFactors as users in JumpCloud
JumpCloud can import users from SAP SuccessFactors through the SuccessFactors SCIM API, with name, job title, department and employee number, and suspends a user when SuccessFactors reports them as inactive. With an integration between SAP SuccessFactors and JumpCloud a new colleague therefore gets an account automatically; KoppelHet sets up the SCIM side and the import filter and fills in where JumpCloud stops, such as the manager and custom fields.
What the integration does
Organisations that have SAP SuccessFactors as their HR system and JumpCloud for devices, single sign-on and users often still create new colleagues by hand. When JumpCloud's import is added, the manager turns out not to come along and JumpCloud imports everyone SuccessFactors knows if there is no filter.
- In SuccessFactors we create an integration user with the Read Users role and enable the required SCIM attributes.
- In JumpCloud we set up the SuccessFactors application with a Custom API import on /Users and the attribute mapping.
- With a SuccessFactors group and the import filter we decide who JumpCloud imports.
- We switch on the hourly import and let imported users land in a JumpCloud group bound to the application.
- After each import KoppelHet fills in the manager and custom fields through the JumpCloud API and reports deviations.
What to watch for with SAP SuccessFactors and JumpCloud
- JumpCloud does not read SuccessFactors through OData but through the SCIM API at /rest/iam/scim/v2. Which fields that API returns is set by the administrator in SuccessFactors under Manage Workforce SCIM API Attributes. If a field is off there, it stays empty in JumpCloud without an error. KoppelHet enables title, department, employeeNumber, emails and manager before the first import runs.
- Sign-in uses Basic Authentication of an integration user, as username@companyID with password. SAP is phasing out that sign-in for its APIs. KoppelHet tracks SAP's timeline and makes sure the import does not stop on the day Basic Authentication ends.
- JumpCloud sets the state with a fixed rule - active if SuccessFactors has active set to true, otherwise suspended. In one place JumpCloud also describes the option to reactivate suspended users as something that happens on a termination. KoppelHet tests with a leaver and a rehire what the option does in your environment before it is switched on.
- SuccessFactors returns the manager through SCIM, but JumpCloud does not include it in the mapping. The import does not synchronise groups or custom fields either. After each import KoppelHet reads the manager and any custom fields and sets them on the user through the JumpCloud API, so approvals and group rules run on the right line.
- Without a filter JumpCloud imports every user the SuccessFactors SCIM API returns, including for example external or test accounts. JumpCloud suggests creating a group in SuccessFactors and referring to it in the import filter. KoppelHet builds that group on rules in SuccessFactors, such as company and employee type, so HR does not have to add anyone by hand.
- An imported user only gets access when they are in a JumpCloud group bound to the application; until then access is implicitly denied. KoppelHet makes sure every new user from SuccessFactors lands in that group straight away, so a new colleague can sign in on day one.
- The scheduled import is off for a new connector and then runs every hour at the same time. JumpCloud also warns that Save instead of Activate discards the SCIM settings. KoppelHet switches the import on after a manual trial run with Preview, and has the summary email go to the administrators after each run.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens with a leaver?
As soon as SuccessFactors returns the employee as inactive, JumpCloud suspends the user at the next import. How quickly depends on when HR records the departure.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- JumpCloud SuccessFactors application (SSO package or higher): Custom API import, Base URL https://{api server}/rest/iam/scim/v2, GET /Users with resource location Resources, total via totalResults, header Accept application/scim+json and Authorization Basic (base64 of user@companyID:password). State expression manageUserState("SUSPENDED", providerUser.active == false, "ACTIVATED", true); import filter in SCIM filter syntax; scheduled import every hour.
- SuccessFactors: integration user with the Read Users role; SCIM attributes enabled under Admin Center > Manage Workforce SCIM API Attributes (externalId, displayName, title, phoneNumbers, personIdExternal, employeeNumber, emails, department, division, manager, empId). Addition by KoppelHet through the JumpCloud API on manager and custom attributes.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in JumpCloud | Notes |
|---|---|---|
id (SCIM) | Unique ID | Required in JumpCloud |
userName of emails[0].value | Company email en Username | |
name.givenName, name.familyName | First Name, Last Name | |
title | Job Title | |
enterprise.department | Department | |
enterprise.employeeNumber | Employee Identifier | |
phoneNumbers[0].value | Work Phone | |
active | State (ACTIVATED of SUSPENDED) | |
manager (SCIM) | Manager | Added by KoppelHet |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central