Identity and access management
SAP SuccessFactors to Omada integration: Employee Central as the authoritative source in Omada Identity
Omada has its own package for SAP SuccessFactors that imports employees from Employee Central as identities, with their manager as owner and company, business unit, division and department as context. With an integration between SAP SuccessFactors and Omada, that data therefore drives roles, reviews and revoking access; KoppelHet sets up the package, moves the sign-in to OAuth and fills in where it stops.
What the integration does
Organisations that use SAP SuccessFactors Employee Central and Omada for roles and audits often find the source runs on a username and password. SAP is ending that sign-in method, and the import then stops without warning while Omada keeps basing roles on the last known state.
- In SuccessFactors we create an API user with a role with read-only rights on employees and the organisation objects.
- We register an OAuth client application with a certificate and enter the details in Omada's system settings.
- Omada's SuccessFactors package reads employees as identities and the organisation as context.
- KoppelHet aligns the queries with your setup, such as paging on person data and custom fields.
- After each import KoppelHet compares the number of changes with SuccessFactors and reports deviations.
What to watch for with SAP SuccessFactors and Omada
- Omada has two packages for SuccessFactors. The OData package reads Employee Central as an HR source; the SCIM package manages users and groups in SuccessFactors itself, through SAP Cloud Identity Services. For this integration we use the OData package.
- Besides a username with password, Omada's import page also lists OAuth 2.0 with SAML, with certificate, user ID and company ID. SAP is phasing out password sign-in. KoppelHet therefore moves the source to OAuth before SAP switches the old sign-in off.
- If HR changes something while Omada reads person data, an employee can appear twice or not at all in the import. Omada therefore recommends paging=snapshot on PerPerson. KoppelHet puts that in the query, so a large import during office hours does not miss identities.
- SuccessFactors distinguishes upper and lower case in the userId, so two users can differ only in that. KoppelHet checks for such pairs in the first import, before Omada treats them as one identity.
- Omada can write the email address back to the PerEmail record in SuccessFactors. Omada's own example uses a fixed code for the email type. That code differs per SuccessFactors environment; KoppelHet looks up the code for the business type, so Omada does not overwrite the private address.
- Fields Omada reads must be enabled in the SuccessFactors data model; otherwise they stay empty. A custom field for, say, employee type is first enabled by the SuccessFactors administrator, and then we add it to the query.
- A restructuring in SuccessFactors can affect hundreds of contexts and roles in one import. The thresholds for new, modified and deleted objects are off by default in Omada. KoppelHet sets them, so an error in the organisation structure does not revoke access in one go.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Omada can already read SuccessFactors. What does KoppelHet do then?
Setting up the API user and OAuth, aligning the queries with your Employee Central and monitoring the imports. For what the package does not cover we build an addition.
Does Omada write anything back to SuccessFactors?
Only the email address, through an event in Omada. Other HR data stays in SuccessFactors and is managed there by HR.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Omada SAP SuccessFactors (OData): on the OData collector, default mapping Employee to Identity, Manager to Identity owner, Company, Business unit, Division and Department to Context and context assignment, head of unit to Context owner. Base URL without the part from login?; user as name@companyID with basic or OAuth 2.0 SAML (SAML IDP Endpoint, Token endpoint, Client ID, X509 certificate, User ID, Company ID); JSON recommended; timeout 3600 seconds by default.
- APIUser role in SuccessFactors according to Omada: Employee Data View, Employee Central HRIS OData API and Foundation OData API (read only), SFAPI User Login, Admin access to OData API, Manage OAuth2 Client Applications and MDF object rights View on Business Unit, Department, Division, Job Classification, Job Function and Legal Entity.
- Write-back: Omada event Update email on Identities with an Execute code action to the SuccessFactors system; writes SFOData.PerEmail (emailAddress) for personIdExternal; test query PerPerson.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in Omada | Notes |
|---|---|---|
userId / personIdExternal | UID (identiteit) | Case-sensitive in SuccessFactors |
Voornaam en achternaam (PerPersonal) | FirstName, LastName | |
managerId (EmpJob) | Identity owner | |
company (FOCompany) | Context (bedrijf) | |
businessUnit, division, department | Context en context assignment | |
Hoofd van de eenheid | Context owner | |
Zakelijk e-mailadres (PerEmail) | Email | Omada can write this address back |
startDate en einddatum dienstverband | ValidFrom, ValidTo |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central