SAP Success Factors connector Configuration in SAP GRC Access Control.

SAP SuccessFactors Employee Central is a cloud-based solution that pulls all employee data into a single platform. SAP GRC can be integrated with the SAP SuccessFactors system. The integration can be done in two ways.

1. Integrating SAP SuccessFactors system with GRC for provisioning, Risk Analysis, and Role import (Role maintenance is not supported).
2. Integrating SAP SuccessFactors Trigger (Employee Central) via SAP Cloud Platform integration.

This Blog highlights the steps required to configure the connector in case the SAP SuccessFactors system is connected directly to the SAP GRC system.

 Creating Connector for SAP SuccessFactors in GRC

Create an HTTP connector Type G between SAP Access Control and SAP SuccessFactors.

1. In Customizing (transaction SPRO), follow the path SAP Reference IMG→ Governance, Risk, and Compliance→ Common Components→ Integration Framework→ Create Connectors.
2. Choose “Create Connectors”.
3. Choose the Create icon and the folder HTTP Connections to External Server.
4. Fill in the data as indicated by the example data in the screenshot below.

In SM59 RFC connection of type G (HTTP connection to External Serv), please maintain the below details:

The API URL is based on the data center you are in. The KBA 2215682 contains the URLs for each data center. The below example is for Data Center 4.

Logon Data

As Basic authentication, the user should be concatenated along with company id, under “Logon & Security” in SM59, the example you can maintain user@company and password.

If you have multiple SuccessFactors instances, where to enter the company id (e.g., company1, company2, company3, company4, etc.)?

For example, if the user is ABCD and the company id is company1, then it should be maintained as ABCD@company1

Please note the user should have admin (role) privileges in SuccessFactors. The manage Role-based Permission access ” RBP_ADMIN” is required for API user.

For more extensive authorization requirements, refer to KBA:2979765.

Certificate installation

You can configure the RFC destination SFEC using the below details:

Certificates
SSL Certificate of SFEC should be installed on the GRC system via t-code STRUST:

Check ST11 (dev_icm) logs for issues with Certificates and for more information on what certificates are missing and need to be installed, the error itself will mention the missing certificate:

• SSL handshake with api4.successfactors.com failed: SSSLERR_PEER_CERT_UNTRUSTED
• Failed to verify peer certificate. Peer not trusted

Please get the missing Certificates from the respective vendor and install them. KB article 2461900 will assist you if any SSSLERR_PEER_CERT_UNTRUSTED handshake errors occur.

Profiles

Following profiles need to be set on the GRC system:

Create the Connection Type Definition

1. In the IMG Choose, Governance, Risk, and Compliance→ Common Components→ Integration Framework→ Maintain Connectors and Connection Types
2. Create a connection type as indicated in the screenshots below. Choose Define Connectors. Enter the Target Connector and Connection Type for your connection.
   3. Assign your connector to the group you just created using the same Connection type. 4. Maintain your connection settings. Choose IMG→ Governance, Risk, and Compliance→ Common Components→ Integration Framework→ Maintain Connection Settings.5.Select Work Area = PROV (Provisioning)
   

1. Link your connector to PROV.
   Select Scenario-Connector Link. Link the Target Connector SFEC to the PROV Work Area. The Connection Type is SFEC.
2. Map your actions and connector groups in SAP Access Control.
   1. Choose IMG→ Governance, Risk, and Compliance→ Access Control→ Maintain Mapping for Actions and Connector Groups.
   2. Add your connector group and activate it.

Case Sensitive and Extended object configuration.

As SAP SuccessFactors is case sensitive, the created SAP SuccessFactors connector needs to be maintained for the configuration parameter 1022(Connector for which Object Ids may be maintained case sensitive) and 1046(Extended objects enabled connector) the same in the configuration parameter. Once the connector is maintained, creating Risk and generating the rules in the SAP GRC system will update the tables mentioned below.

• GRACACTRULEEXT
• GRACFUNCACTEXT
• GRACFUNCPRMEXT
• GRACPROFACTVLEXT
• GRACPROFPRMVLEXT
• GRACROLEACTVLEXT
• GRACROLEPRMVLEXT
• GRACUSERACTVLEXT
• GRACUSERPRMVLEXT

Note: If you run Repository Object sync prior to maintaining the SAP SuccessFactors connector in the parameter 1022, the User id in the SAP GRC table GRACUSERCONN will be updated with Upper case and later on if you maintain the SAP SuccessFactors connector for the parameter 1022 an run the Repository Object sync job again, the GRACUSERCONN table will have duplicate entries for the User id’s maintained in Lower Case in the SAP SuccessFactors system.

User Mapping

In the customer landscape, there could be a scenario where the user id in the SAP SuccessFactors system is different from user id in other SAP systems. If the parameter 1055(Connector enabled for auto User Mapping in Repository) in the SPRO configuration is set for the SAP SuccessFactors system, Running the repository sync for the SAP SuccessFactors system will map the SF Username filed to the SAP User ID Field.

Once this is maintained, while running the repository sync, the system will map the SF field with GRC fields and update the data in the GRC table accordingly.

User Mapping to be added. Custom user mapping needs to be assigned in the connector setting.

This completes the Connector configuration for integrating the SAP SuccessFactors system with GRC.