OAuth2SAMLBearerAssertion

This brief is to showcase the SAP SuccessFactors extensibility service when used directly from SAP BTP, Kyma runtime environment. Please check the code sample below: build a SAP SuccessFactors app on Kyma runtime with SAP CAP framework.

SAP SuccessFactors extensibility service comprises SuccessFactors ODATA api-access automation and SSO configuration service plans, as documented here:

• Extending SAP SuccessFactors in the Cloud Foundry and Kyma Environment | Process Flow | SAP Help

Putting it all together

Here goes the agenda for this brief.

api-access automation service plan

apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: quovadis-sap-jwt
  labels:
    app.kubernetes.io/name: sap-successfactors-extensibility
  annotations: {}
  namespace: <namespace>
spec:
  serviceOfferingName: sap-successfactors-extensibility
  servicePlanName: api-access
  externalName: Quovadis-SAP-JWT ### destination name
  parameters: 
    systemName: SFPART058654 ### SAP BTP Global Account system name

sso-configuration service plan

Destinations testing using a managed approuter on a BTP subaccount level

Given the fact the destinations have been created on a BTP sub-account level and assuming there is a managed approuter instance on the BTP sub-account as well we could leverage the approuter dynamic_dest construct as follows:

https://<tenant>.launchpad.cfapps.<region>.hana.ondemand.com/dynamic_dest/Quovadis-SAP-JWT/odata/v2/PerPersonal,EmpJob/$metadata

https://<tenant>.launchpad.cfapps.<region>.hana.ondemand.com/dynamic_dest/Quovadis-SAP-JWT/odata/v2/User?$top=1&$format=json

Conclusion

The SAP BTP automation makes it easy to set up integrations between SAP LOB applications and the SAP BTP platform.

The SAP BTP, Kyma runtime together with the btp service operator allow for the out-of-the-box automation multi-tenancy. For instance you can deploy same set of SFSF destination to different subscribers (different BTP sub-accounts) to cater for geographical proximity etc…

The Cloud Application Programming model provides a productivity framework to help create beautiful business application with the BTP runtimes you want.

Now it’s time to shine and create this kyma app you always wanted to make.

Please share your feedback and continue reading through to the coffee corner below…

Coffee corner

Build a SAP SuccessFactors app on Kyma runtime with SAP CAP framework.

Let’s use the following CAP code generator (VScode or terminal):

• https://www.npmjs.com/package/generator-saphanaacademy-cap
• https://github.com/saphanaacademy/generator-saphanaacademy-cap

Please get familiar with the wizard’s documentation. There are also hands-on video tutorials here.

To help you get started, please find the prompt values for a minimal viable CAP application with Kyma runtime using SAP SuccessFactors Recruiting and SAP SuccessFactors Employee Central external APIs:

sfk8s with terminal

$ yo saphanaacademy-cap

The prompt values are purely for guidance. Feel free to alter your answers and then inspect and amend the generated code.

📦srv
 ┣ 📂external
 ┃ ┣ 📜ECEmploymentInformation.csn
 ┃ ┣ 📜ECEmploymentInformation.edmx
 ┃ ┣ 📜RCMCandidate.csn
 ┃ ┗ 📜RCMCandidate.edmx
 ┣ 📜Dockerfile
 ┣ 📜catalog-service.cds
 ┗ 📜catalog-service.js

📦app
 ┣ 📂resources
 ┃ ┣ 📂html5
 ┃ ┃ ┗ 📂webapp
 ┃ ┃ ┃ ┣ 📜index.html
 ┃ ┃ ┃ ┗ 📜map.html
 ┃ ┗ 📜index.html
 ┣ 📜Dockerfile
 ┣ 📜package.json
 ┗ 📜xs-app.json

You can test your project locally from the command line as follows:
 cd sfk8s
 cds watch

You can build and deploy your project as follows or use a CI/CD pipeline:
 cd sfk8s
 make docker-push
 make helm-deploy

Before compiling the CAP project, let’s make sure we use nodejs 18 and latest versions of some of the SAP libraries, for instance:

package.json

{
  "name": "sfk8s",
  "version": "0.0.1",
  "repository": "<Add your repository here>",
  "license": "UNLICENSED",
  "description": "sfk8s",
  "engines": {
    "node": "^18"
  },
  "dependencies": {
    "@sap/cds": "^6.8",
    "@sap/audit-logging": "^5",

    "@sap-cloud-sdk/http-client": "latest",
    "@sap/xsenv": "latest",
    "@sap/xssec": "latest",

............

      ,
      "RCMCandidate": {
        "kind": "odata-v2",
        "model": "srv/external/RCMCandidate",
        "credentials": {
          "[production]": {
            "destination": "Quovadis-SAP",
            "path": "odata/v2"
          },
          "[development]": {
            "url": "https://sandbox.api.sap.com/successfactors/odata/v2"
          }
        }
      }
      ,
      "ECEmploymentInformation": {
        "kind": "odata-v2",
        "model": "srv/external/ECEmploymentInformation",
          "credentials": {
            "[production]": {
              "destination": "Quovadis-SAP",
              "path": "odata/v2"
            },
            "[development]": {
              "url": "https://sandbox.api.sap.com/successfactors/odata/v2"
            }
          }
        }
    }
  }
}

Time to build the project…

It may take several minutes to build, and may even take longer if this is the first time you are using the buildpacks…

$ cd sfk8s/
$ make docker-push
cds build --production
[cds] - the following build tasks will be executed
[cds] -    {
     "build": {
       "target": "gen",
       "tasks": [
         {"for":"nodejs", "src":"srv", "options":{"model":["srv","app","srv/external/RCMCandidate","srv/external/ECEmploymentInformation"]}}
       ]
     }
   }

[cds] - building project [/Users/<username>/.kube/sfk8s], clean [true]
[cds] - cds [6.8.1], compiler [3.9.2], home [/Users/<user name>/.kube/sfk8s/node_modules/@sap/cds]

[cds] - done > wrote output to:
   gen/srv/package-lock.json
   gen/srv/package.json
   gen/srv/srv/Dockerfile
   gen/srv/srv/catalog-service.js
   gen/srv/srv/csn.json
   gen/srv/srv/external/ECEmploymentInformation.edmx
   gen/srv/srv/external/RCMCandidate.edmx

[cds] - build completed in 1496 ms

pack build <docker_id>/<docker_repo>:sfk8s-srv -p gen/srv -B paketobuildpacks/builder:base
....................

📦gen
 ┗ 📂srv
 ┃ ┣ 📂srv
 ┃ ┃ ┣ 📂external
 ┃ ┃ ┃ ┣ 📜ECEmploymentInformation.edmx
 ┃ ┃ ┃ ┗ 📜RCMCandidate.edmx
 ┃ ┃ ┣ 📜Dockerfile
 ┃ ┃ ┣ 📜catalog-service.js
 ┃ ┃ ┗ 📜csn.json
 ┃ ┣ 📜package-lock.json
 ┃ ┗ 📜package.json

Eventually all the project artefacts have been built and pushed to the docker repository….

Let’s deploy it to kyma runtime environment:

📦helm
 ┣ 📂sfk8s-app
 ┃ ┣ 📂templates
 ┃ ┃ ┣ 📜NOTES.txt
 ┃ ┃ ┣ 📜_helpers.tpl
 ┃ ┃ ┣ 📜apirule.yaml
 ┃ ┃ ┣ 📜configmap.yaml
 ┃ ┃ ┣ 📜deployment.yaml
 ┃ ┃ ┗ 📜service.yaml
 ┃ ┣ 📜.helmignore
 ┃ ┣ 📜Chart.yaml
 ┃ ┗ 📜values.yaml
 ┗ 📂sfk8s-srv
 ┃ ┣ 📂templates
 ┃ ┃ ┣ 📜NOTES.txt
 ┃ ┃ ┣ 📜_helpers.tpl
 ┃ ┃ ┣ 📜apirule.yaml
 ┃ ┃ ┣ 📜binding-dest.yaml
 ┃ ┃ ┣ 📜binding-uaa.yaml
 ┃ ┃ ┣ 📜configmap.yaml
 ┃ ┃ ┣ 📜deployment.yaml
 ┃ ┃ ┣ 📜service-dest.yaml
 ┃ ┃ ┣ 📜service-uaa.yaml
 ┃ ┃ ┗ 📜service.yaml
 ┃ ┣ 📜.helmignore
 ┃ ┣ 📜Chart.yaml
 ┃ ┗ 📜values.yaml

$ make helm-deploy
helm upgrade -n team-kyma -i sfk8s-srv helm/sfk8s-srv --install --kubeconfig /Users/<username>/.kube/kubeconfig--team-kyma.yaml
Release "sfk8s-srv" does not exist. Installing it now.
NAME: sfk8s-srv
LAST DEPLOYED: *************
NAMESPACE: team-kyma
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Thank you for installing sfk8s-srv. Your release is named sfk8s-srv and was deployed to the namespace team-kyma.
helm upgrade -n team-kyma -i sfk8s-app helm/sfk8s-app --install --kubeconfig /Users/<username/>.kube/kubeconfig--team-kyma.yaml
Release "sfk8s-app" does not exist. Installing it now.
NAME: sfk8s-app
LAST DEPLOYED: *************
NAMESPACE: team-kyma
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Thank you for installing sfk8s-app. Your release is named sfk8s-app and was deployed to the namespace team-kyma.

As a result the following kyma cluster resources get created automatically:

and last but not least the API rules that allow to expose the frontend app and backend service to the public internet:

The access to app and srv is protected with the BTP SAP ID service. Please make sure to assign the sfk8s application role collection(s) to all business users who should be granted access to the application. This is done from a BTP sub-account cockpit or with btp cli.

Failure to do it will result in a Forbidden error message.

Now it’s time to run the frontend app:

Last but not least, the deployment clean-up:

$ make helm-undeploy

Troubleshooting SFSF ODATA API access

• SAP SuccessFactors Platform. Managing Permission Roles | SAP Help
• SAP SuccessFactors Platform. Troubleshooting users permissions | SAP Help

In order to be able to register a SFSF system with a BTP Global Account you must grant the admin user the following permissions:

• Admin access to MDF OData API
• Create Integration with SAP BTP

Permission Role List	Permission Role Detail
You need to pick a permission role (the one which your admin user has been assigned to) and make sure it has the required permissions	I have chosen a System Admin role as the sfadmin user has this role assigned
Create Integration with SAP BTP	Admin access to MDF OData API

The OData API Candidate Export role permission must be assigned to the business user that is about to call SAP SuccessFactors Recruiting ODATA API via a BTP destination:

more than words…

• Extending SAP Solutions Using Automated Configurations | SAP Help
• Extending SAP SuccessFactors in the Cloud Foundry and Kyma Environment | SAP Help
• SAP SuccessFactors Platform. Managing Permission Roles | SAP Help
• SAP SuccessFactors Platform. Troubleshooting users permissions | SAP Help
• Video tutorials

Video tutorials

• SAP BTP Kyma Runtime – Extending SAP SuccessFactors | Video Tutorial Series

__________

SAP Community: https://community.sap.com/

SAP Community Topic Page link: https://community.sap.com/topics/kyma

SAP Community Q&A Tags:
Kyma Open Source: https://answers.sap.com/tags/2936b97d-6a90-4cd8-b635-0e51441611eb
SAP BTP, Kyma runtime: https://answers.sap.com/tags/73554900100800003012

Follow me in SAP Community: Piotr Tesny