Apurva16
ServiceNow Employee
ServiceNow Employee

Hello All,

I recently implemented the SuccessFactors spoke and would like to share my findings and knowledge with you as very little information is available out there.

I have tried to be descriptive so please be patient with the length of the article.

 

Installation:

You need an Integration Hub subscription to install the spoke, please check if the spoke is part of your subscription or not.

Before you set up the credentials, please ensure to check docs.servicenow.com for the dependencies. Some of the properties might not exist in the system and needs to be manually created. 

 

Credentials setup:

Once the dependencies are done and the plugin(s) has been installed, you would be able to see the spoke in the flow designer.

As of the time of creating the article, the spoke only supports Basic authentication.

You can set up the credentials in two ways:

  1. Going to Connections and Credentials -> Connection & Credential Aliases -> SuccessFactors_Comp_Emp, SuccessFactors_OData
  2. Flow Designer -> Connections -> SuccessFactors_Comp_Emp, SuccessFactors_OData

You can also set up the SFTP credentials if needed.

 

Please remember to follow the format of credentials:

For OData: 

Username: <username>@<SAP-SuccessFactors-CompanyID>. e.g. apiadmin@servicenowT1

Password: The SuccessFactors password

For URL: please ensure to provide the API URL and not the login URL of the customer. You can refer to: https://userapps.support.sap.com/sap/support/knowledge/en/2215682

For CompEmp:

You will need to create credentials in Connections & Credentials, the username and password will be the same as that of the login in SuccessFactors.

 

Flow and Sub-Flow setup:

The flow and sub-flows that come from OOTB are read-only. You need to make a copy and make changes if you need to do any customizations. I'd recommend sticking to a naming convention to make it easier to track the custom changes.

The "Run SuccessFactors Integration Flow" is the flow that "pulls" the data from SuccessFactors to ServiceNow. The other two flows are to push To-Do data from ServiceNow to SuccessFactors.

Data Pull from SuccessFactors (SF) to ServiceNow (SN):

The "Run SuccessFactors Integration Flow" is the flow that "pulls" the data from SuccessFactors to ServiceNow. 

The flow pulls the below data OOTB:

  • Department
  • Location
  • Job Profile (Job classification in SF)
  • Worker profile
  • Job History Including Secondary Assignments - This sub-flow is only in the spoke and not available in the OOTB HR Integration (Legacy)
  • To-Do

 

Staging tables and actual SN tables:

The spoke pulls the data from SF and puts them only in a staging table, it does not touch the SN tables.

In the backend, navigate to SuccessFactors Spoke and you can find the staging tables: 

find_real_file.png

For department and location, the OOTB transform map can work directly if you didn't make any changes to the respective SN tables.

However, for the rest, the OOTB transform map only sends the data to another custom table, so you need to deactivate it and make your own transform map. You can use the OOTB transform map as a reference.

Ensure that you are marking the coalesce fields. Some of the fields might require you to make a script to make it work if the format in SF and SN are different.

find_real_file.png

 

I suggest testing the connection and pulling the data before making the new transform map to ensure that the right data is being pulled from SF.

 

Issues noted in the OOTB spoke:

At the time of writing this article, I noted some issues in the system and you might have to make modifications due to them.

Sub-flow to pull the worker and job info data:

  • The sub-flow has the determine uniqueness marked, what this does is that only new user records are updated and any update on an existing user record is not transformed if the staging table still has the record of that user on it.
    • To fix it, remove the determines uniqueness from the sub-flow (you will need to copy the sub-flow and update the reference to it in any other flow/sub-flows that call it.

find_real_file.png

  • The job history and secondary job sub-flow pull the primary and secondary job information, however, it does not mark the primary and secondary jobs correctly. I had a case opened with the support team for this. You also might have to script the primary position on the HR profile as the spoke does not provide a script for this.

 

Pull To-Dos:

The flow that pulls the user and Org data also pulls the To-dos. You will need to create your own transform map (target table: Pulled To-do [sn_hr_integrations_todo_inbound])

A few of the pulled to-dos were not having the SF URL in them, I had opened a case for this issue too.

Push To-Do:

The OOTB provides a staging table for the spoke to take the To-dos from SN and push them to SF. However, you will need to write Business Rules/Flows to populate the staging table based on your requirements.

Eg. you might make a flow to populate the staging table with the approval and HR task type to-do. Please note, for the URL: you might want to simply re-direct to the Employee Center To-do page. Individual to-do won't be possible.

You can use the OOTB transform map.

 

Guidance for the custom transform maps:

 ObjectSource TableTarget Table
Job ProfileSuccessFactors Job Profile Staging Table [sn_successfactors_job_profile]Job Profile [sn_hr_core_job_profile]
Worker profileSuccessFactors Worker Profiles Staging Table [sn_successfactors_worker_profiles]HR Profile [sn_hr_core_profile]
Job HistorySuccessFactors Employee Job Information and History Staging Table [sn_successfactors_employee_job_information_and_history]Job [sn_hr_core_job]
Inbound To-DoSuccessFactors Inbound Todos Staging Table [sn_successfactors_inbound_todos]Pulled To-do [sn_hr_integrations_todo_inbound]

 

Further Actions:

You can use the OOTB actions in the spoke to expand the integration between the two systems.

You can fetch more data such as the time-off details of the employee and create a conversation in the Virtual Agent/Utilize this in the HR services.

However, please note that only the action is available (the API pulls the data) you will still need to create the conversations/HR Services and the flow to carry out the actions.

find_real_file.png

 

I hope that this article helps you with the implementation of the spoke. It does bring out more capabilities compared to the legacy integration and could go a long way to improve the data sync and employee experience.

Comments
Seema Hegde
ServiceNow Employee
ServiceNow Employee

This is a great write up and resource! 

 

An additional note on the credentials setup for spoke v4.x.x - do not use the auto-generated pem file from SuccessFactors. This format will not work. Additionally the private key generated is encrypted, preventing adding it to a key store.

 

  • The client's security team needs to provide a self-signed certificate and corresponding private key.
    • Add this certificate to X.509 certificate section when registering the OAuth client in SuccessFactors.
    • They should generate a corresponding java key store (.jks) file with the certificate and private key. This is the file that the ServiceNow admin will need to setup the X.509 certificate record in ServiceNow.
      • Note the key store password and alias as it will be required later in ServiceNow to create the X.509 certificate record, and the SAML2 Assertion Key store records, along with the API key.
Mohith Devatte
Tera Sage
Tera Sage

@Seema Hegde I was facing the same issue thanks for adding this info.

 

I also wanted to check if you faced any error called "Assertion missing in OAuth request" and "Missing required parameters:access_token"

 

I think my SAML assertion producer is not generating the assertion properly which is the request parameter in OAuth request and may be because of that assertion miss its not generating the access token which is throwing an error saying missing access token 

 

Please let me know if you faced this issue 

Thanks

Mohith Devatte

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@Mohith Devatte I think I recall seeing an error message about access token at one point. But ultimately the issue was my Key store, and making sure that I had the right key store password and alias.

Double-check your SAML2 assertion keystore and attribute:

  • Make sure in your assertion keystore you have the correct keystore alias and password. The password should match the one you have on the X.509 keystore (I got errors when I had a mismatch)
  • Make sure your API key in the assertion attribute is the same as the client ID in your application registry.

 

Alexander Versh
Tera Expert

Could you, please, explain how to use SF webhook and Intelligent Services Center?

Niharika Sood
Tera Explorer

@Seema Hegde I am trying to connect SuccessFactors using the spoke, but getting the following error when I try to get OAuth token:
"OAuth flow failed. Verify the configurations and try again. Error detail:invalid_request, Missing parameters: access_token"
Could you please suggest how to resolve this. Thank you!

Vibhuti4
Tera Contributor

@Mohith Devatte Were you able to get around the "Assertion missing in OAuth request" and "Missing required parameters:access_token" issue. We seem to be encountering the same error.

Mohith Devatte
Tera Sage
Tera Sage

@Vibhuti4 we were able to solve the issue by generating a new JKS certificate with the help of our certificate team.

 

As far as I know Assertion is the mandatory key  which will passed to Success factor as a parameter in order to get the OAuth token.

When this assertion key is passed to Success factors correctly, it will return us access token which will be valid for next 24 hours .So the issue  was we did not have a correct certificate generated from open SSL and once we generated correct set of certs with the help of our certificate team and validated the certificate , Assertion producer which is tagged to credentials started working properly and assertion key was produced correctly which in return gave us the access token.

 

Please verify the certs once and try .That will definitely solve the issue .

 

 

Thanks,

Mohith Devatte

Subramanyam V
Giga Expert

@Mohith Devatte ,

 

We are also facing the same issue - We got .pem file from SuccessFactors, which has couple of encrypted info -

key and end user certificate.

We sent the .pem file to certificate authority team - and got .jks and .cer files;

 

In the SN configuration setup - I didn't find where the .cer file will be used; 

After following the setup steps - and clicking on "Get OAuth Token" at credentials 

 

Getting the error -

OAuth flow failed. Verify the configurations and try again. Error detail:invalid_request, Missing parameters: access_token
 
 

In the logs :

Signing key is not found for the assertion keystore with sys_id: xxxxxx com.snc.platform.security.oauth.saml2.SAML2AssertionException: Signing key is not found for the assertion keystore with sys_id: xxxxxxx

Seema Hegde
ServiceNow Employee
ServiceNow Employee

For everyone's reference, here are the steps I took to configure connectivity once I received the .jks file from the Successfactors side.

 

  • In the filter navigator, under System Definition -> Certificates, create a new record .
    • Format: PEM, Type: Java. Key Store
    • Attach the provided java key store file to the record.
    • Validate the store
  • In the filter navigator, under  System OAuth > Application Registry, create a new record "SuccessFactors OAuth Reg"
    • Add the provided API key as Client ID and set the token URL
  • In the filter navigator, under  System OAuth > SAML2 Assertion Producers, create a new record "Successfactor SAML OAuth"
    • Set the Subject Name ID to the provided user account in SuccessFactors.
    • Under the SAML2 Assertion Keystores tab, create a new record and set the X.509 Keystore, keystore password, and keystore alias
  • In the filter navigator, under  Connections & Credentials > Credentials, create Credential record for the OData API
    • Name: SAML_SuccessFactors_OData_Cred, Type: OAuth 2.0
    • Set OAuth entity profile to record that is associated with the OAuth application registry created
  • In the filter navigator, under  Connections & Credentials > Credentials, created Credential record for the SOAP API
    • Name: SAML_SuccessFactors_SOAP_Cred, Type: OAuth 2.0
    • Set OAuth entity profile to record that is associated with the OAuth application registry created
  • In the filter navigator, under  Connections & Credentials > Connection & Credential Aliases, update the stub connection record for the OData API "SuccessFactors_OData"
    • Add the related connection record "SAML_SuccessFactors_OData_Conn"
    • Set the credential to the previously created record
    • Set the Connection URL to the successfactors Data API (check with your Successfactors admin)
  • In the filter navigator, under  Connections & Credentials > Connection & Credential Aliases, update the stub connection record for the SOAP API "SuccessFactors_Comp_Emp"
    • Add the related connection record "SAML_SuccessFactors_SOAP_Conn"
    • Set the credential to the previously created record
    • Set the Connection URL to the Compound Employee SOAP API (check with your Successfactors admin)
    • Set the attribute Company ID

 

Now you can test. Don't use the "Get Access Token" related link. Instead, go to flow designer, and search for the action "Login to Successfactors". Run that to test connectivity.

 

I hope this helps.

Anantha Gowrara
Kilo Sage

Hi All,

 

This is great Post, BTW did anyone tried using SAP CPI to connect to sucessfactor.If yes, please provide me details regarding the same.Thank you in advance

anandpara_s
Tera Contributor

Great post Apurva, thanks a lot for your kindness to share your real time experience and challenges / issues. Also thank you Seema for adding more details around the issues commonly faced while implementing the spoke. I am not yet implementing this so can't realize the issues wrt assertion and certificates etc, but surely i can imagine it would be super helpful when I do it hands-on.

 

I have another question though - 

 

Which system is considered as right system to trigger the lifecycle events.? SuccessFactors or ServiceNow.?

 

is it different for different events, like Onboarding, Crossboarding (Transfers/ promotions etc) and Offboarding..

or is there some best practice to have just one system for all three.? 

or does it depend on system which is the source of truth.. 

or would that be based on the system that will be used to initiate and complete the activities involved as part of the event.. 

 

We have a requirement for Onboarding to trigger from SuccessFactors, but crossboarding and offboarding from ServiceNow, but what I understand is that - its not common / standard to initiate Crossboarding from ServiceNow because usually it is initiated from SuccessFactors and data flows through to ServiceNow.

 

Could you please share any information around this. Thanks.!

 

Regards,

Sagar

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@anandpara_s  - there is no right or wrong way here. It depends on each company's preference on data updates to the HCM. If Onboarding is initiated on the ServiceNow portal, then data is pushed to HCM. It'll be similar for cross boarding. You will need to set up bi-directional integration, and evaluate the processes between systems to maintain data integrity and avoid overwriting.

Pablo Sanz
Tera Guru

I have some questions, if you can help me to solve them I would appreciate it, it is related to custom fields in SuccessFactor, what would be the recommendation to follow?

 

For example, in the flows and subflows that get Locations, departments, do we have to make changes in these flows?

 

Where are these custom fields stored once we get the data?

 

In case the custom fields are created automatically in the stagging tables, how can we change the transform map? To correctly map the new fields?

 

In which other parts of the platform do we have to make modifications related to the customs fields?

 

 

Apurva16
ServiceNow Employee
ServiceNow Employee

@Pablo Sanz ,

 

If you want to bring custom fields from SucessFactors to ServiceNow then you will need to modify the action, and subflow so that you can bring those data.

You will also need to modify the staging table and the destination table to house the data that you are fetching from SF and ofcourse the transform maps.

 

Essentiatelly even if there is a 1 field needed which is not OOTB, you will have a cascading effect and will have to modify many tables and flow components.

 

I hope this helped.

ankur40
Tera Contributor

@Apurva16 

Hi Apurva,

We are fetching data from successfactors and transforming that data into ServiceNow(HR Profile table).

While running the complete load, we are getting below error. We are using Successfactors Spoke and copied one of the data stream action(Retrieve Job Profiles) which is available OOB. There are around 55k records that needs to be updated in ServiceNow.

Could you please share any information around this. Thanks.!

ankur40_0-1722856262069.png

 

Regards,

Ankur

 

Apurva16
ServiceNow Employee
ServiceNow Employee

Hi @ankur40 ,

 

Please see my other article "https://www.servicenow.com/community/hrsd-articles/overcoming-integration-challenges-with-successfac... where we faced similar issue and the solution for it.

best1
Tera Contributor

Hi @Apurva16 

We are also configuring the SuccessFactors Integration with SuccessFactors Spoke, Can you please help me on Signing Key Alias and Signing Key Password. These details will get from SuccessFactors team? 

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@best1  yes, the certificate team should provide this along with the java keystroke (.jks) file.

KCH1
Tera Contributor

A basic question, but I would just like to confirm one thing. I was looking at the documents provided by ServiceNow for the SuccessFactors spoke, but could not find it written that when a new account is created in SuccessFactors, this will automatically create a new account in ServiceNow. I am hoping this is the case, but is my understanding correct on this?

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@KCH1 - It isn't necessarily automatic. You'll need to check your transform map configurations. When the spoke fetches the data from SF, it's pushed automatically to the staging (import set) table. From here, you can either set your transform maps to create new users, update new users, or neither, and only create/update the HR Profiles as needed.

KCH1
Tera Contributor

@Seema Hegde Ah, I see. Thank you.

best1
Tera Contributor

Hi @Seema Hegde 

while we are running the action from flow designer "Login into SuccessFactors", getting the below error.

Error: Login failure due to the invalid company!

Can you please review and help me to fix this issue/error?

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@best1 - Check the "Company_ID" attribute in your SuccessFactors_Comp_Emp connection record. This should match the company id of the SuccessFactors instance that you're trying to connect to.

best1
Tera Contributor

Hi @Seema Hegde 
Able to retrieve full data from SuccessFactors by clicking "Retrieve All Data"  check box but how delta load will execute?  "Retrieve Job Histories Modified From", Is the date will automatically update by system? Can you help me on this scenario

Seema Hegde
ServiceNow Employee
ServiceNow Employee

@best1 after the initial full load, you need to un-check the "Retrieve delta data" flag in the "Run success factors integration" flow. Then the triggered list of sub flows and actions checks the last run date of the corresponding subflow (retrieve_worker_profiles, retrieve_departments etc) and sets that as the value for the "modified from" input for the delta data.

Ramesh2
Tera Guru

If you are looking to integrate Successfactors for HRSD, check the plugin HSRD Integration with Successfactors as well.

 

Please reference the below post.

https://www.servicenow.com/community/hrsd-forum/hrsd-successfactors-spoke/m-p/2817453

Jishnu Jayakris
Tera Contributor

Hi @Apurva16 

 

How to ensure that the requestor in the SuccessFactors leave request reflects the actual user who is making the request, rather than using the service account, we need to pass the current user's context in the API call from ServiceNow to SuccessFactors. The current integration setup likely uses a service account, which may not be ideal for capturing the individual user's information in SuccessFactors.

 

please find the architectural diagram

 

JishnuJayakris_0-1737376676181.png

 

Apurva16
ServiceNow Employee
ServiceNow Employee

@Jishnu Jayakris per my understanding as of now only the admin user (system user) can be used to send the API queries. You need to pass the requester's User/person ID in the query to ensure that SF is updating the correct account

ClareH
Tera Explorer

Can anyone help? 

 

We have an integration between ServiceNow and Success Factors using the Spoke. The aim is to a set of information from about users in an XML payload that can then be processed into user records in ServiceNow.

This is initiated by ServiceNow sending a query to Success Factors via SOAP, for example here is the latest query:

<urn:queryString>SELECT

                person

                ,personal_information

                ,address_information 

                ,email_information 

                ,phone_information 

                ,employment_information

                ,job_information 

                from CompoundEmployee 

                where last_modified_on >= to_DateTime('2025-05-22T10:30:00Z')

                and

                isContingentWorker IN ('true','false')

                and

                fromDate = to_date('2025-02-22', 'yyyy-MM-dd')

   and 

       toDate = to_date('2026-05-22', 'yyyy-MM-dd') 

            </urn:queryString>

 

The issues we have encountered so far on are journey are:

 

  • First we had a query that pulled back recently updated records, this didn't work because for inactive users, that have a start date in the future, we did not get the essential personal and job information.
  • To overcome that issue, we have added the fromDate/toDate parameters to the query, which means we now get the missing information, but it ignores the last_modified_on parameter, so we get all records in that date range. Not just the deltas.

 

So the question remains, what query can we send to SF that does the following:

  • Get a user's full details including personal and job information
  • Get this data for users with a start date in the future (so are inactive)
  • Limit the results to only those that have changed recently. (so respects the last_modified_on parameter)

 

What we are ideally looking for is to write a query that achieves the above, in a format similar to the current query, that we can use to update the current 'deltaquery' being sent by ServiceNow.

Janet7
Tera Contributor

Hello, @Apurva16 !
Awesome post and explanation! Already helped a lot!

However a question arises - how did you manage to trigger the Transform map?
I made a copy, activated - no auto transform. Created a data source with the Data Stream Action as well as a source and the first staging table as source. When I try to test the data source - it is kind of rewriting the staging table and gives error that the coalesce field has no value which is not true. But if you have managed to make it work without data source in a first place I would love to know how.

Thank in advance!

JigyasaAror
Tera Contributor

 @Apurva16 : After following all the steps mentioned in https://www.servicenow.com/docs/bundle/yokohama-it-asset-management/page/product/software-asset-mana...

The Oauth token flow for both oData and soap are successfully completed. But while running the retrieve workers subflow to test if data can be pulled from successfactor or not we are getting the following error

JigyasaAror_0-1751850740055.png

what could be the possible issue here, could this be because of the incorrect role based permissions given to the user in successfactors?

Ivan Flores
Tera Expert

@Apurva16 I'm having this problem. The problem is in the "Login into SuccessFactors" subflow. The configuration is done according to the step-by-step ServiceNow documentation, and the credentials are correct. However, these errors occur, and when the action runs a soap test, it returns a 504 error.

 

evidence 02.jpgevidence 01.jpg

IvanFlores_0-1756499090643.png

Can you help me, please., with your comments o recommendation.

 

@JigyasaArorwere you able to solve that problem?

 

regards.

Michal Sereda
Tera Contributor

Hi Everyone,

Having a problem making an oath set up for successfactors.

the client send us the certificate in PEm format, but SNOW requires the jks format.

Is there a quick way to convert the pem file into a jks? Client is not proviiding the jks certificate and asks us to convert ourselves.

Version history
Last update:
‎07-18-2022 05:46 AM
Updated by: