---
sourceDocument: Yokohama Data and Automation
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/integrate-applications

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Data and Automation

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Set up the SuccessFactors spoke v4.x.x

# Set up the SuccessFactors spoke v4.x.x {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 9 minutes to read

Integrate the ServiceNow instance with your SuccessFactors instance using OAuth client application and API key.

## Before you begin

* Request an Integration Hub subscription.
* Activate the SuccessFactors spoke.
* Enable these system properties:
  * glide.pf.rest.response_payload_max_size: The maximum value is, <kbd class="ph userinput">10240</kbd>.
  * com.snc.process_flow.reporting.serialized.val_size_limit: The maximum value is, <kbd class="ph userinput">16384</kbd>.
  * com.glide.transform.json.max-partial-length: The maximum value is, <kbd class="ph userinput">65536</kbd>.
  {#setup-successfactors__ul_w1q_fzp_5lb}
* Role required: admin.

{#setup-successfactors__ul_a2t_p2s_wkb}  
Note:  
This procedure is applicable if you are setting up the SuccessFactors spoke v4.11.1 for the first time. If you are using an earlier version of the SuccessFactors spoke, see [Migrate to SuccessFactors spoke v4.11.1](https://www.servicenow.com/docs/hKLq_jWZPZFTNJg2awqPRQ "Migrate from an earlier version of the SuccessFactors spoke to SuccessFactors spoke v4.11.1 by selecting the credential records that are associated with the SuccessFactors spoke v4.11.1.") for the migration procedure.

For
more information about setting up the spoke, see [SAP SuccessFactors Spoke - OAuth Setup \&
Migration - Pre-Tokyo, Tokyo and beyond](https://www.servicenow.com/community/knowledge-managers/sap-successfactors-spoke-oauth-setup-amp-migration-pre-tokyo/ta-p/2468046) in [ServiceNow Community](https://www.servicenow.com/community/).

## Register OAuth client application in SuccessFactors {#ariaid-title2}

Enable client certificate authentication for the outbound communication
by generating the keystore.jks and
keystore.cer files.

### Before you begin

* Generate a valid JKS certificate. For information about creating a JKS certificate, see [Creating Java Keystore(JKS) with Private Key and Certificate Chain](https://help.sap.com/docs/SAP_Cloud_Platform_Master_Data_for_Business_Partners/246fb358c1c7413289c03b8c72734209/18f5bae37a664396b2ebbc1b3c384c53.html) in [SAP Help Portal](https://help.sap.com/docs/), or, do the steps.
  1. Use the command <kbd class="ph userinput">openssl genrsa -out private.key 2048</kbd> to generate the private.key file.
  2. Use the private.key to create x.509 certificate (.cer file) that contains your public key.Use the command <kbd class="ph userinput">openssl req -new -x509 -key private.key -out publickey.cer -days 365</kbd>

  {#cert-successfactors__ol_xz2_gp1_w2c}
* Convert the public and private key to a .p12 file.Use the command to do the above step <kbd class="ph userinput">openssl pkcs12 -export -in publickey.cer -inkey private.key -out successfactors.p12 -name "&lt;provide custom name&gt;".</kbd>

* Convert the .p12 file to .jksUse the command to do the above step <kbd class="ph userinput">keytool -importkeystore -srckeystore successfactors.p12 -srcstoretype pkcs12 -destkeystore successfactors.jks</kbd>.

* Role required: admin.
{#cert-successfactors__ul_sq2_ztg_dwb}

### Procedure

1. Log in to the SuccessFactors account as an admin.
2. Navigate to Admin Centre and click Company Settings.
3. Click Manage OAuth2 Client Applications.
4. Click Register Client Application.  
5. Provide the required details on the form.  
   In the X.509 Certificate field, provide contents of the cert.pem file (public key) without the headers.
6. Click Submit.  
   API Key is generated and displayed. Copy and record the value for later use.

## Upload the JKS certificate in your ServiceNow instance {#ariaid-title3}

Enable client certificate authentication for the outbound communication by uploading
the JKS certificate in your ServiceNow instance.

### Before you begin

Role required: admin

### Procedure

1. Log in to your ServiceNow instance as an admin.
2. Upload the JKS certificate to your ServiceNow instance.  
   For instructions to upload the JKS certificate, see [Upload a
   certificate to an instance](https://www.servicenow.com/docs/access?context=t_UploadACertificateToAnInstance&version=yokohama&pubname=yokohama-platform-security&ft:locale=en-US) .

## Register SuccessFactors as an OAuth provider {#ariaid-title4}

Use the API key generated during the client application configuration to register the
application as an OAuth provider.

### Before you begin

Role required: admin

### Procedure

1. In your ServiceNow instance, navigate to System OAuthApplication Registry.
2. Click New.
3. In the form, fill in these fields.  
   {#app-reg-successfactors__table_yb3_bwh_dwb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique name to identify the certificate. For example, <kbd class="ph userinput">SuccessFactors SAML</kbd>. |
   | Client ID | Value of the API key you had copied after registering the OAuth client application in SuccessFactors. |
   | Client Secret | Note: Client secret is not needed to register the application as an OAuth provider. You can provide any value for this field. |
   | OAuth API Script | Name of the OAuth API script. Search for `OAuthUtilSuccessFactors` and select it from the list. |
   | Default Grant Type | Default grant type used to establish the token. Select SAML2 Bearer. |
   | Token URL | SuccessFactors OAuth server endpoint URL that includes the Company ID in this format: <kbd class="ph userinput">https://&lt;SuccessFactors_Instance_Name&gt;/oauth/token?company_id=&lt;Company_ID&gt;</kbd>. For example, <kbd class="ph userinput">https://example.successfactors.eu/oauth/token?company_id=SFCPART123456</kbd>. |
   [ ]

   {#app-reg-successfactors__table_yb3_bwh_dwb}
4. Click Submit.

## Create the SAML2 assertion producer record {#ariaid-title5}

Create a SAML2 assertion record to generate the SAML2 assertion and exchange the
assertion for the access tokens with the provider.

### Before you begin

Role required: admin

### Procedure

1. Create a SAML2 assertion producer record in your ServiceNow instance.
   1. Navigate to AllSystem OAuthSAML2 Assertion Producers.
   2. Click New.
   3. On the form, fill these values.  
      {#conf-saml2-successfactors__table_fx3_ym3_dwb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Unique name to identify the SAML2 assertion producer record. For example, <kbd class="ph userinput">Successfactor SAML OAuth</kbd>. |
      | Issuer | Unique identifier for the assertion issuing entity. Provide the ServiceNow instance URL. |
      | Subject NameID | User name to log in to the SuccessFactors instance. For example, <kbd class="ph userinput">sfadmin</kbd>. |
      | Audience | Intended audience for the assertion. Enter the value, <kbd class="ph userinput">www.successfactors.com</kbd>. |
      | Recipient | Intended recipient for the assertion. Enter URL in this format, <kbd class="ph userinput">https://&lt;SuccessFactors-Instance-Name&gt;/oauth/token</kbd>. |
      [ ]

      {#conf-saml2-successfactors__table_fx3_ym3_dwb}
   4. Right-click the form header and click Save.
   5. Under the SAML2 Assertion Keystores tab, click New.
   6. On the form, fill these values.  
      {#conf-saml2-successfactors__table_zqv_kp3_dwb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Unique name to identify the SAML2 assertion keystore record. For example, <kbd class="ph userinput">sap_successfactor</kbd>. |
      | Signing Key Alias | Alias of key entry stored in the Keystore used to sign the assertion. For example, <kbd class="ph userinput">1</kbd>. |
      | Signing Key Password | Password of the key entry stored in the keystore used to sign the assertion. |
      | Signing Keystore | Required X.509 certificate record. Select the X.509 certificate record that you had earlier created. For more information, see [Upload the JKS certificate in your ServiceNow instance](https://www.servicenow.com/docs/3d7j1R8XSuo855Z0hsXxIA#successfactors-upload-cert "Enable client certificate authentication for the outbound communication by uploading the JKS certificate in your ServiceNow instance."). |
      [ ]

      {#conf-saml2-successfactors__table_zqv_kp3_dwb}
   7. Click Submit.
   8. Navigate to AllSystem OAuthSAML2 Assertion Producers.
   9. Open the SAML2 assertion producer record that you had created.  
      For example, Successfactor SAML OAuth.
   10. Under the SAML2 Assertion Attributes tab, click New.
   11. On the form, fill these values.  
       {#conf-saml2-successfactors__table_e2p_w1j_dwb__entry__2}

       | Field | Description |
       |-|-|
       | Name | Name to identify the SAML2 assertion attribute record. Enter <kbd class="ph userinput">api_key</kbd>. |
       | Type | Type of the Value field. Select String. |
       | Value | API key generated after the OAuth client application is created in SuccessFactors. |
       [ ]

       {#conf-saml2-successfactors__table_e2p_w1j_dwb}
   12. Click Submit.
   {#conf-saml2-successfactors__substeps_zx3_vm3_dwb}
2. Associate the SAML2 assertion producer with the application registry record.
   1. Navigate to System OAuthApplication Registry.
   2. Open the application registry record that you had created.  
      For example, SuccessFactors OAuth Reg. For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://www.servicenow.com/docs/3d7j1R8XSuo855Z0hsXxIA#app-reg-successfactors "Use the API key generated during the client application configuration to register the application as an OAuth provider.").
   3. Under the OAuth Entity Profiles tab, open the default OAuth entity profile record.  
      For example, Successfactor SAML default_profile.
   4. For the Assertion Producer field, select the SAML2 assertion producer record you had created.  
      For example, Successfactor SAML OAuth.
   5. Click Update.
   {#conf-saml2-successfactors__substeps_y1k_y2j_dwb}

## Create Credential record for the OData API {#ariaid-title6}

Create Credential record for the OData APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the
OData API.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsCredentials.
2. Click New.  
   The system displays the message What type of Credentials would you like to create?.
3. Select OAuth 2.0 Credentials.  
   An empty OAuth 2.0 Credentials form is displayed.
4. On the form, fill these values.  
   {#create-cred-sfsap-rest__table_twl_mk2_5kb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Name to uniquely identify the record. For example, enter <kbd class="ph userinput">SAML_SuccessFactors_OData_Cred</kbd>. |
   | OAuth Entity Profile | OAuth entity profile record that is associated with the OAuth application registry you had created. For example, <kbd class="ph userinput">Successfactor SAML default_profile</kbd>. For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://www.servicenow.com/docs/3d7j1R8XSuo855Z0hsXxIA#app-reg-successfactors "Use the API key generated during the client application configuration to register the application as an OAuth provider."). |
   | Active | Option to actively use the credential record. |
   | Order | Order to apply this credential. For example, enter <kbd class="ph userinput">100</kbd>. |
   [ ]

   {#create-cred-sfsap-rest__table_twl_mk2_5kb}
5. Click Submit.

### Result

The credential record to authorize actions using the OData API is created.

## Create Credential record for the SOAP API {#ariaid-title7}

Create Credential record for the SOAP APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the
SOAP APIs.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsCredentials.
2. Click New.  
   The system displays the message What type of Credentials would you like to create?.
3. Select OAuth 2.0 Credentials.  
   An empty OAuth 2.0 Credentials form is displayed.
4. On the form, fill these values.  
   {#create-cred-sfsap-odata__table_twl_mk2_5kb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Name to uniquely identify the record. For example, enter <kbd class="ph userinput">SAML_SuccessFactors_SOAP_Cred</kbd>. |
   | OAuth Entity Profile | OAuth entity profile record associated with the OAuth application registry you had created. For example, <kbd class="ph userinput">Successfactor SAML default_profile</kbd>. For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://www.servicenow.com/docs/3d7j1R8XSuo855Z0hsXxIA#app-reg-successfactors "Use the API key generated during the client application configuration to register the application as an OAuth provider."). |
   | Active | Option to actively use the credential record. |
   | Order | Order to apply this credential. For example, enter <kbd class="ph userinput">100</kbd>. |
   [ ]

   {#create-cred-sfsap-odata__table_twl_mk2_5kb}
5. Click Submit.
{#create-cred-sfsap-odata__steps_lxz_nlt_wkb}

### Result

The credential record to authorize actions using the SOAP API is created.

## Create Connection record for the OData API {#ariaid-title8}

Create a Connection record for the OData API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsConnection \& Credential Aliases.
2. Open for the record for SuccessFactors OData.  
   For example, SuccessFactors_OData.
3. From the Connections tab, click New.  
   The system displays an empty HTTP(s) Connection form.
4. On the form, fill these values.  
   {#create-conn-sf-rest__table_ol3_3nt_wkb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name to uniquely identify the record. For example, <kbd class="ph userinput">SAML_SuccessFactors_OData_Conn</kbd>. |
   | Credential | Credential record you created for the REST API. For example, <kbd class="ph userinput">SAML_SuccessFactors_OData_Cred</kbd>. |
   | Connection URL | SuccessFactors service root URL in this format: <kbd class="ph userinput">https://&lt;SuccessFactors_Instance_Name&gt;/odata/v2</kbd>. For example, <kbd class="ph userinput">https://example.successfactors.eu/odata/v2</kbd>. Note: If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server. |
   | Active | Option to actively use the connection record. |
   [Table 1. HTTP(s) Connection form]

   {#create-conn-sf-rest__table_ol3_3nt_wkb}
5. Click Submit.

### Result

The connection record for the REST API in SuccessFactors is created.

## Create Connection record for the SOAP API {#ariaid-title9}

Create a Connection record for the SOAP API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsConnection \& Credential Aliases.
2. Open for the record for SuccessFactors SOAP API.  
   For example, SuccessFactors_Comp_Emp.
3. From the Connections tab, click New.  
   The system displays an empty HTTP(s) Connection form.
4. On the form, fill these values.  
   {#create-conn-sapsf-soap__table_ol3_3nt_wkb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name to uniquely identify the record. For example, <kbd class="ph userinput">SAML_SuccessFactors_SOAP_Conn</kbd>. |
   | Credential | Credential record you created for the SOAP API. For example, <kbd class="ph userinput">SAML_SuccessFactors_SOAP_Cred</kbd>. |
   | Connection URL | SuccessFactors connection URL. For example, <kbd class="ph userinput">https://&lt;SuccessFactors_Instance_Name&gt;/sfapi/v1/soap</kbd>. For example, <kbd class="ph userinput">https://example.successfactors.eu/sfapi/v1/soap</kbd>. Note: If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server. |
   | Active | Option to actively use the connection record. |
   [Table 2. HTTP(s) Connection form]

   {#create-conn-sapsf-soap__table_ol3_3nt_wkb}
5. In the Attributes tab, provide these fields.  
   {#create-conn-sapsf-soap__table_lyn_wtt_wkb__entry__2}

   | Field | Description |
   |-|-|
   | Company Id | Immutable Company ID of your SuccessFactors instance. |
   | Flow Timeout (seconds) | Maximum time in seconds up to which data can be received from SuccessFactors during the flow execution. If the time taken to retrieve data from SuccessFactors exceeds the timeout duration, the flow or subflow is cancelled. Default value is, <kbd class="ph userinput">30</kbd>. |
   [ ]

   {#create-conn-sapsf-soap__table_lyn_wtt_wkb}
6. Click Submit.
{#create-conn-sapsf-soap__steps_mmz_ftt_wkb}

### Result

The connection record for the SOAP API in SuccessFactors is created.

## Synchronize data between SuccessFactors and ServiceNow {#ariaid-title10}

Customise the sample flows as per your requirement to synchronize data between your
SuccessFactors and ServiceNow instances.

### Todo entity

The SuccessFactors spoke provides sample flows to synchronize data bi-directionally for the todo
entity. The sample flow, Run SuccessFactors Integration Flow can customised to
retrieve data from SuccessFactors, while the Create Todo and Update Todo flows creates or updates the todo records
in SuccessFactors when events occur in ServiceNow. While customising the
sample flows, ensure that you provide appropriate triggers to retrieve and save
future updates using transform maps.

### Other default entities

For these entities, the sample flow, Run SuccessFactors Integration Flow, can be customised to retrieve data from SuccessFactors:

* Department
* Location
* Job Profile
* Workers Profile
* Effective Workers Profile
* Job History Including Secondary Assignments
{#sync-data-sapsf__ul_q5q_qvp_5lb}

To create or update records in SuccessFactors for these entities when events occur in ServiceNow:  
* Create flows or subflows as per your choice or customise the sample flows and subflows.
* Use Metadata Retrieval and Record Management actions in your flows.
* Ensure that you provide appropriate triggers to retrieve and save future updates using transform maps.
{#sync-data-sapsf__ul_ih1_w1y_nsb}

### Other SuccessFactors entities

Depending on the SuccessFactors permissions and configurations, you can also synchronize data of other entities
as per your requirement.

*[\>]: and then