SAP SuccessFactors

Set up a dedicated SAP SuccessFactors user for this integration rather than using an administrator account. This limits the data Exclaimer can access. SAP SuccessFactors does not assign permissions to an OAuth2 client; instead, each API call runs under the linked user account and can only access data that the user is authorized to view.

Create a dedicated integration user

Create a user account in SuccessFactors dedicated to running this connection. Your SuccessFactors administrator can create the account using your organization's standard process. 

Create a permission group

Create a permission group for the integration user. This ensures the role you create in the next step applies only to the integration account.

1. In the search bar, enter Manage Permission Groups and open the page.
    
2. Select Create New.
    
3. In Group Name, enter a name that identifies the connection, such as Exclaimer Integration.
    
4. Set User Type to Employee.
    
5. Under Choose Group Members, add only the integration user (User ID) you created earlier.
    
6. Leave Exclude and Granted Permission Roles empty. You will assign the permission roles later.
    
7. Select Done.
   
   
   _{Example image showing the Permission Group screen.}

Create a permission role

Create a permission role that defines which data the integration user can access.

1. In the search bar, enter Manage Permission Roles and open the page.
    
2. Select Create.
    
3. Enter a role name that clearly identifies the connection, such as Exclaimer Integration Role.
    
4. Set User Type to Employee.
    
5. Select Permissions to open the full list of user and administrator permissions.
    
6. Select only the permissions required for your integration.

At a minimum, select:

• General User Permission → User Login. This allows the integration user to authenticate.
• Manage Integration Tools → the permission that provides OData API access.
  
  _{Example image showing the Add Permissions screen.}

Assign the role to the group

Assign the permission role to the group you created earlier in Create a permission group. This activates the role and determines which employee records the integration can access.

1. After saving the role, select Yes when prompted to continue to the role assignment. You can also assign the role later from Manage Permission Roles.
    
2. Enter a name for the assignment that clearly identifies its purpose, such as Exclaimer Integration Assignment.
    

3. Under Grant Access To, select From groups, then select the permission group you created in step Create a permission group.
    

   IMPORTANT! Do not leave this set to All. This grants the role to every employee in your SuccessFactors instance.
4. Under Define a Target Population, select Everyone to allow a full sync, or select a permission group to limit the sync to a specific subset of employees.
    
5. Save the assignment.

Verify the effective permissions

SuccessFactors permissions are additive. A user's effective access includes permissions from every role assigned to that user, including roles assigned to all employees in your instance. Verify the effective permissions now to ensure the integration user has only the intended access.

1. In the search bar, enter RBP Troubleshooting and open the page.
2. Enter the integration user in Access User 1 and select Search.
3. Review the roles shown in the results.

You should see only the role you created in Step Create a permission role. If additional roles appear, the integration user may be inheriting broader access from another assignment. Ask your SuccessFactors administrator to exclude the account from that assignment, or confirm whether additional access is required.

To find your API server:

1. Navigate to SAP SuccessFactors API server / data center reference page on the SAP Help Portal.

2. Locate the API server value that corresponds to your SAP SuccessFactors login domain.

   NOTE: The API server generally mirrors your login domain with an 'api' prefix. For example, a login domain such as 'https://salesdemo2.successfactors.com' corresponds to an API server beginning 'apisalesdemo2'.
   TIP! Record this value securely. This will be required for the integration.

To find your Company ID:

1. Select the initials icon in the header bar, select Show version information.
   
   
   _{Example image showing the Show version information option.} 
   
    

2. Locate the Company ID.
   
    
   _{Example image showing where to find the Company ID.}
   
   NOTE: The credentials in the screenshot are for example purposes only. Please extract your Company ID.

   TIP! Record the Company ID securely. It will be required for the integration. 

To confirm your username:

The username is the User ID you use to sign in to your SAP SuccessFactors dashboard. If you set up a scoped integration user (see Optional pre-requisites: Set up a scoped integration user), enter that account's User ID instead.

Exclaimer uses the permissions assigned to the account you enter. Using a scoped integration user therefore limits the employee data Exclaimer can access.

To register an OAuth2 Client Application:

1. In the search bar, enter Manage OAuth2 Client Applications.
    
2. Select Register Client Application.
   
   
   _{Example image showing the search bar. Select Register Client Application.}
    
3. In Application Name, enter a relevant name for the application.
    
4. In Application URL, enter your application URL.
    
   
   _{Enter the Application Name and Application URL.}
    
5. Select Generate X.509 Certificate.
    
6. In Common Name (CN), enter a common name for the certificate.
   
   
   _{Enter the Common Name (CN).}
    
7. Select Generate. 
   
   The X.509 Certificate field is populated automatically.
   
   
   _{Example image showing the X.509 Certificate.} 
    

8. Select Download to save the certificate file.
    

   TIP! Copy the private key securely. It is entered as the Client Secret when integrating with Exclaimer.  
   WARNING! Copy only the private key value from the downloaded certificate file. Do not include the header/footer lines.
   
   _{Example image showing the downloaded version.} 
    
9. Select Register to complete registration.

To get your Client ID:

1. In the Manage OAuth2 Client Applications, locate the application you registered and select View.
   
   
   _{Select the View option.}
    

2. Copy the value shown in the API Key.
   
   
   _{Example image showing the API Key.}
    

   TIP! Record the API Key securely. It is entered as the Client ID when integrating with Exclaimer.

To connect to your HRIS to allow Exclaimer to synchronize user contact details:

1. From the drop-down list, select SAP SuccessFactors.
   
   
   _{From the drop-down, select SAP SuccessFactors.}
    

2. Select Connect.

   An authorization window is displayed. 

   
   _{Example image in Exclaimer when trying to connect to the SAP SuccessFactors system.} 
    

3. Select Allow and Continue.
    

   WARNING! If the authorization window is not displayed, allowlist cdn.bindbee.dev (and preferably *.bindbee.dev) to ensure the Bindbee SDK loads correctly in the browser.
    
4. Enter your API Server, then select Continue.
   
   
   _{Example image in Exclaimer when trying to connect to the SAP SuccessFactors system. Enter your API Server.}
    
5. Enter your Company ID.
    
6. Enter your username.
   
   
   _{Example image in Exclaimer when trying to connect to the SAP SuccessFactors system. Enter your Company ID and username.}
    
7. Select Continue.
    
8. Enter your Client ID (API Key).
    
9. Enter your Client Secret (private key).
   
   
   _{Example image in Exclaimer when trying to connect to the SAP SuccessFactors system. Enter your Client ID and Client Secret.}
    

10. Select Connect to complete the integration between Exclaimer and SAP SuccessFactors using Bindbee.
     

    WARNING! Keep the window open until the connection is complete. If you close it too soon, the connection may not finish setting up, and it may not appear as connected in Exclaimer.

    If you try to connect to SAP SuccessFactors again, you may see a message saying that the connector already exists. If this happens, raise a support ticket so the team can assist you.
     

11. Once a connection is established, the status displays as Connected in Exclaimer.
    
    
    _{Once a connection is established with the SAP SuccessFactors system, the Connected text is displayed within Exclaimer.}

To re-connect to the SAP SuccessFactors system:

1. Select Re-connect. 
   
   
   _{Select Re-connect.}
   
   A message is displayed that reconnecting will remove your existing connection to SAP SuccessFactors, and any data will no longer be available, and a new connection flow will start automatically.
   
   
   _{Select OK to reconnect to the SAP SuccessFactors system.}
    
2. Select OK to continue.

To disconnect from the SAP SuccessFactors system:

1. Select Disconnect. This removes your connection and any synced data.
   
   _{Select Disconnect.} 
   
   A message is displayed that disconnecting will entirely remove your connection to SAP SuccessFactors, and any data from the system will no longer be available.
   
   
   _{Select OK to disconnect from the SAP SuccessFactors system.}
    
2. Select OK to continue.

SAP SuccessFactors connectors automatically synchronize data on a predefined schedule. 

To run a manual sync to immediately update employee data in Exclaimer:

1. Select Sync Now.
   
   
   _{Select Sync Now to start a manual sync.}

NOTE: The Sync Now button is enabled only after 6 hours since the last successful sync. The next sync date and time are displayed.

If the authorization window does not appear in Exclaimer:

• Ensure the following domains are allowlisted in your network or browser security tools: cdn.bindbee.dev, and *.bindbee.dev.
• Verify that browser extensions or content blockers are not preventing the page from loading.
• Refresh the browser and try again.

If the connection to SAP SuccessFactors fails during setup, verify that:

• The API server value matches your SAP SuccessFactors login domain.
• The Company ID is correct and copied from the Show Version Information screen.
• The username has permission to access the employee data required for the integration.
• The Client ID (API Key) and Client Secret (private key) are entered correctly, and the private key does not include the certificate header/footer lines.
• The registered OAuth2 Client Application has not been deleted or deactivated in SAP SuccessFactors.

If a scheduled or manual sync does not complete successfully:

• Confirm the connection still shows as Connected in Exclaimer.
• Verify the OAuth2 Client Application credentials have not expired or been revoked in SAP SuccessFactors.
• Check that the username used for the integration still has permission to access employee data.