Introduction

Configurations for IAS(Identity Authentication Service)  integration with SAP SuccessFactors is completed. In case you want to understand what steps are followed to do the configuration, kindly refer the blog post mentioned below:

Blog 1:IAS integration with SAP SuccessFactors Application – 0

Blog 2:IAS integration with SAP SuccessFactors Application – 1

Blog 3:IAS integration with SAP SuccessFactors Application – 2 (Sync users using Identity Provisioning Service(IPS))

Optional: To get better understanding about integration of IAS with SAP SuccessFactors(SF) application, please read the blogs mentioned below:

Blog 4:Why Identity authentication is required for SAP SuccessFactors Application

Blog 5:Identity Authentication Service(IAS) Configuration approach with SAP SuccessFactors Application

In this blog post we will discuss about Activation of the Configuration and will perform testing of different scenarios

Important

To activate the configuration – We will perform the second upgrade in upgrade center in SAP SF application

Once you activate the configuration – Activate SuccessFactors SAP Cloud Platform Identity Authentication Service Integration 

• All the requests will be by default redirected to IAS and as per the configurations performed in IAS – Users will authenticate in IAS or in different Corporate Identity Providers(in our scenario – Corporate IDP 1 -India region, or Azure AD)
• Once configuration is activated successfully, you can’t go back
• I strongly recommend not to perform the second upgrade if you haven’t performed the pre-requisites.

Lets get started !

Testing Scenario

We will test 3 scenarios for which we have performed the configuration:

• Password user
• SSO to Azure AD
• SSO to Corporate IDP 1 – India region

Continue Implementation Steps

Perform Second upgrade in upgrade center in SAP SuccessFactors application – Activate the integration between IAS and SAP SuccessFactors

Testing is a part of this upgrade and only when testing is successful, it will give you option to go-ahead with the upgrade.

• You can test only 1 scenario – and if its successful – it will give option to activate the configuration.
• You can cancel it on last screen and re-perform the same steps to test all the scenarios. Make sure not to activate the configuration once all scenarios are tested otherwise that scenario won’t work after activation and you will need to fix it after activation.

Testing 1: Password user scenario

• Login to SAP SF application
• Goto upgrade center and select platform
• Click on upgrade – Activate SuccessFactors SAP Cloud Platform Identity Authentication Service Integration 
• Click on upgrade now
• Click on Test Now
• It will redirect you to IAS screen – This screen exactly look like how users will see after activation is completed. Enter the Username or email address of user and click continue
  
• Enter the Password and continue
• Authentication Successful
• Click on Yes if you want to continue. You can click cancel and test other scenario

Testing Scenario 2: For Azure AD users

In this scenario –  mapping is enabled in IAS(option is enabled – USE IAS USER STORE) , Username and email address is different in SAP SF application

• Clear browser cookies and close the browser
• Login to SF and perform the upgrade again and click on test now.
• enter the email address of user (Azure AD user – [email protected])
• 
• It will redirect you to Azure AD screen – if you are already logged into your azure AD(in case you are in VPN) it will directly log you into SAP SF application. In case you are not logged into your Azure AD account. It will ask you for password
• 
• Authentication successful
• 
• Now you can activate the configuration by clicking on yes or cancel it to test the other scenario
• 

Testing Scenario 3: For Corporate IDP – India Region users

In this scenario –  mapping is no enabled in IAS, Username and email address are same in SAP SF application

• Clear browser cookies and close the browser
• Login to SF and perform the upgrade again and click on test now.
• enter the email address of user (Corporate IDP -India region user – [email protected])
• 
• User is redirected to Corporate IDP.
• 
• Authentication successful
• 
• Now you can activate the configuration by clicking on yes
• 
• Usually it don’t take more than 1 or 2 minutes to activate the configuration.

Post activation of the configuration – you can try all the testing scenarios again to be confirmed that everything is working as expected.

• All types of users are getting authenticated using only 1 URL
• For more information about the approach – please read –Identity Authentication Service(IAS) Configuration approach with SAP SuccessFactors Application
• Password users authenticate in IAS. This is successful means password migration and IPS user sync is working fine.
• SSO users authenticate in respective Corporate IDPs.

Frequent questions from Users

How to check the error in case testing fails?

You can install a google chrome extension called SAML tracer 

and then start capturing the trace while reproducing the issue. This can help you in troubleshooting.

What will happen in case upgrade failed? Will users be able to login?

In case upgrade failed – you can fix the issue and re-trigger it in next 30 days. till the time upgrade is not successfully completed. User will authenticate how they were getting authenticated earlier without any issues.

In this blog post you have learnt about the steps to be performed while activating the IAS integration with SAP SF and testing !

Please let me know your thoughts about the blogs in comment section.

Thank you !