Name: SAP SuccessFactors Integration - Creating API User Roles and Permissions
Uploaded: 2023-9-7
Duration: 448 s

Share feedback

<p>Planned maintenance of Practice Systems</p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Subscribe now

Learn more

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div>In this video series we are taking a look at the configuration settings to allow custom Background Check vendors within SAP SuccessFactors Recruiting module.  In this first step, we will take a look at establishing the appropriate User roles and permissions for Background Check integration set up and processing.<br><br>For more information on SAP SuccessFactors, please visit: <a href="http://www.successfactors.com" rel="nofollow noopener noreferrer" target="_blank">http://www.successfactors.com</a><br>For more information on Partnering with SAP, please visit: www.sap.com › partner › become<br><br>Please note:<br>                     This video was originally published on the SAP HANA Academy YouTube Channel                      and therefore may contain references to SAP HANA Academy and YouTube.                      The tech world is always evolving and the SAP HANA Academy YouTube channel                      is set to close on December 31, 2023.                      At that time, references will no longer be valid                      and will gradually be removed when the videos are updated.<br>Also, this video includes automatically generated captions                      and therefore might misrepresent the spoken content or display incorrect product names.</div></div>

SAP SuccessFactors Integration - Creating API User Roles and Permissions

Hi, and welcome to this video series covering partner integration scenarios using APIs for SAP SuccessFactors. In this video, we'll assign our API user the correct roles and permissions needed. If we go back to our admin center, we're still logged in as our admin user. And under tools, we're going to search for manage permission groups. We'll go ahead and click on that. And let's create a new group and let's call it temp API group. And next we want to add a people pool. And from our category list, let's scroll all the way down and choose user name. And then look for our new user, the SF API 2. Go ahead and select that and click Done. And so now we have our group, and let's go make our role. We go back to the Admin Center. And this time in our Tools, we're going to use Manage Permission Roles. Now I already have this as a favorite, or I could type it into the search box like I did before. And once again, we're going to create New. And let's go ahead and give our role a name. My name will just call it temp API permission. And next we want to grant the permission. So what we're going to look for is under the admin permissions. We're going to look for the manage integration tools. And we'll go ahead and click on that. And in that, we see the allow admin to access OData API through basic authentication. So we're going to go ahead and click that and click Done. And the next thing to do now will be to grant this role to our group. So we'll go ahead and click Add. We'll search for our group, our Tempa API group. We'll go ahead and select that and click done and click done again. Now we've associated the role of temp API permission to our temp API group. If I wanted to add another, I could simply click the add button. Or I might choose to save the changes that I've made so far. Then we could always go back in and open up that permission rule again to make modifications or add additional groups. Let's add our original SF API group as well. So we'll search SSO API, select it, click done, and done again. OK, there's a couple other permissions that we want to add here that are common for all partners. Now the first one we're going to add is under General User Permission, and it's User Login. And then we want to scroll down and we're also going to pick the SF API user login as well. We'll click done. And then we want to look for, next we want to look for the metadata framework, which is under our admin roles again. Here we go. And then here we're going to select all and click done. Next, we're going to go to the intelligence service tools and select all as well. And under our manage integration tools. And we want to make sure that we have access to the integration center as well. But realistically, this temporary API user, we can just add all the different permissions that allows us to get to the audit logs, etc. So we'll just do that for now because it's our temp user. And of course, after we've added all these permissions, we can go ahead and save our changes. Then there's a couple areas that might be specific to your scenario. So if you're going to use APIs in the recruiting module for let's say, assessment or background checks, then we might want to go into the recruiting permissions and make sure that all of the various OData API permissions are granted. And then if we were doing a background check, then we would want to make sure that we also included the background check permissions as well. And for that scenario, we also want to make sure that in the integration tools, we have the allow users to execute application UI or event-based integrations, which we already updated earlier. In the Employee Central area, for Employee Central API, we want to make sure that we have the API NO data added. And then also in the employee data, the employee central effective date, and the compensation integration, we may also want to have the view and edit capabilities, depending on what information or data you're getting at in your integration scenario. And save our changes. Okay, one last step that we might want to add is if we go back to the admin center, we have the ability to do a login policy and password reset rules. So we might want to go into our API log in and add a rule that says that for our API user that we created. We don't want the password to expire, so we're going to put a negative one and then we can put an IP address restriction for that. And then we can go ahead and save and close, and that gives us the ability to allow that technical user to be an open connection within an internal system, and not be subject to the password reset policies, etc. And that's a brief understanding of how to set up our API user and the roles and permissions needed. Thanks for watching.