I recently presented at Mastering SAP Africa around my thoughts on HXM and SAP SuccessFactors People Analytics. I tried my best to “Timo Elliott” it but I’m just not that polished, and I like that, it’s authentically me!. My daughter says that it can be watched at 2x speed and still makes sense, but has no idea what all those SuccessFactors words I used mean…
Hello! Time for me to go on a bit of rant again. So far, these little rants have been very successful! With support from the community (and demonstrating this to the SAP SuccessFactors leadership group), we’ve pushed the dial a few times in the right direction (well, I thought it was the right direction anyway!) Although, I’m perhaps not as optimistic about this one… let’s see!
The “Reimagined” Home Page (a naming that is going to get tired very quickly!)
A little while ago (quite some time actually – end of 2020) SAP announced that it was going to retire the existing Fiori Launchpad style homepage and move to a new “reimagined” home page. The reimagined home page had been demo’d during a few SuccessFactors conferences and looked quite exciting. The new home page is pretty cool. The whole concept of having the things that are important to you right now highlighted and brought to the front is a good one. Show me what I need to act on right now! Make me do it quickly!
This said – it seems that it’s still a bit of a journey to parity with the old home page. (which may never happen, given the different idea that we’re working with – some things just wouldn’t make sense in a one-to-one mapping.) However, relatively important pieces of functionality, like to-do notifications, manager team tiles and ability to use with onboardees is still being added. There’s also the minor/major issue that you can’t do a refresh to or from any system that has the reimagined home page implemented using the instance refresh tool, you have to request SAP to do it. The plan is that by end of 2H2021 release, everything that is needed to go live with the new home page will be added and these issues fixed. (And hopefully we’ll be able to have that text in the middle of the top panel in some colour other than white).
The (forced) migration to the reimagined home page
There was a plan to push all customers to the new home page by 2H2021. (I just can’t manage to keep typing reimagined… it’s so going to get renamed to “Home Page” as soon as it’s the only option. Can I chalk up another product renaming before it even happens?) But then due to some functionality not going to be available until then, there was this strange idea to push the release universally to all customer’s preview instances 2H2021 and then production 1H2022.
So, I had a bit of a rant about how it really didn’t make sense to push the new home page to all customers’ preview instance before all of the fixes were rolled out and customers had some time to test them. (It wasn’t just me that had this rant – lots of community support for that idea). SAP have now pushed back that idea, we should instead get the universal push in 1H2022 for all customers. So, you’d better get ready for it! Cos it’s coming!
Okay… so what’s the problem?
Well, see the thing is, the main reason that we need the new home page experience, is also the main reason why the existing experience is so useful.
Note how there’s a lot of content on the old layout compared to the new one… well that screen shot is pretty minimalistic compared to some customer instances I’ve come across. (And, I’ll admit, helped implement.)
Here’s a screen shot of one of our demo systems there is a LOT here.
The original idea of the Fiori Launchpad was that a user would be able to see all their important information in one place and drill down to bits that stood out. Of course, that doesn’t work because having pages of stuff means people don’t look at any of it. So the idea of using machine learning to figure out which bits to surface for a person to look at, makes great sense.
The problem is that in many cases SuccessFactors doesn’t know what’s important.
This is especially the case for extension use cases and the “We don’t use just SAP SuccessFactors for all our people processes” use case.
Here’s a couple of examples from one customer I work with:
These two existing home page tiles, “Legacy” I believe the terminology is now, link off to BTP Cloud Portal, which then uses SAP Cloud Connector to tunnel through to an on-premise SAP ECC instance and display Fiori based apps showing leave balances and approval apps that are based on data still stored in SAP Payroll, not in SAP SuccessFactors.
It is exactly the same with these tiles:
The customer also has additional BTP based extension applications – here’s one example:
All managers get the team leave balance tiles/applications and all employees (not contingent workers/contractors) get the leave and payslips apps. And everyone gets the Network Compliance App (it’s really cool btw, if you need something like this, please give me a shout!)
In the new home page these would ideally be part of the leave management quick links or approval tiles that popped up as needed, payslip tiles that appeared when payroll has been sent to bank (dreaming here about next gen payroll, but you get the idea). However, because all these tiles are just links out to other systems/application, they can’t be part of the “intelligent” framework and instead must be part of the “Organisational Updates” section of the homepage. And take up about twice as much screen real-estate. There’s also a limit on the number of tiles that will show in this section, so you’d better hope you don’t have too many custom applications/extensions that you want to link to. (Originally the SAP team had thought to limit the number of “cards” in this section much more, but fortunately a few more are allowed now. (Feedback works!)
Managing Sections with Permissions
So, whilst I would argue that custom cards look really bad in this new experience (they are big, chunky and not sorted into any meaningful categorisation, certainly they are not “Organisational Updates”! – but that’s a topic of a different set of feedback!), we’re only just now getting into the crux of this particular rant, which involves figuring out how to limit who gets which tiles/cards. In the “legacy” home page there is functionality which allows an administrator to create “Sections” on the home page. These sections can then be shown/hidden based upon Role Base Permission (RBP) roles and groups.
It’s as easy as creating a section and then using the drop down to pick as many roles/groups as you want to allow to see that section.
One particularly useful thing is that you can choose the system generated roles used by compensation, but any role can be used and this can can be one that is assigned to a population of “Managers” for example:
This gives a particularly powerful way to assign access to sections based on system generated subsets of the employee population.
Then we can simply assign whichever tiles we want to whichever sections we want and hey-presto, we have managed to use RBP roles and groups to restrict which users have access to which tiles.
There is the downside that quite often we ended up with a section with only one or two tiles in it, but that wasn’t so bad.
So, again, where’s the problem? Well, the thing is, in the new home page, you can’t do this!
Managing custom tiles with Home Page groups
The solution that has been adopted by the new home page is one that also existed in the legacy home page, but we didn’t use because it’s (my opinion) rubbish. When you create a custom tile you can assign it to a “User Group”.
It is possible to edit these user groups:
You’ll hopefully be familiar with the layout of the editor as it’s the same one used in managing role-based permission groups.
However, note that you are creating and maintaining “homepage tile groups” and not RBP groups.
There are some serious restrictions here – you cannot make these groups contain all managers for example or any of the other automatically built permission role assignment groups.
If you have an extension application that relies on the end user accessing the application having a certain set of SuccessFactors role-based permissions, then you MUST ensure that any editing of the home page tile group that includes the list of people who can see the custom tile that links to the extension application MUST also update the associated role-based permission group and the two must not get out of sync.
Well – if you have an extension application that you only want to display to managers as a custom card, well, you’re pretty much stuffed – you cannot use the new home page tooling as it works today. The only way would be to manually maintain the list of all employees that are managers in your organisation. And, ummmm, sorry, this ain’t happening!
I’ve considered building tooling that could automatically maintain these groups based on similar logic to the existing home page, but unfortunately the APIs for dynamic groups are all read only and cannot be used to update a group.
The only things I have so far come up with to enable effective filtering and using custom home page cards are:
- an additional extension application that is launched from the home page and then provides another view of which “additional” applications a user can access. In effect, a secondary launch page which provides the functionality to filter links to applications based on permission roles and groups that the new home page does not.
- An application/integration that regularly goes through all users and updates one of the custom fields to a value which can then be queried by the home page tile dynamic groups (i.e. populate a “is a manager” flag against custom field 14 or something. )
In standard configuration it is still (thankfully) possible to use permission roles and group to decide which items are available in a given user’s navigation menu. Just like the logic that allowed sections to be permissioned in the legacy home page.
So, it is an option to remove these applications completely from the homepage, and just have them in the custom navigation. For those customers that don’t have a crack extension development team to provide a custom tile that can handle using RBPs to provision or not a secondary launchpad, I think I’d be suggesting that they build a custom tile that explains how to find the now missing links in the user menu.
Plea for support
Okay, hopefully you can see now why I’m really worried about the forced push to the new home page in 1H2022. I have spoken at length with the product team for the reimagined home page and whilst they see the potential issue, my feedback to date has been that they do not envisage fixing this issue before the universal migration to the new experience. They actually encouraged me to write this blog post because they want to see if others believe this to be an issue! I did ask them to just run a query on any existing customer that were using the permissions in existing home page sections, but I haven’t got a response on whether that is a large number or not.
SO… if you’ve read this and thought, “Crap, that could be something that’s going to cause me an issue!” Please, please, get onto the SAP SuccessFactors community web site – post your comments on the Migration to Reimagined Home Page Within 1H 2022 Release – Innovation Alert blog post.
Give me some “Kudos” for my comment on that post about this issue: https://community.successfactors.com/t5/Platform-Resources-Blog/Migration-to-Reimagined-Home-Page-Within-1H-2022-Release/bc-p/268878/highlight/true#M1833 and write about your own concerns. If we have enough customers express to SAP SuccessFactors that this will cause a problem we might just yet, get a solution.
Cheers! Here’s to getting the community involved!
Right, this feels kinda awkward… I’m about to give Microsoft kudos and point out how I wish that some SAP processes were closer to what I’ve seen from the team from Microsoft. So bear with me if I seem a little less hyperboly than regularly…
This isn’t the Microsoft you remember
Recently I was working through the options for integrating SAP SuccessFactors personnel records into Microsoft AD, it’s something that every organisation that doesn’t have a dedicated IAM or (IdAM, however you want to make up your TLAs or FLAs) is likely to need in their environment. Have to say, I love working with new “start-up” orgs that don’t use an on-prem AD, but there’s not quite so many of those that are large enough to pick up SuccessFactors that they are probably still a minority.
Documentation is a skill that is distinct from development
Anyway, I happened to look at the Azure AD online doco about SuccessFactors integration and discovered it had been written by a developer. Well, that’s a guess, but seriously, who digs through the results of an API call to get config values out of a system when you can just use the standard tooling to do it? And then makes some poor sod document how to use Postman to do the same? So I suggested an update.
no – just use the UI!
So, I was feeling benevolent and thought I’d offer my advice that perhaps there was a better way. I clicked the feedback button…
Shock horror – I wasn’t redirected to another site and asked to create a new user, I was asked to create a Github issue! (Okay if you don’t have a Github user, you’ll be asked to create one, but seriously, you don’t have a Github user id?)
And now we wait… or not
Then I resigned myself to never hearing back about it again… But I did!
Issue was triaged and assigned to the document author to review that very same day! (that’s not normal is it?)
I was – wow!
Then things got surreal…
Not only did I have someone look at and action the feedback that I gave, they then went and found my tweet on the subject and personally responded to it! Wat?
And now, the update to the documentation is about to go live:
And hopefully that will make some poor consultant/tech support person’s life a little bit easier.
Meanwhile, back at the ranch
So let’s compare and contrast. And I know this isn’t apples – doco is different to application UI changes, but, lets compare the process at least.
I was working on the new SAP SuccessFactors IAS/IPS integration on my own company’s system when had an issue – I couldn’t figure out how to change some value in the config. Fortunately there is a partner community that SAP have set up for partners to discuss these sorts things and get some assistance from each other.
(Sidebar – Yes, I know it’s a bizarre idea, consultants helping our competing firms consultants do stuff. But in the scheme of things, the other consultants are all good people, they just aren’t lucky enough to work for my company, and helping others tends to do pretty good things for your own internal skills too.)
If you don’t know, then ask!
So I raised the issue in the forum and the really nice SAP person how has to read all my grumbles and moderate the forum raised it in the fortnightly call that SAP hosts for partners (it’s at 12:30am my local time, which makes it a bit fun, but better that than 6am!)
And there was already a solution! WOOO HOOO!
Pretty cool, so I had a look..
If you have to attend training to do something, it isn’t intuitive.
Let’s just say I wasn’t impressed with the UX and I realised why I hadn’t figured out how to do this myself! Because colouring something BLUE in an SAP UI5 app is possibly the least intuitive thing on planet to do to indicate that it is editable if you click it. Possibly the developers had played one too many games of Day of the Tentacle and thought users needing to randomly waving their mouse around the screen to see if it changes pointer shape is a good way to indicate to people that something is clickable? (Okay I doubt that was actually the case, more likely someone threw a guideline at them that didn’t make sense and they had to get inventive to work around it (been there!)). Pretty much everything in standard SAP UI5 apps are cyan or blue, and I’m not checking everyone one of them to see if it’s different.
So I gave some feedback on the forum.
I even tweeted about it. Cause that’s what you do, right? (Well it’s what I do. I mean there’s a certain type of person who stays up late at night writing blog posts about these sort of things, so what do you expect?)
This then lead to a bit of a conversation in my DM’s with someone from SAP (since it was DM’s I’ll not share, private stays private) who suggested that I really needed to raise this with support since it was an issue, and that helps track that people have issues. Likewise in the forums I was directed to raise it formally.
To whom it may concern
So I raised a SAP Support ticket (low priority since I already had a fully working work-around.)
I would happily have bet on the response, and I’d have won!
Thanks Mike – yep, the ole “Raise an enhancement request” gambit. That place where good ideas go to die.
“Once more unto the breach, dear friends, once more;
Or close the wall up with our English dead”
But by this time I was, “right whatever, lets see how far this sucker goes!” So I raised that enhancement request.
Oh – and whilst I was doing that, I came across a small issue…
The feedback site is hosted in Europe. I am not in Europe. But that’s cool because there’s this concept called CDNs, yeah, that allow large websites that are accessed around the world to be accessed in a reasonably fast manner from everywhere.
Yup – CDN wasn’t enabled. It is now – so the rest of you can thank me for suffering on your behalf!
Sod it though I’m gonna get this bugger filed! Oooh flashy light on my phone…
Anyway after much self flagellation
I got the request raised! had to attach my diagram as an “attachment” not able to be viewed inline in the request – but hey – it was raised.
And there it sat…
Three weeks later my request was “Acknowledged”.
What’s the German word for “million to one chances happen constantly”?
And in the weird way that the universe works, whilst I have been typing this up, I got a comment on the request, strangely I didn’t get a notification (yet) but keeping my fingers crossed that sometime tonight. I did just check my spam email folder too, and interesting that it’s about 30/70 banking phishing scams and webinar invites, sure it used to be far more interesting. But nothing to notify me that my request had an update.
The really nice lead designer for the product reached out and asked me what I thought about their thoughts about making some UI changes to make things easier to use!
The response was awesome! I Loved it!
they ended the message with a request for my thoughts!
“Please let us know what you think.”
YES, YES, YES!
Well – I can say I was totally stoked, so happy! And then I tried to find the button to reply….
The irony of wanting to reply to a conversation about improving UI to make things more obvious and easier for people to use and then not being able to because the UI of the tool in which the conversation is happening doesn’t facilitate it.
Anyway. I did what I always do. Tweet lots, then try to figure out what to do…
It would appear that someone thought that it would make more sense for new comments to appear at the top of the conversation, not the bottom. So by clicking on the comments “tab” at the top of the page I was navigated up the screen and saw that I could enter a new comment. I did. And I tried to be very nice in my feedback (given the amount of huffing and puffing I’d been doing seconds before.)
Two ways of doing things, both with good result
So, we have two different scenarios, both ended up (or will hopefully end up with) some change in the product as influenced and suggested by me. Two out of two is pretty good going. However, one took 3 weeks, the other, over 3 months. One was painless and easy, the other painful and frustrating. As I said earlier, we’re not comparing apples to apples – getting a product changed is much harder than getting some doco changed. And I have heard anecdotally that some areas of SAP are even faster:
Interesting to note that the area that got the same day response that Robin mentions is also using the Microsoft Github tooling to manage issues. I wonder if tooling impacts delivery approach?
Yes – AND?
So what do I want to achieve by writing all this (other than hopefully amusing a few of you with the tale)? Well, I think it’s important that it’s documented how difficult giving good and constructive feedback can be. Only by taking a look at what’s happening can we get on the right path to working together to make everything we do better and easier.
I’ll finish by just mentioning that EVERYONE that I have dealt with when providing feedback at both SAP and Microsoft have been AWESOME. Both organisations do understand and value feedback. It’s not a people problem.
Okay – so I’m supposed to be doing something else right now, but a) I’m procrastinating, b) I just got off a call with a whole bunch of SuccessFactors integration “experts” and I want to show that I haven’t completely lost touch! And c) I’ve finished Witcher 3 Wild Hunt and all the add ons and played far too much Civ6 so I really needed to do something else (which wasn’t the thing I was avoiding doing in part a).
So, I thought I’d share a teeny tiny simple integration that I helped a customer build the other day. Yep – I didn’t build it – I helped the customer do it (a functional SuccessFactors admin) via a web meeting.
Updating data in SF WITHOUT using a workflow just simple integration
It came about because we had just updated from old and honestly less than perfect Boomi integrations to newer (and still not perfect, but better) SAP Cloud Platform Integration based integrations. One of the things that was “fixed” was that leave records in SF and SAP were now being kept in sync. So an old process that they had running in SAP that was updating SAP leave records without updating the SF record was no longer working. Well, truthfully, it did work, right up until the next sync run happened and then the record got updated back to the SF state.
The functional requirement was based on a process this customer has. They allow managers to enter a “unexplained” absence type for employees into SuccessFactors in the case that an employee is a no-show for a given day. When the employee returns to work, they have the option to change that absence type to a personal leave (sick leave or carers leave) or mark it as annual leave, or however it needs to be handled. But if they don’t update the record within 14 days the leave type is automatically changed to personal leave without medical certificate.
On the basis that “Any sufficiently advanced technology is indistinguishable from magic”
I present how we got it to work again in my bad whiteboard drawing style. NB payroll is shown as a little black box because you really don’t want to look in there, and I clearly do not have enough skills with drawing to represent Pandora’s box.
So I’d like to take the time to explain how we got the “Magic aka Integration Center” bit to work. (Yes I know that there are two spellings for Centre/Center and really I don’t mind. If I did I would blame the US, but they’re in a world of hurt right now, so let’s be nice).
Making the Magic happen
In Integration Center we created a new integration:
Chose the “more integration types”
And then chose Scheduled SuccessFactors to SuccessFactors OData v2
Chose the Employee Time entity
Then simply dragged and dropped the external code from source to destination, fixed the time type to 0200 (Personal Leave)
And set the operation to “Update/Merge” (which is a personal bugbear of mine since the HTTP operation should really by “Patch” not “Merge” but that’s OData v2… <sigh>)
Now if we were to run this now it would transform all leave record in the system to time type 0200 – which would be bad… (with great power comes great responsibility Peter!)
So next up let’s restrict which records should be selected…
I’ve only set up one “Unexplained” absence in the system – has time type of 6666
Now we only want to update entries that are time type 6666 and creation date is 14 days in past (I’ve used 14 minutes for this example because waiting 14 days seems a bit excessive for such an unpolished blog post)
Note that date filters have a very useful “relative date” option.
Now jumping back to the configure fields screen and you should see only one entry… (NB if you choose created DATE rather than created DATETIME, just taking 1 min off actually takes you to previous day so be careful what you choose!)
Now if I wanted, I could schedule the job to run daily:
Then just set the schedule and go for it!
But to be sure it’s working, I can actually just run it in preview:
And it works!
Entry updated to personal leave
So simple, yet so powerful!
Usual disclaimers apply – and especially so given the whole Spidey superpower unleashed here. You can really muck up your data doing stuff like this… DO NOT TEST IN PRODUCTION!
Enjoy. Don’t be afraid to give it a go! I’d advise, just go out try it. You learn so much more that way rather than asking other people to figure things out for you!
Okay, even with the number of diagrams in my last post, there was still some confusion. So, I’m going to try to make it totally clear. Emphasis on “try”.
Regression Testing isn’t just about regression testing one part of a solution
Firstly, I got some feedback from SAP Support when I tried to raise this issue with them. They didn’t seem to understand my concern that I tested the whole recruit to hire to fire employee life cycle every time that SAP released new functionality for SuccessFactors in the preview environment before it got released to the productive environment. This was because:
“Since IAS productive and test instances are of the same version, there is from IdP perspective no difference at all.“
“As already mentioned above: IAS test- and productive instances are of the same release. There is no such thing as a preview environment for IAS.
Thus again one single IAS tenant will be fully sufficient to handle the described scenarios from IdP perspective“
I’m not sure how I can make this clearer. But, yes, I do want to test that during the preview release update period the changes that SuccessFactors make do not impact the provisioning and login processes that I have configured in IPS/IAS. I also want to ensure as well as ensure that these are working in the non-prod environment so that if I push up a change to fix a release impact, it doesn’t break stuff. I’m confused how the Identity services teams seem to think their solutions works in isolation! If it isn’t for the systems that use their services and provide the user details the solutions aren’t worth anything!
How does this all look if we try to connect it up?
Okay – here’s a relatively complex diagram. It shows how you’d have to wire up the provisioning and authentication trust when using more that one SuccessFactors system with a single IAS.
But there is the slim possibility it could work!
And it could work provided that you:
- Did some configuration in the IPS and IAS that SuccessFactors has not at all been documented for customers
- that populated userid into different custom attributes of the IAS user record per system
- then used that system specific field in the assertion sent to the different systems.
- AND – never maintained different employee attributes for the same email address in the two systems (if you don’t want the system to get hella confused.)
Unfortunately that’s about as likely as me winning the Powerball lottery. Whilst the first point is terribly technical and pedantic (therefore will be loved by half the people I know and hated by the other half) the second point pretty much means this is never going to happen. The reason for the second restriction is that you cannot have the same email address against multiple “user” records in IAS. Whilst through some technical wizardry I might get the same record to point to two different system ids, whether it is active or inactive is a non-system specific piece of user data. What name that user has is a non-system specific piece of user data.
So assume I do have the same email address assigned to an employee in both systems A and B. Terminating that employee in system A will cause a delta in the employee record that will get picked up by the IPS and deactivate the user in the IAS. Even though they should be active to be allowed to log in to system B, they won’t be able to as they are now “inactive”.
It is possible that customers will just decide that they will ensure consistency between user records in different systems, use same name, have both active, have both inactive, but I very much doubt it.
Likewise not using the same email address for employees in both systems is going to be hard (not to mention hard to track if it mistakenly happens).
Would be nice, but unlikely
In my previous post, I assumed that the previous scenario (especially as it involves undocumented configuration) would not be customers’ default. There I assumed that customers would use the default configuration that is deployed when a customer implements the SuccessFactors IAS “upgrade”. That then allows for all sorts of mischief!
How to abuse authentication when you control the data it is based upon.
Let’s have some fun. Assume that default IPS configuration is being used and the employee records from systems A and B are both trying to update the IAS user master record. Assume system B contains sensitive payroll data (for example it is a copy of productive system). Only Annie Admin has the roles in system B to see this data. I, Chris Creative, have access to system A where I’m doing some project work. I have a role where I can hire and fire employees (tends to happen in HR systems!)
- I firstly terminate an employee with Annie Admin’s email address in system A. If there isn’t one, I’ll just hire her then term her.
- This will trigger the IPS to update the IAS with the user with Annie’s email address as inactive so Annie can’t log into either system and stop my nefarious fun.
- Then I hire a new employee that has the same personnel number as Annie had in system B and put a newly generated email address (that I have access to) against the employee’s record
- I get emailed by the IAS that I have a new user record set up 🙂 what a cool system! I set/reset the password.
- Now I can use this email address to access system B and it thinks I’m logging in as Annie! Which is awesome as when they try to trace who downloaded all the payroll details from the system the audit logs are going to clearly point to Annie’s user! (Okay yes a bit of further checking and someone might see that it was my IP address, but I can hide that using a VPN, the audit logging in IAS is hard to get to (API access only) so going to be hard for them to find the random gmail address I made up and trace it.
- I access a bunch of data I’m not supposed to
- I go back to system A, change the email address of the fake Annie back to her email.
- She gets reactivated
- I just got away with accessing a system that I had no rights to access because I had rights to another system that was provisioning the same authentication system.
Are you worried yet?
Can you see now why I’m a little worried about this setup? This is why I also assumed that to prevent this sort of thing happening, most organisations if forced down the path of using just one IAS will choose the most secure SuccessFactors system to provision user data to the IAS. But that, as I wrote about in the previous post will cause a bunch of other problems.
In case it’s not obvious enough, there is a simple solution. Provide another IAS instance per SuccessFactors instance that a customer has.
So, firstly, at this moment in time it feels a little petty writing about this. The world is just starting to realise how huge a problematic space we are in with COVID-19. So I wish all of you out there reading this, health and the wisdom to look after yourselves and others. So, now back to me being needy.
SAP SuccessFactors are only offering customers one non-prod IAS system. One non-prod IAS is not enough. Read more to understand what that is and why I think this is a mistake.
A new service to support new functionality
Recently SAP SuccessFactors announced that they are going to move all customers to a new platform authentication solution which uses SAP Cloud Identity Authentication*. This new background service is a requirement to use the new People Analytics that use SAP Analytics Cloud and is also required to use new internal facing Career Site builder functionality. In short, to take advantage of some of the newest and coolest looking features of SuccessFactors, you’re going to need to implement this!
*There’s a handy overview video (strangely enough not behind SuccessFactors community wall) that explains in detail what SAP is doing, it’s a little more in depth than the detail I provide in this post, it’s not bad although very detailed.
Why are SAP SuccessFactors doing this?
Honestly, this is a good move. Authentication is a common problem in all cloud based solutions, so why not have a single service that can be leveraged by all SAP solutions to solve this? Customers get the benefit of multiple development teams within SAP all pooling to produce a better product, SAP gets the benefit of reducing cost of having to maintain and upgrade their authentication solutions for each cloud product. Win – Win!
It’s not yet a requirement for customers to migrate to this solution (and yes for many customers this will require some work to implement), but in order to take advantage of several new SAP SuccessFactors functionalities, customers are going to have to move. So I’m pretty sure that SAP will get close to its goal of migrating by end of year (although possibly with a covid related bump in that progress).
“Our goal is to have customers migrated to SAP Cloud Identity Authentication (IAS and IPS) by the end of 2020. This is not a “forced” migration, we are just encouraging customers to migrate. At some point all customers will need to be using this authentication method, that date is not yet determined. “from SAP SuccessFactors Community, Platform Resources Blog
However, in going through the process to migrate some of my own systems, I’ve discovered a bit of a problem. I’ve tried to raise this multiple times, but so far, I just don’t seem to be able to clearly articulate why this problem is so important. So, I thought I’d try putting together a simple blog post with LOTS of pictures. Hopefully more pictures means easier to understand and then we can get somewhere!
Background – How does it work?
Okay, before diving into the deep end, it’s probably worth trying to articulate what on earth this SAP Cloud Identity Authentication is, and why I’m so happy that it’s coming.
So, here’s how it works in general.
- Happy SuccessFactors user uses their computer to
- Access SuccessFactors website, which
- Redirects them to their own company’s identity provider (IDP) which asks them to log on (or possibly realises they are already signed in and does single sign on. Which then
- Sends them back to SuccessFactors having verified that they are a valid user and they can access their SuccessFactors system, so
- The Ecstatically Happy SuccessFactors user is even more happy!
Pretty simple really! There’s some technical stuff like SAML2 assertions and stuff that happens – but generally the experience and security are what matters.
Importantly, SAP SuccessFactors aren’t really aiming to change any of that experience, there just a small technical difference. In between steps 3 and 4 there’s going to be a little more going on under the hood.
Steps 3 and 4 of our previous diagram are replaced with 4 other steps. Quite simply SAP Cloud Identity Authentication Service (IAS) becomes a middleman to/from SuccessFactors and the Corporate IDP.
- SuccessFactors sends unauthenticated requests to IAS.
- IAS redirects request to IDP for authentication.
- IDP tells IAS that user is identified and correctly authenticated
- IAS tells SuccessFactors that user is identified and correctly authenticated.
There are a few benefits here. The SAP Cloud IAS is set up to be maintainable by customers. Whereas setting the details of a corporate IDP into SuccessFactors was/is restricted to SAP and certified partners, using the IAS is something that most customer’s technical teams should be able to manage. (I’ll caveat that with note that I expect that most customers will probably get their implementation partner to guide them through the initial setup. But at least it is something that customers can do, if they want to.) SAP SuccessFactors automagically set up the link between SAP SuccessFactors and the IAS.
There are many options to be able to configure the IAS to do some nice things, setting up rules for access, making login screens pretty, etc. It’s a good tool.
It is important, however, to understand that the IAS isn’t just a simple pass-through proxy service for authentication, it stores a list of all active users. A user MUST exist in the IAS in order to be able to log on to SuccessFactors.
So, what’s the problem?
Well so far everything seems hunky dory, no? Well, that’s probably because I’ve just talked about the productive use of the solution (which to be fair is what most people care about.) However, for many customer non-productive environments (and even some productive ones!) a corporate IDP and single sign on is not used.
- Uses browser,
- Logs on with username/password (stored in SuccessFactors)
- Is happy
This scenario is updated also with IAS in the picture.
Can we just assume that you’re as tired of reading numbered lists as I am of typing them? No? Okay – just to be complete:
- User bounces to their laptop…
- Uses browser to access SuccessFactors
- Which redirects them to IAS which asks them for username and password (as no corporate IDP configured)
- IAS tells SuccessFactors that user successfully identified and authenticated.
- User has great time using SuccessFactors without SSO or a corporate IDP
There is some great functionality that can be leveraged here too! SAP Cloud IAS can implement multi-factor authentication – pretty damn good to have that available without having to use corporate IDP!
Sidebar – there is an IPS too
Yes, sorry more terminology! The way that the IAS works it needs to have a list of users provisioned into it. It doesn’t just use the list of employees that are in SuccessFactors, these need to be populated into the IAS.
- The IPS reads SuccessFactors regularly to find any changes to employee/user records
- It passes any details if finds to the IAS which updates its list of active users for SuccessFactors (and potentially any other system that authenticates against it).
Now that might sound like a retrograde step – it means that we need to provision (yep IPS stands for Identity Provisioning Service) users from SuccessFactors into IAS on a very regular basis. But, realistically, there are very few productive use scenarios that require a new employee to have access to the SuccessFactors system instantaneously, a delay of an hour is normally manageable. And there are ways to make that sync happen faster if needed.
Again, this seems all to be good news! There are a few minor niggles. For instance, the IAS must keep a list of usernames and email addresses in order to allow it to function. One additional restriction is that all users must have unique email addresses (you can’t set all the non-used users’ emails to firstname.lastname@example.org!) Again this doesn’t seem to be much of a problem. Until one considers that many customers have more than one non-productive system.
There can be only one!
I was so tempted to put a Highlander meme in there… But I didn’t because it might distract from the seriousness of this next bit – which seems to be the official SAP position at the moment.
” SAP is offering free [IAS] licenses to SuccessFactors customers for the purpose of logging-in to SF; they will receive one production and one test instance (by region). “SAP SuccessFactors IAS FAQ, highlighting and info in [brackets] added by me
SAP will only provide customers with one IAS tenant for their productive environment and one for their non-productive environments.
Why is this a concern?
This seems to be the bit that I’m having trouble explaining to people, so I hope the following diagrams and explanations help.
For many SuccessFactors Employee Central (Core HR) customers they have been provisioned by default with three instances. Customers can use them however they like, but I tend to advise people to do the below:
Note that these systems are very often linked to payroll environments that reflect similar levels of detail to the productive environments. As such, the levels of control of access are very important. This is personal and private information and needs care and attention!
However, very often one of the systems will have anonymised data, or even just made up data, and be used for prototyping and building solutions. Generally in this system users may be given access to areas that they don’t normally have access to. Training and/or testing may take place. The key thing is that users may be running scenarios with different access levels than normal.
It’s important to note that whilst there is clearly an overlap in user records between all three systems, there are plenty of users in both non-productive environments that don’t overlap in normal usage of these systems.
Again, so why is this concerning?
Well, to reiterate, SAP have said they will only provide as part of customers’ existing subscriptions, two IAS instances. One for productive use and one for non-productive/test environments.
The non-productive IAS must provide authentication services for both non-prod environments. However, the feed that populates the list of users into the IAS can realistically only come from one of the two environments.
I’d better make QAS my source of user data then
Due to security concerns for data access, I must then make the source of user data for the IAS the QAS system, where I have locked down user access. Otherwise, if the source of the user data was the test system, then a test user could update a user in the test system records to have details that could allow themselves to log on to the QAS environment and see data that they were not supposed to see. That can’t be allowed!
Real email addresses at a premium for testing, double handling.
It will be quite some hassle to maintain all the Test system users in the QAS system, but it could be done. However, it may be very difficult to test scenarios that rely on real email addresses. Because the email address must be unique in the IAS, it won’t be possible to swap emails around easily. This becomes especially problematic when email address is used to authenticate users to downstream systems (particular cases where I have seen this occur are SSO into SAP ERP systems, where email address is used as the unique identifier.) Changing an email address to allow testing of a process may mean creating a new employee in the QAS system and reassigning email addresses there in addition to updating the test system.
But hold on, what about regression testing?
However, during the 6 monthly release cycle, there is a need to test all the new SAP SuccessFactors functionality. This needs to be done in the preview environment. So perhaps during this period I lock down all access to the preview environment, make user access as per the QAS system? Then I switch my IAS source to be the preview environment? This has some problems associated with it too. It really restricts how I can carry out my regression testing and who I can use to do it. But sure as a very sure thing, I will want to test out user provisioning and definitely want to check that the configuration I’m using to populate the user list into my IAS from SuccessFactors hasn’t been impacted by the half yearly release.
So where does this leave us?
Very soon, with the release of SuccessFactors embedded analytics (People Analytics), more and more customers are going to want/need to implement SAP Cloud IAS within their SuccessFactors environments. I would imagine that due to the overheads that I described that many customers would opt to purchase an additional subscription for another non-productive IAS instance. If I think of the cost/overhead of:
- maintaining all non-productive users in pre-prod (imagine having to hire someone in the pre-prod environment just so you could test a hire in the test environment!)
- Separating out test system users/data from pre-prod environment to ensure regression testing payroll changes.
- Migrating IAS and IPS (tool used to synchronise user record to IAS) configuration from one system to another to enable release testing, then flipping back if urgent production support testing needs to occur.
- Restricting release regression testing to only those users that have pre-production access and only to their regular roles.
Then I think I can see the cost benefit of purchasing an additional IAS system to handle that. But I really don’t want to be forced into paying additional subscription to handle a scenario that works just fine right now.
Given that when I raised this point in SuccessFactors community site I was told that:
…By design, you don’t need a 1 to 1 relationship between SF instances/tenants and IAS.
IAS is designed like any other Identity Management product to handle logins for many different systems. Customers don’t buy a new copy of Ping Identity or Microsoft Azure for every application they use it for. Your IAS configuration will control which SF instance users log into.
Additionally, having the 1:many approach makes it a lot easier to manager [sic]. If you had multiple copies of IAS/IPS you would need to figure what is connect to what every time you want to manage anything. When you re-use the same IAS for many applications, you only have to configure one time and then re-use them. ie…Password policy settings, Corporate Identity Provider connections etc. The corporate IDP is a huge one since you have to work with your internal SSO folks any time you change anything there.
I think there is a disconnect between how some SuccessFactors product managers think customers are using their product and how it is being used. Many customers do not use SSO into their non-productive environment by design!
I really hope that by spending the time to put this post together I can raise some awareness of this problem before it becomes a bigger issue for customers. Ideally, I’d love SAP SuccessFactors to re-evaluate their stance on providing only one IAS instance for all non-productive SuccessFactors instances. It should clearly be (in my not so humble opinion) one IAS per SuccessFactors instance. (on a technical note, happy for just one non-prod IPS). Let’s see. If you’re reading this and you have some influence with SAP SuccessFactors it would be great if you let me know what you think and perhaps let others know too.
Last thought on solution parity
Finally let me leave you with one last diagram/thought…
I love working with the SAP SuccessFactors software and I think that the IAS is some great functionality. However, no new functionality that replaces existing functionality that a customer has should ever require them to purchase additional subscription to retain parity with their existing solution.
P.S. there’s a follow up post to this one to clarify a few things – How to break a shared authentication solution where I put my evil hacker hat on and give and example of why this could be very ugly for an organisation.
Just some very brief highlights and musings from the lounge in LAX whilst I wait for my flight home to Melbourne.
This was the eXperience SuccessConnect, there were X’s everywhere! The amount of airtime that Qualtrics and experience management got may well have equalled the amount of time that the SuccessFactors product was discussed.
My SuccessConnect really kicked off with the Monday partner briefing and meeting up with Sylvie Otten and introduced to Micheal Grimm from Ingentis. Was good to start off the event with a good moan about the state of CF vs Neo when it came to SuccessFactors extensions. Sorry Sylvie – I earned my namesake.
At least she was smiling in the photo!
Next up was the partner briefing – after having made the mistake of sitting near the front last year at it being the most boring multiple hours of the conference, I sat at the back so I could sneak out rather than pass out with boredom.
I was wrong.
David Ludlow completely creamed it with his update on roadmap and recent changes. That was probably the best 20mins of the entire conference. Wish I had sat nearer the front! Although have discovered that taking photos of slides in SAP’s newly preferred dark theme really doesn’t come out well, the black comes out browny grey – doesn’t look so cool… 🙁 But I got the slide deck – gold!
There were many cool things in there, but the new UI being proposed for the user landing page was probably the most exciting bit – which is why David didn’t say much about it, but left that for Amy the next day at the keynote.
Lots of debate about this new conversational AI based UI. With the biggest one being, there better still be menus and some way i can add a link to view my payslips, and apply for leave with one click without having to type in “view my payslip”.
We’ll see how it develops as looks like planned delivery 2020 – but I’ll bet on it not being GA before next SuccessConnect. Perhaps beta with a couple of customers… lets see next year.
After David’s excellent presentation I got to catch up with the team of analysts and media folk who’d had a briefing that day. Josh Greenbaum was holding court and had some interesting comments around SAP’s strategy with payroll, but the wine and food was excellent and I left with some of the folks there to go to the exhibition show floor and do what I was supposed to be at the conference for (not chin wagging with analysts!)
I was here at SuccessConnect to sell a SAP CP extension for SuccessFactors that me and my team have built – it provides EHS functionality embedded into SuccessFactors. It’s pretty cool! But I would say that!
I have discovered that I sell much better with a glass of wine in my hand…
After that it was to Jewel nightclub to the Kronos and Rizing party (not sure I really should have continued drinking, next day was hard work!) But did get to meet up with Sherryanne Meyer which was nice.
The next day was lots of water and the keynote.
Have to say, I love the moments that matter idea. as in consider where you are putting your effort in making certain processes work better. It’s probably much more important that the initial day one experience for an employee is better than the process they have to use to apply for leave. They might apply for leave hundreds of times, but they only have one day one and it will be a much bigger impact. Think about the return to work process for return from parental leave, make that a great experience don’t worry so much about timesheet entry….
However I heard the term FAR too over used during the conference and used outside of the context i just described.
And then the keynote just went to “eXperience”. It was wow, everything was about HXM or Human eXperience Management, not Human Capital Management. Look, I dislike the HCM idea of treating employees as “Capital”, that’s not what we try to do, but still there is a whole bunch more the the successful running of employees in a business than just looking after their experience!
I observed cynically to someone (the night club from night before possibly didn’t help my mood) that it seemed that the SuccessFactors exec team had all been given bigger KPIs to sell Qualtrics than they had to sell SuccessFactors.
After the keynote were lots of general sessions including loads of roadmap sessions! The conference team really listened to the customer desire for roadmap sessions and most were repeated at least one. Even better the sessions were short on presentation and long on questions. This is why people come to conferences rather than reading the slides at home (and without having to fly stupid distances around the world). So SUPER KUDOS to the SuccessFactors team, your roadmap sessions were AWESOME! I had lots of fun in one run by Mark McCawley who I meet for the first time and leaked some news that I’m hoping we can reveal soon that will make many customers very happy!
Saw mention that instance sync tool will allow copy back of employee data from prod to non-prod systems (without full system refresh) allowing for trouble shooting of issues in test environments – this is awesome and will be a huge benefit for customers. When you look at the list price that Accenture were/are charging for a SAP CP tool that does similar thing, you can see how customers were really wanting this functionality!
Talking of the SAP App Store and SAP CP extensions, they were highly visible this year on the show floor and customers were clearly interested!
Final keynote was more eXperience Qualtrics puff along with 3 partner add on solutions, and a strange plug for SAP.io which I’m pretty sure the audience didn’t care about. Much disappointment that non of the partners on the stage with SuccessFactors add ons were using SAP Cloud Platform – a real lost opportunity to showcase the power and benefit of having extensions that look like they are just additional modules of SuccessFactors, a functionality that SuccessFactors has that is unique – I’m afraid integration to ServiceNow isn’t really that unique…
Last day and the team:
went to the golf driving range, where I discovered I’m not terrible at this golf lark, but not good at it either. Was fun!
Anyway – flight about to be called.
Was great to be at SuccessConnect, think it would be good for the SuccessFactors exec team to perhaps take a moment to listen to the SAP Mentor feedback – perhaps we can arrange something for next year?
I think perhaps my photo taken on the way to the airport this morning sums up today pretty well.
— Chris Paine (@wombling) October 5, 2015
An empty road with a whole bunch of speed bumps. I’m afraid that’s what today felt like. It’s kinda weird starting off a conference without hearing the keynote to set the tone. Even with SAP conferences like TechEd we have “pre-conference” days – thanks ASUG! But today was part of the conference, and it didn’t really feel like it.
An example of the bumpy road was having a session today on the new support model for SuccessFactors, but without mentioning the SFXpert program. It was kinda weird – but apparently Mike Ettling will talk about that in the keynote tomorrow, it’s a little confusing.
Moreover, there weren’t an awful lot of people here. Which in someways is pretty good, it means that we’re able to have comfortable conversations, no running around with microphones to ask questions. But it certainly seems that running a SuccessConnect in Singapore may have reduced the number of Sydney attendees. I’m not sure, perhaps tomorrow will bring more people? It was a big ask to get people to come for a whole day for 3 sessions.
But it was a glorious evening in Sydney:
— S.A.Wilson (@SawilsBiz) October 6, 2015
and we’re keeping on going with the saving of Elephants and Rhinos with the corporate social responsibility thing
— SuccessFactors (@successfactors) October 5, 2015
Would love to know where we’re at with that total – hopefully we’ve got above a few thousand dollars by now.
So a few bumps, a fairly empty road, but the way ahead looks clear, and the weather is glorious. I look forward to tomorrow. I just hope that the panel session with David Ludlow goes well. 🙂
we shall see.
Just a quicky.
I thought I’d add a link to the presentation that I gave at SAUG Summit this week.
Seemed to be well received.
(Mike Ettling explains SuccessFactors new commitment to putting customers first)
So I’m in the lounge at LAX – the new OneWorld business lounge – it’s loads better than the old Qantas lounge, they have craft beer on tap for a start, which did lead to rather a few posts:
— Chris Paine (@wombling) September 13, 2014
— Chris Paine (@wombling) September 13, 2014
— Chris Paine (@wombling) September 13, 2014
Which weren’t particularly related to themes I normally post on, but nevertheless probably tell you something, I’ll leave this as an exercise to the reader to speculate on what.
So whilst I’m nice and relaxed after a nice shower and looking forward to heading home, I thought I’d capture a couple of things that happened whilst I was at SuccessConnect this week, and hopefully this will also remind me to expand on them at a later time.
Firstly – customer first
The commitment by SuccessFactors to publish a roadmap to customers is a big win. And It’s not just a win for customers. As a partner it’s much easier to advise a customer when you have a good understanding of what _might_ happen in the near future. By making as much of the solution as possible accessible by the upgrade centre rather than provisioning (an ongoing effort) it removes from customers the need to engage an SI partner for what may well be just an administrative task. Allowing customers to attend the same training that partners can attend is also a great thing – so now there is a real possibility that customers can do some of their support in-house.
Why, you might ask, am I cheering this as a good thing? I am one of those partners who previously customers had to rely on to make these changes. Well, it’s really because I don’t like doing boring stuff. If as an SI all the work I do is very simple, then customers can be a little resentful for paying me as much as I would like to be paid. I see this as an opportunity to get rid of the boring work and instead focus on bringing real value through expertise. We shall see, but I’m hopeful that this is the path SAP envisages as well.
SAP a SuccessFactors company?
With Rob Enslin opening the conference, I got a real feeling of SAP being a full part of the conference, and not it being a SuccessFactors as a separate company anymore. That said, all the “Cloud DNA” was still there and it was interesting to see Lars make a guest appearance. The reaction from the SuccessFactors staff to seeing Lars was remarkable, it was all a surprise, and a nice one for most. However, Fiori making itself felt in the UI development pipeline amongst other “Simple” things shows that the “DNA” exchange isn’t just one way.
The public announcement of a phase released of functionality, with updates being released a month earlier on the test instances of a customer is great news. This will help extension developers hugely (although ideally I’d like access to the update another few weeks before the customers get it in their test systems, but can work with this idea!) Customers too have the ability to check out any mandatory (although there are few of those) updates before they get deployed. All in all a great step forward to helping customers manage their solutions – and the spontaneous applause from the audience when it was mentioned shows it’s not just me as a developer that appreciates this.
Righto, that will do for now, Mike Ettling’s flight to Sydney has already left, and mine to Melbourne is going soon. I’ll be catching up with him and the team again for the Sydney version of SuccessConnect, but I’m so glad that I was here this week in Las Vegas, it has been great.