SAP Business One and ADP integration

What moves between them

The main flow runs from ADP into SAP Business One. After each payroll run, ml-connector reads ADP general ledger documents and posts the labor cost journals into SAP Business One as journal entries, mapped to the matching GL accounts and profit centers. Worker records flow the same direction so SAP Business One reflects ADP hires, terminations, and rehires. Reference data such as cost centers, departments, and job codes is aligned in both directions so payroll allocations land on valid SAP Business One dimensions. GL documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, refreshing the ADP bearer token when a call returns 401. On the SAP Business One side it accepts the full Service Layer base URL per customer, logs in once to obtain the B1SESSION cookie, and reuses that session across calls because the first login is slow. When SAP Business One returns error code -5002 the session has timed out, so ml-connector logs in again and replays the failed request. ADP general ledger documents map to SAP Business One JournalEntries, and ADP cost centers map to SAP Business One ProfitCenters and CostingCode dimensions, which are aligned first so every journal line references an account and cost center that already exists. Because SAP Business One webhooks need on-premise admin setup that most sites do not have, ml-connector polls ADP and SAP Business One on a schedule tied to your payroll calendar, and can receive ADP event notifications where they are enabled. ADP rate limits return HTTP 429 per gateway node, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A midsize industrial distributor runs SAP Business One for purchasing, inventory, and finance across a warehouse and two branch offices, and uses ADP Workforce Now for payroll. Before the integration, the finance team exported payroll registers from ADP every pay period and keyed the labor totals into SAP Business One by hand, then spent the first days of month-end close chasing differences between headcount and the labor accounts in the ledger. With SAP Business One and ADP connected, each payroll run's GL document posts into SAP Business One automatically, allocated to the cost center for each location, and worker changes keep the two systems aligned. Month-end close starts with the labor accounts already reconciled, and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into SAP Business One as journal entries after every pay run, allocated to the correct profit centers.
• •Keep SAP Business One headcount aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes to SAP Business One profit centers and CostingCode dimensions so payroll lands on valid accounts.
• •Authenticate ADP with OAuth2 and the required mutual TLS certificate, and SAP Business One with its session login cookie.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between SAP Business One and ADP?

The main flow is ADP into SAP Business One. Payroll GL documents and worker records move from ADP into SAP Business One, while cost centers and departments are aligned in both directions. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

How does the integration handle SAP Business One's session login and lack of webhooks?

ml-connector logs in to the Service Layer once to obtain the B1SESSION cookie and reuses it across calls, re-authenticating and replaying the request when SAP returns the -5002 timeout code. Because SAP Business One webhooks require on-premise admin setup that most sites do not have, it polls on a schedule tied to your payroll calendar rather than relying on a push.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 credentials, and the connection fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.