How does ml-connector handle SAML token authentication for SAP SuccessFactors?

ml-connector generates an RSA-signed SAML assertion using your client certificate and private key, POSTs it to the SuccessFactors /oauth/token endpoint to retrieve a 24-hour Bearer token, and stores that token encrypted. When the token approaches expiry (before 24 hours), ml-connector automatically re-authenticates, so the connection never breaks mid-sync. The token refresh happens transparently without manual intervention.

Which direction does data flow between Visma and SAP SuccessFactors?

Data flows primarily from SAP SuccessFactors into Visma. Employee records, job codes, and cost center hierarchies from SuccessFactors are synced into Visma employees and dimensions on a schedule you control. Visma does not write employee or organizational data back to SuccessFactors, so SuccessFactors remains the authoritative source for HR data.

How does ml-connector handle SuccessFactors throttling and OData datetime formats?

SAP SuccessFactors enforces strict throttling (10 concurrent threads per client, HTTP 429 backoff response). ml-connector serializes requests and implements exponential backoff with jitter so it respects those limits and avoids throttle penalties. SuccessFactors OData V2 uses a non-standard datetime format (Date(milliseconds) in responses); ml-connector parses that format and converts to ISO 8601 for Visma's REST API, ensuring dates land correctly in both systems.

VismaSAP SuccessFactors

Visma and SAP SuccessFactors integration

Visma runs your general ledger, AP, AR, and payroll. SAP SuccessFactors runs your HR and headcount. Connecting the two keeps your payroll allocations aligned with your organizational structure and cost centers. New hires and terminations in SuccessFactors appear in Visma's employee records, and cost center hierarchies sync in both directions so payroll journals post to valid Visma dimensions. ml-connector handles the complex SAML token lifecycle and OData datatype transforms so the connection stays reliable.

How Visma works

Visma.net ERP is a cloud accounting and financial management platform widely used in the Nordic region, exposing suppliers, purchase orders, invoices, GL accounts, cost centers, employees, and journal transactions through REST APIs over HTTPS. Authentication uses OAuth 2.0 via Visma Connect, where service connectors obtain tokens by exchanging client credentials (client_id, client_secret, tenant_id) and passing an ipp-company-id header on every API call. Visma supports both webhooks registered via POST to /v1/subscription and polling via the lastModifiedDateTime query parameter on list endpoints. Webhook delivery is one-time with no automatic retry, so polling is recommended for financial and payroll data where reliability is critical.

How SAP SuccessFactors works

SAP SuccessFactors is a cloud HCM suite with Employee Central as the system of record for employees, jobs, cost centers, and organizational structure, exposed via OData V2 and V4 REST APIs over HTTPS. Each datacentre has its own hostname (e.g., api4.successfactors.com for US East), and authentication requires OAuth 2.0 with SAML Bearer assertion: the client generates an RSA-signed SAML assertion, POSTs it to the /oauth/token endpoint to retrieve a 24-hour Bearer token, and includes that token on all subsequent API calls. SuccessFactors offers intelligent event callbacks for HR lifecycle events, but the webhook subscription API exists only in the Admin Center UI, not as a programmable endpoint; pull-only via OData delta queries with lastModifiedDateTime is the recommended approach. The API enforces strict throttling (10 concurrent thread limit, 429/503 backoff), uses a non-standard datetime format (Date(milliseconds) in responses, datetime'YYYY-MM-DDTHH:mm:ss' in filters), and caps default page size at 20 records (max 1000 if explicitly requested).

What moves between them

Employee records and cost center hierarchies flow from SAP SuccessFactors into Visma.net ERP. Visma reads SuccessFactors employees (PerPerson, EmpJob entities) on a daily or weekly schedule tied to your payroll calendar and creates or updates Visma employee records and dimension entries (Dimension, Subaccount) to represent cost centers and organizational units. Changes in SuccessFactors headcount, job codes, or cost center assignments are reflected in Visma so payroll postings allocate correctly. Data flows primarily one direction (SuccessFactors into Visma); Visma does not write employee records back to SuccessFactors.

How ml-connector handles it

ml-connector manages the SAML Bearer token lifecycle: it generates an RSA-signed SAML assertion using the client certificate and private key, exchanges it for a 24-hour access token, and re-authenticates when the token approaches expiry so the connection never breaks mid-sync. On the Visma side, it uses OAuth 2.0 client credentials with the required ipp-company-id header. Because SuccessFactors enforces strict throttling (10 concurrent threads, HTTP 429 on overload), ml-connector serializes requests and backs off exponentially, tracking state to avoid duplicate processing. OData V2 datetime values arrive in the non-standard Date(milliseconds) format; ml-connector parses and converts them to ISO 8601 for Visma's REST API. Cost centers and employee dimensions are matched by natural key (cost center code, employee ID) so updates idempotently apply to the correct Visma entities. Every record carries a full audit trail and can be replayed if a downstream Visma call fails.

A real-world example

A mid-sized professional services firm operates Visma.net ERP for financials and payroll across three countries and uses SAP SuccessFactors for HR and employee records globally. Before the integration, the finance team manually exported employee lists and cost center hierarchies from SuccessFactors weekly and re-entered them into Visma, then spent time chasing mismatches when new hires or promotions changed cost center assignments. With Visma and SuccessFactors connected, each week's employee changes and cost center updates flow automatically into Visma, payroll allocations land on current cost centers without re-keying, and month-end close starts with clean dimension alignment.

What you can do

Sync employee records from SAP SuccessFactors into Visma, including hires, terminations, and job changes.
Match cost center hierarchies from SuccessFactors to Visma dimensions so payroll journals allocate to valid accounts.
Handle SAML Bearer token authentication and automatically refresh tokens before expiry.
Transform OData V2 datetime formats and throttle to SuccessFactors concurrent request limits.
Poll on a schedule you control with retries and full audit trail on every employee and dimension record.

Questions

How does ml-connector handle SAML token authentication for SAP SuccessFactors?: ml-connector generates an RSA-signed SAML assertion using your client certificate and private key, POSTs it to the SuccessFactors /oauth/token endpoint to retrieve a 24-hour Bearer token, and stores that token encrypted. When the token approaches expiry (before 24 hours), ml-connector automatically re-authenticates, so the connection never breaks mid-sync. The token refresh happens transparently without manual intervention.
Which direction does data flow between Visma and SAP SuccessFactors?: Data flows primarily from SAP SuccessFactors into Visma. Employee records, job codes, and cost center hierarchies from SuccessFactors are synced into Visma employees and dimensions on a schedule you control. Visma does not write employee or organizational data back to SuccessFactors, so SuccessFactors remains the authoritative source for HR data.
How does ml-connector handle SuccessFactors throttling and OData datetime formats?: SAP SuccessFactors enforces strict throttling (10 concurrent threads per client, HTTP 429 backoff response). ml-connector serializes requests and implements exponential backoff with jitter so it respects those limits and avoids throttle penalties. SuccessFactors OData V2 uses a non-standard datetime format (Date(milliseconds) in responses); ml-connector parses that format and converts to ISO 8601 for Visma's REST API, ensuring dates land correctly in both systems.

Connect Visma and SAP SuccessFactors

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started