0% found this document useful (0 votes)
30 views24 pages

SF PLT CommonSuperDomain

The document outlines the implementation of the Common Super Domain feature in SAP SuccessFactors to address the impact of third-party cookie deprecation by major browser vendors. It details the migration process, prerequisites, and the effects on various SAP SuccessFactors applications, emphasizing the need for customers to transition to a unified domain structure to maintain functionality. Additionally, it provides guidelines for identity provider configurations and troubleshooting during the migration process.

Uploaded by

asiskumar2212
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
30 views24 pages

SF PLT CommonSuperDomain

The document outlines the implementation of the Common Super Domain feature in SAP SuccessFactors to address the impact of third-party cookie deprecation by major browser vendors. It details the migration process, prerequisites, and the effects on various SAP SuccessFactors applications, emphasizing the need for customers to transition to a unified domain structure to maintain functionality. Additionally, it provides guidelines for identity provider configurations and troubleshooting during the migration process.

Uploaded by

asiskumar2212
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 24

PUBLIC

Document Version: 1H 2025 – 2025-05-27

Implementing the Common Super Domain


© 2025 SAP SE or an SAP affiliate company. All rights reserved.

THE BEST RUN


Content

1 Common Super Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3


1.1 Impact of Third-Party Cookie Deprecation on SAP SuccessFactors Applications. . . . . . . . . . . . . . . . . . . . 3
1.2 Common Super Domain Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Migration to the Common Super Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Prerequisites for Migrating to Common Super Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Migration - In Scope and Out of Scope. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Migrating to the Common Super Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Impact of CSD Migration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Migration on Additionally Purchased Tenants. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Additional Enhancements Outside Common Super Domain Migration. . . . . . . . . . . . . . . . . . . . . . . . 12
Other Things You Need to Know About Migration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Actions Following Migration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.4 Guidelines on Identity Providers for Customers and Partners. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Guidelines When Using SAP Identity Authentication Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Guidelines When Using Third-Party Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.5 Data Center URL Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
1.6 Sales Demo System URL Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

2 Change History. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Implementing the Common Super Domain


2 PUBLIC Content
1 Common Super Domain

SAP SuccessFactors is offering the common super domain feature to mitigate the effects caused by major browser
vendors' discontinuing support for third-party cookies on their browsers.

Vendors are discontinuing support for third-party cookies on their browsers in order to comply with new laws
created to avoid the tracking of browser behavior by advertising companies.

This deprecation impacts SAP SuccessFactors products. So, customers need to migrate all SAP SuccessFactors
HCM suite products, along with products such as Learning (LMS), Employee Central Payroll (ECP), and Onboarding
1.0 (ONB1.0).

1.1 Impact of Third-Party Cookie Deprecation on SAP


SuccessFactors Applications

We've identified the impact that the third-party cookie deprecation might have on SAP SuccessFactors
applications.

 Note

The deprecation only impacts UI integration. API and Secure File Transfer Protocol (SFTP) integrations are not
affected.

• User authentication and single sign-on (SSO) might not work.


• Embedded iFrames, where content is loaded from one of the SAP SuccessFactors products, might not load.
• SAP SuccessFactors internal product integrations might not work.
• External partner UI integrations would not work and corresponding iFrames might not load the content.
• UI embedding uses third-party cookies to offer integrations with external partners who provide HR services,
such as background verification, benefits administration, time management, and more. These integrations are
treated as third-party integrations when used within the context of SAP SuccessFactors native applications,
such as Employee Central, Recruiting, Talent, and Compensation.

1.2 Common Super Domain Example

Let's look at an example of when the common super domain is used.

Let’s say users are directly accessing SAP SuccessFactors applications using the SAP SuccessFactors access URL
performancemanager.successfactors.eu. Or admins could be integrating this URL in company’s native application.
Different products across the HCM suite have URLs that end up in different domains:

• Learning (LMS) would have a URL like <companyID>.plateau.com.

Implementing the Common Super Domain


Common Super Domain PUBLIC 3
• Onboarding 1.0 (ONB1.0) has onboarding4.successfactors.eu.
• Workforce Analytics (WFA) has analyticspreview.sapsf.com.
• Employee Central Payroll (ECP) has <systemID>.payroll.ondemand.com.

All these URLs are associated with different domains, and in the context of the SAP SuccessFactors application
URL, they are considered third parties. From the 2H 2023 release, SAP SuccessFactors is providing an automated
solution to help customers and partners migrate from the legacy domains to a new common super domain. The
URLs would then look like this:

• Learning (LMS): <companyID>.hr.cloud.sap


• Onboarding 1.0 (ONB1.0): onboarding4.hr.cloud.sap.
• Workforce Analytics (WFA): analyticspreview.hr.cloud.sap.
• Employee Central Payroll (ECP) has <systemID>.payroll.hr.cloud.sap.

1.3 Migration to the Common Super Domain

1. Prerequisites for Migrating to Common Super Domain [page 5]


Learn what you need to do before migrating to the common super domain.
2. Migration - In Scope and Out of Scope [page 5]
Learn about what's in and out of scope on common super domain (CSD) migration.
3. Migrating to the Common Super Domain [page 6]
Learn how to migrate to the common super domain.
4. Impact of CSD Migration [page 9]
Here's a checklist of items to bear in mind after migration to the common super domain (CSD).
5. Migration on Additionally Purchased Tenants [page 11]
Customers can choose to purchase and add additional preview test tenants or production dev/test tenants
in their existing landscape.
6. Additional Enhancements Outside Common Super Domain Migration [page 12]
Not every impact on SAP SuccessFactors applications arising from third-party cookie deprecation can be
addressed by updating the product access or integration domains to a common super domain (CSD).
7. Other Things You Need to Know About Migration [page 12]
There are some more things you need to know about common secure domain (CSD) migration.
8. Actions Following Migration [page 13]
Joule customers need to make some updates after migrating to the common super domain (CSD).
9. Troubleshooting [page 14]
You might encounter problems with migration to the common super domain. Here's some help on how to
resolve them.

Implementing the Common Super Domain


4 PUBLIC Common Super Domain
1.3.1 Prerequisites for Migrating to Common Super Domain

Learn what you need to do before migrating to the common super domain.

You need to do the following before migrating:

• Test, analyze, and validate whether third-party cookie deprecation has any effect on your non SAP
SuccessFactors UI integration.
• Execute migration on preview and non-productive tenants and test the application thoroughly before executing
the migration on a productive tenant.
• Clean up duplicate Assertion Consumer Services (ACS) settings:
• If duplicates are not cleaned up, customers will not be able to make any changes to these ACS records in
the UI (either provisioning UI or Admin Center) because, when they try to save, they will get a message that
duplicate entries exist.
• If duplicates are not cleaned up, they won't break any of customer/partner’s tenant’s existing ACS
behavior. So, cleanup is not required, but we do recommend it.

Parent topic: Migration to the Common Super Domain [page 4]

Next: Migration - In Scope and Out of Scope [page 5]

1.3.2 Migration - In Scope and Out of Scope

Learn about what's in and out of scope on common super domain (CSD) migration.

In Scope

Among the impact areas specified in the Impact of Third-Party Cookie Deprecation on SAP SuccessFactors
Applications part of this document, CSD migration, an automated solution from SAP SuccessFactors, solves the
following problems:

• User authentication and single sign-on (SSO) – customer or partner tenants configured to use:
• Basic authentication, meaning username and password based on SSO.
• SAP Identity Authentication Services (IAS) as the primary and only Identity Provider (IdP).
• SAP IAS as proxy along with using third-party corporate IdP.
• Embedded iFrames where content is loaded from one of the SAP SuccessFactors products.
• SAP SuccessFactors internal integrations - that is, integration between the HCM suite and Learning, Employee
Central Payroll, Stories in People Analytics, Workforce Analytics, and Onboarding 1.0.

Out of Scope

• Customers/partners using third-party IdPs such as Microsoft Azure Active Directory, Okta for Single Sign-On
(SSO) – the SSO settings on the third-party application to allow SAML assertion and build trust on *.cloud.sap
or *.sapcloud.cn needs to be configured and established in the third-party IdP.
In such cases, customers must fix any issues with third-party cookies themselves.
• External partner UI integrations and corresponding iFrames content loading. UI embedding uses third-
party cookies to offer integrations with external partners, which provide HR services, such as background
verification, benefits administration, time management, and more. These integrations are treated as third-

Implementing the Common Super Domain


Common Super Domain PUBLIC 5
party integrations when used within the context of SAP SuccessFactors native applications, such as Employee
Central, Recruiting, Talent, or Compensation.
In such cases, customers must fix any issues with third-party cookies themselves.
• Custom cards on the Home page that use iFrame with third-party-cookies.

Parent topic: Migration to the Common Super Domain [page 4]

Previous: Prerequisites for Migrating to Common Super Domain [page 5]

Next: Migrating to the Common Super Domain [page 6]

1.3.3 Migrating to the Common Super Domain

Learn how to migrate to the common super domain.

1. Access to CSD migration requires the specific Common Super Domain shown here.

2. Then access the migration function in the Upgrade Center.

Implementing the Common Super Domain


6 PUBLIC Common Super Domain
3. Run the migration.

4. Finally, run the CSD checks in the Check Tool.

Implementing the Common Super Domain


Common Super Domain PUBLIC 7
Parent topic: Migration to the Common Super Domain [page 4]

Previous: Migration - In Scope and Out of Scope [page 5]

Next: Impact of CSD Migration [page 9]

Implementing the Common Super Domain


8 PUBLIC Common Super Domain
1.3.4 Impact of CSD Migration

Here's a checklist of items to bear in mind after migration to the common super domain (CSD).

Post CSD Migration/Impact Descrip-


Impact Use Case tion Customer/Partner Action

Impact of third-party cookie deprecation N/A Analyze impact of third-party cookies


on all external integrations deprecation on all external integrations
that use SAP SuccessFactors Single
Sign-On (SSO) and/or have embedded
UI integrations within iFrames or in any
other form.

If you find the impact consider changing


iFrame into a new tab or new window,
or review some of the solution options
offered by the browser vendors and work
closely with your integrating application
owner/vendor to discuss the right option
for your use case.

Timeline: Start now.

Impact of CSD migration on your tenants Analysis work Analyze the impact of CSD migration on
your tenants.

After the CSD migration, you need to


identify and manually re-establish SSO
trust against the new domain(*.cloud.sap
or *.sapcloud.cn) wherever you have de-
pendency on SAP SuccessFactors SSO
that was formerly based on the old do-
main. Identification could be guided by
the list of Assertion Consumers Services
settings that are maintained in the SAP
SuccessFactors HCM suite.

Timeline: Do not start until migration is


completed through the Upgrade Center
against the preview and/or non-prod ten-
ants in production landscape.

Only after all of the above is done, based


on these findings, analyze and plan the
changes against the Productive tenants.

Implementing the Common Super Domain


Common Super Domain PUBLIC 9
Post CSD Migration/Impact Descrip-
Impact Use Case tion Customer/Partner Action

Tenant using third-party corporate iden- SSO doesn't work. After the CSD migration, you need
tify provider (IdP), such as Microsoft to identify and manually re-establish
Azure Active Directory. External UI integrations and SSO integra- SSO trust against the new domain
tions are impacted. (*.cloud.sap or *.sapcloud.cn) wherever
you have dependency on SAP Success-
Factors SSO that was earlier based on
the old domain. The identification could
be guided by the list of Assertion Con-
sumers Services settings.

Tenants configured to use SAP Success-


Factors basic authentication for SSO.

Tenants configured to use IAS as Proxy Make changes to your corporate IdP to
along with the third-party corporate IdP. support IAS on the new common super
domain.

Reverse proxy settings. After CSD migration, reverse proxy Make changes to your proxy settings
doesn't work.
aligning with the common super domain
SAP SuccessFactorsis introducing and
ensure to test all the related scenarios
at your end and address any issues sur-
faced due to third-party cookies depreca-
tion.

Status of integration of SuccessFactors If a learning instance is integrated with Pull migration cannot be initiated if
Platform with Learning. SuccessFactors Platorm, sealing is a pre- the integration between SuccessFactors
requisite for initiating CSD migration. In- Platform and Learning is not sealed. To
tegration sealing is validation that the in- seal, choose System Adminstration
tegration has been correctly set up so
Configuration System Configuration
that the CSD migration of Learning URLs
completes successfully. Bizx Integration Status .

Learning tenants using custom content N/A If the Learning instance includes content
server. launched from a content server hosted
outside of SAP SuccessFactors, the new
Learning instance URL that includes the
common super domain will need to be
added to the allowlist for the cross-do-
main portlet.

Learning tenants using Open Content N/A If Open Content Network (OCN) is ena-
Network, such as LinkedIn. bled in the Learning instance for one or
more vendors, the configuration in the
vendor application might need to be up-
dated. If the OCN vendor application in-
cludes any references to the legacy do-
main in the Learning instance's URL, it
will need to be updated to reference the
common super domain.

Implementing the Common Super Domain


10 PUBLIC Common Super Domain
Post CSD Migration/Impact Descrip-
Impact Use Case tion Customer/Partner Action

EnableNow integration. N/A Log a ticket to KM-SEN-MGR with the


URL of the Identity Authentication Serv-
ices (IAS) and ask to update the config-
uration on BTP (with the new domain).
The SAP team will carry out the updates
and customers can just test those.

External (Partner) UI integrations includ- Embedded iFrames with partner content Review Assertion Consumer Services
ing SolEx partners and any SSO dependency on SAP IAS will (ACS) Settings. This will provide a list of
be impacted. integrations built into your tenant. Ana-
lyze the impact for each integration and
work with partners to get it fixed.

New CSD adoption in the company’s eco- N/A The new domain (*.cloud.sap) should be
system/landscape – Allow requests from added to the company’s IT landscape if
*.cloud.sap or *.sapcloud.cn. (Firewalls this kind of allowed listing exists before
should consider requests coming from CSD migration is triggered.
these sources as authentic requests)

Parent topic: Migration to the Common Super Domain [page 4]

Previous: Migrating to the Common Super Domain [page 6]

Next: Migration on Additionally Purchased Tenants [page 11]

1.3.5 Migration on Additionally Purchased Tenants

Customers can choose to purchase and add additional preview test tenants or production dev/test tenants in their
existing landscape.

Every new tenant (greenfield) assigned to a customer will be provisioned on a common super domain (CSD) by
default. There is no need to migrate these tenants to CSD.

Parent topic: Migration to the Common Super Domain [page 4]

Previous: Impact of CSD Migration [page 9]

Next: Additional Enhancements Outside Common Super Domain Migration [page 12]

Implementing the Common Super Domain


Common Super Domain PUBLIC 11
1.3.6 Additional Enhancements Outside Common Super
Domain Migration

Not every impact on SAP SuccessFactors applications arising from third-party cookie deprecation can be
addressed by updating the product access or integration domains to a common super domain (CSD).

There are some special scenarios that need specific handling and solutioning outside CSD migration. An example is
Learning Integration with Work Zone.

The display of Work Zone within the Course Home page requires the use of third-party cookies and action
is needed to ensure that the Work Zone integration continues to function when third party cookies are not
supported in a browser. In System Administration Configuration System Configuration BizX , set
openJaminNewBrowserWindow to true.

Parent topic: Migration to the Common Super Domain [page 4]

Previous: Migration on Additionally Purchased Tenants [page 11]

Next: Other Things You Need to Know About Migration [page 12]

1.3.7 Other Things You Need to Know About Migration

There are some more things you need to know about common secure domain (CSD) migration.

• SAP SuccessFactors HCM suite-wide products will be migrated through the automated solution for CSD
migration, to avoid production integration issues.
Changes in the external integrations, such as third-party corporate identity provider (IdP), should be
synchronized with the CSD migration.
• The CSD migration can take up 30 minutes. There could be 30 minutes of UI downtime during migration.
However, backend API executions and jobs are not impacted.
• If any errors occur during CSD migration or there are issues afterwards, please log an incident under LOD-SF-
CSD.

Parent topic: Migration to the Common Super Domain [page 4]

Previous: Additional Enhancements Outside Common Super Domain Migration [page 12]

Next task: Actions Following Migration [page 13]

Implementing the Common Super Domain


12 PUBLIC Common Super Domain
1.3.8 Actions Following Migration

Joule customers need to make some updates after migrating to the common super domain (CSD).

Procedure

1. Update the trusted domains in the BTP subaccount.

2. Update the work zone destination URL in the BTP subaccount.

3. Update the IAS trusted domain in the BTP subaccount.

Implementing the Common Super Domain


Common Super Domain PUBLIC 13
Task overview: Migration to the Common Super Domain [page 4]

Previous: Other Things You Need to Know About Migration [page 12]

Next: Troubleshooting [page 14]

1.3.9 Troubleshooting

You might encounter problems with migration to the common super domain. Here's some help on how to resolve
them.

If you see this message It's this type of message: This needs to happen:

An enabled reverse proxy has been de- Warning • Reverse proxy configuration needs
tected.
to be adopted to the new domain-
that is, hr.cloud.sap.com.
• Disable reverse proxy and proceed
with migration.
• If customer does not really use re-
verse proxy then request SAP/Part-
ner to remove the configuration in
HCM provisioning.

Implementing the Common Super Domain


14 PUBLIC Common Super Domain
If you see this message It's this type of message: This needs to happen:

Open Content Network (OCN) is enabled Warning You need to update the OCN vendor ap-
in this Learning instance for one or more plication URL reference to the common
vendors. If the OCN vendor application super domain.
includes any references to the legacy do-
main in the Learning instances, you need
to update it to reference the common su-
per domain.

This Learning instance includes content Warning You need to add the new Learning in-
launched from a content server hosted stance URL that includes the common
outside of SuccessFactors. You need to super domain to the allowlist for the
add the new Learning instance URL that cross-domain proxlet.
includes the common super domain to
the allowlist for the cross-domain proxlet.

A Learning instance is integrated with Error You need to seal LMS application with
your SAP SuccessFactors Platform in- BizX company ID.
stance; however, the integration is not
sealed.

The IAS tenant is integrated with a cor- Warning Customers need to configure corporate
porate IDP, thus further configurations IDP to accommodate IAS on cloud.sap
are needed on corporate IDP to ensure domain
connection to IAS on the new common
super domain. Please make appropri-
ate changes on the corporate IDP, then
come back acknowledge that necessary
changes are made before proceeding
with this automated common super do-
main migration.

 Caution
Customers need to configure corpo-
rate IDP.

Customer IDP has been detected. Please Warning We recommend that you migrate to IAS
check the SAML2 configuration and, if as proxy to the IDP before running the
required, adapt it when migration is com- migration.Customers can run migration,
plete. but needs to manually update SAML con-
figurations in IDP.

Customer IDP has been detected. Push Error Customer, not SAP, should run the migra-
Scenario stopped. tion.

Implementing the Common Super Domain


Common Super Domain PUBLIC 15
If you see this message It's this type of message: This needs to happen:

An SSO configuration for a Solution Ex- Warning After the migration, the embedding of
tension such as OpenText, Workforce your SolEx or BTP application might not
Software, Benefit Focus or a Business work anymore. The changes required to
Technology Platform extension has been make the embedding work again are ex-
detected in "Provisioning - Authorized SP plained in the KBA. This includes chang-
Assertion Consumer Setting". ing or adding the new URLs to the config-
uration of the third-party or BTP applica-
tion.

Please check the KBA below for a de-


tailed description of the solution.

KBA 3448820

A legacy IdP-initiated SSO URL has been Warning After the migration, the IdP-initiated SSO
detected for External Benefits Adminis- won't work until you change the domain
tration in Provisioning. of the URL to the new one, as described
in the KBA.

Please check the KBA below for a de-


tailed description of the solution.

KBA 3448820

A legacy IdP-initiated SSO URL has been Warning After the migration, the IdP-initiated SSO
detected for External Time Management won't work until you change the domain
in Provisioning. of the URL to the new one, as described
in the KBA.

Please check the KBA below for a de-


tailed description of the solution.

KBA 3448820

A legacy IdP-initiated SSO URL has been Warning After the migration, the IdP-initiated SSO
detected for External Time Management won't work until you change the domain
in Provisioning. of the URL to the new one, as described
in the KBA.

Please check the KBA below for a de-


tailed description of the solution.

KBA 3448820

Parent topic: Migration to the Common Super Domain [page 4]

Previous task: Actions Following Migration [page 13]

Implementing the Common Super Domain


16 PUBLIC Common Super Domain
1.4 Guidelines on Identity Providers for Customers and
Partners

Assumptions and options for migrations are different, depending on whether you use SAP Identity Authentication
Services (IAS) as your identity provider (IdP) or you use a third-party IdP.

Guidelines When Using SAP Identity Authentication Services [page 17]


Learn about the assumptions and options governing common super domain (CSD) migration if you are
using SAP Identity Authentication Services (IAS) as your sole identity provider (IdP).

Guidelines When Using Third-Party Identity Provider [page 18]


Learn about the assumptions and options governing common secure domain (CSD) migration if you are
not using SAP Identity Authentication Services (IAS) as your identity provider (IdP).

1.4.1 Guidelines When Using SAP Identity Authentication


Services

Learn about the assumptions and options governing common super domain (CSD) migration if you are using SAP
Identity Authentication Services (IAS) as your sole identity provider (IdP).

After Migration

SAP IAS can support both ondemand.com and cloud.sap accesses at the same time, and these are available now.

IAS tenant ID will remain the same – that is, the Name under Tenant Settings page in the IAS Admin Console will
NOT change.

If the name is xxxx.xxxx.ondemand.com, then it will not change.

If this tenant name is changed, then ALL applications connected to this IAS need to update the Security Assertion
Markup Language (SAML) issuer name in each application affected. Since there could be many applications
connected to one single IAS, such a change could significantly impact the connected applications operation. If you
can migrate all the applications authenticating using SAP IAS to the same common super domain, then you can
change the IAS’s name to CSD as well.

Implementing the Common Super Domain


Common Super Domain PUBLIC 17
Execution Steps

Once done with the configuration changes described above, you can test the login and logout process on both the
SP initiate and the IAS initiate.

Expected Test Outcome

Service Provider Initiated Logins

• End users are able to log in with the new domain. They are redirected to IAS on CSD to enter their User ID and
password.
• End users can successfully log out and are redirected to the logout page under CSD.

IdP Initiated Logins

• End users are redirected to IAS (on CSD) for login and then redirected back to the SAP SuccessFactors HCM
suite on CSD.
• End users can successfully log out and are then redirected to the logout URL specified in the Manage SAML
SSO page.

1.4.2 Guidelines When Using Third-Party Identity Provider

Learn about the assumptions and options governing common secure domain (CSD) migration if you are not using
SAP Identity Authentication Services (IAS) as your identity provider (IdP).

If you are using SAP SuccessFactors products such as Learning, Employee Central Payroll, or Onboarding, or are
using partner applications, these will be migrated to CSD to avoid product integration discrepancies or issues.

Execution Options

Choose one of these options:

• Migrate to IAS as the corporate IdP, then use SAP's automated solution for migrating to CSD.

Implementing the Common Super Domain


18 PUBLIC Common Super Domain
• Perform all changes on the third-party corporate IdP and corresponding SAP SuccessFactors products
manually.
• Perform changes on the third-party corporate IdP manually, but use SAP's automated solution for the SAP
SuccessFactors side of migration. As far as possible, you should do these two things at the same time.

Suggested Manual Configuration Changes in Third-Party IdP

We suggest that you make the following manual configuration changes:

1. Identify, configure, test, and deploy other necessary changes for the specific third-party corporate IdP
deployed. For specific changes outside of the ones listed below, please check the official documentation of
your IdP vendors to reconfigure URLs aligning with CSD embedded URLs.
2. On the third-party corporate IdP side, at minimum, change the parameters equivalent to these parameters in
SAP IAS:
• Assertion Consumer Service Endpoint
• Single Logout Endpoint

In SAP SuccessFactors, review and change the redirect URLs for the third-party corporate IdP, if applicable.

1.5 Data Center URL Changes

The URLs for the relevant data centers are changing.

Data Center Environment Old URL New URL

DC22 Production https://hcm22.sapsf.com https://hcm-


ae10.hr.cloud.sap

DC22 Preview https://hcm22pre- https://hcm-ae10-pre-


view.sapsf.com view.hr.cloud.sap

DC23 Production https://hcm23.sapsf.com https://hcm-


sa10.hr.cloud.sap

DC23 Preview https://hcm23pre- https://hcm-sa10-pre-


view.sapsf.com view.hr.cloud.sap

DC30 Production https://performanceman- https://hcm-cn10.sap-


ager15.sapsf.cn cloud.cn

DC30 Preview https://hcm15pre- https://hcm-cn10-pre-


view.sapsf.cn view.sapcloud.cn

DC33 Production https://performanceman- https://hcm-


ager5.successfactors.eu eu20.hr.cloud.sap

DC33 Preview https://hcm12pre- https://hcm-eu20-pre-


view.sapsf.eu view.hr.cloud.sap

DC41 Production https://hcm41.sapsf.com https://hcm-


us30.hr.cloud.sap

Implementing the Common Super Domain


Common Super Domain PUBLIC 19
Data Center Environment Old URL New URL

DC41 Preview https://hcm41pre- https://hcm-us30-pre-


view.sapsf.com view.hr.cloud.sap

DC47 Production https://hcm47.sapsf.com https://hcm-


ca20.hr.cloud.sap

DC47 Preview https://hcm47pre- https://hcm-ca20-pre-


view.sapsf.com view.hr.cloud.sap

DC50 Production https://hcm50.sapsf.com https://hcm-


jp10.hr.cloud.sap

DC50 Preview https://hcm-jp10-pre- https://hcm-jp10-pre-


view.hr.cloud.sap view.hr.cloud.sap

DC52 Production https://hcm44.sapsf.com https://hcm-


ap20.hr.cloud.sap

DC52 Preview https://hcm44pre- https://hcm-ap20-pre-


view.sapsf.com view.hr.cloud.sap

DC55 Production https://hcm55.sapsf.eu https://hcm-


eu30.hr.cloud.sap

DC55 Preview https://hcm55pre- https://hcm-eu30-pre-


view.sapsf.eu view.hr.cloud.sap

DC57 Production https://performanceman- https://hcm-


ager.successfactors.eu eu10.hr.cloud.sap

DC57 Preview https://hcm2pre- https://hcm-eu10-pre-


view.sapsf.eu view.hr.cloud.sap

DC60 Production https://hcm17.sapsf.com https://hcm-


ca10.hr.cloud.sap

DC60 Preview https://hcm17pre- https://hcm-ca10-pre-


view.sapsf.com view.hr.cloud.sap

DC62 Production https://hcm19.sapsf.com https://hcm-


br10.hr.cloud.sap

DC62 Preview https://hcm19pre- https://hcm-br10-pre-


view.sapsf.com view.hr.cloud.sap

DC66 Production https://performanceman- https://hcm-


ager10.successfactors.com ap10.hr.cloud.sap

DC66 Preview https://hcm10pre- https://hcm-ap10-pre-


view.sapsf.com view.hr.cloud.sap

DC68 Production https://performanceman- https://hcm-


ager4.successfactors.com us20.hr.cloud.sap

DC68 Preview https://hcm4pre- https://hcm-us20-pre-


view.sapsf.com view.hr.cloud.sap

DC70 Production https://performance- https://hcm-


manager8.successfac- us10.hr.cloud.sap
tors.com/

Implementing the Common Super Domain


20 PUBLIC Common Super Domain
Data Center Environment Old URL New URL

DC70 Preview https://hcm8pre- https://hcm-us10-pre-


view.sapsf.com/ view.hr.cloud.sap

DC74 Production https://hcm74.sapsf.eu https://hcm-


eu40.hr.cloud.sap

DC74 Preview https://hcm74pre- https://hcm-eu40-pre-


view.sapsf.eu view.hr.cloud.sap

1.6 Sales Demo System URL Changes

The URLs for the relevant sales demo systems are changing.

Data Center Environment Old URL New URL

DC40 Sales Demo https:// https://hcm-us40-


hcm40sales.sapsf.com/sf/ sales.hr.cloud.sap/sf/

DC57 Sales Demo https://salesdemo.success- https://hcm-eu10-pre-


factors.eu/ view.hr.cloud.sap/sf/

DC68 Sales Demo https://hcm68sales.success- https://hcm-us20-


factors.com/sf/ sales.hr.cloud.sap/sf/

DC70 Sales Demo https://pmsalesdemo8.suc- https://hcm-us10-


cessfactors.com/sf/ sales.hr.cloud.sap/sf/

Implementing the Common Super Domain


Common Super Domain PUBLIC 21
2 Change History

Learn about changes to the documentation for the common super domain in recent releases.

1H 2024

Type of Change Description More Infp

New We've added information on some up- Actions Following Migration [page 13]
dates Joule customers need to make af-
ter migrating to the common super do-
main.

2H 2023

Type of Change Description More Info

March 2024

Added We added information on what you need Troubleshooting [page 14]


to do when warning or error messages ap-
pear in connection with migration.

Added We added information on changes to sales Sales Demo System URL Changes [page
demo system urls. 21]

December 2023

New This is the first version of this guide.

Implementing the Common Super Domain


22 PUBLIC Change History
Important Disclaimers and Legal Information

Hyperlinks
Some links are classified by an icon and/or a mouseover text. These links provide additional information.
About the icons:

• Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements
with SAP) to this:

• The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.

• SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any
damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

• Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering an SAP-hosted Web site. By using such links,
you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information.

Videos Hosted on External Platforms


Some videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any
advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within the
control or responsibility of SAP.

Beta and Other Experimental Features


Experimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by
SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use the
experimental features in a live operating environment or with data that has not been sufficiently backed up.
The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your feedback
(e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example Code
Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and
phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example
code unless damages have been caused by SAP's gross negligence or willful misconduct.

Bias-Free Language
SAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities, genders,
and abilities.

Implementing the Common Super Domain


Important Disclaimers and Legal Information PUBLIC 23
www.sap.com/contactsap

© 2025 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form


or for any purpose without the express permission of SAP SE or an SAP
affiliate company. The information contained herein may be changed
without prior notice.

Some software products marketed by SAP SE and its distributors


contain proprietary software components of other software vendors.
National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for


informational purposes only, without representation or warranty of any
kind, and SAP or its affiliated companies shall not be liable for errors or
omissions with respect to the materials. The only warranties for SAP or
SAP affiliate company products and services are those that are set forth
in the express warranty statements accompanying such products and
services, if any. Nothing herein should be construed as constituting an
additional warranty.

SAP and other SAP products and services mentioned herein as well as
their respective logos are trademarks or registered trademarks of SAP
SE (or an SAP affiliate company) in Germany and other countries. All
other product and service names mentioned are the trademarks of their
respective companies.

Please see https://www.sap.com/about/legal/trademark.html for


additional trademark information and notices.

THE BEST RUN

You might also like