2187183 - SFTP Account Standards for SAP SuccessFactors

This article explains the standards for SuccessFactors SFTP accounts. The account related topics include:

1. How to Request a SFTP Account & how many accounts a customer can have?
2. How are accounts named?
3. Do SFTP accounts have expiration dates?
4. Do SFTP passwords have to be changed?
5. If password has been forgotten, can it be recovered?
6. Is password-less authentication possible?
7. Can customers create their own key pair to authenticate on SFTP servers?
8. How does the customer Data Retention Standard works?
9. What is the Maximum Storage supported in a SFTP Account?
10. What is the Maximum File Count Restrictions?
11. What is the File Naming Standard?
12. Attempt to block the SFTP Account
13. SFTP Folder access limitations in SuccessFactors
14. Is it possible to recover a deleted file from SuccessFactors SFTP Server?
15. SFTP Allowlisting / IP Restriction requests
16. Are Client/third-party SFTP allowed?
17. Is it possible to have temporary SFTP account?

SAP SuccessFactors HCM Suite

1. How to Request a SFTP Account & how many accounts a customer can have?

• KBA 2278826 - SAP SuccessFactors SFTP Account Details provides full information on this details.

1.1. Connecting Test SFTP Development Instance

• A customer's test SFTP account details can be used to set up the scheduled jobs of their development instance.
• The customer/Partner/Professional Services consultant working on their behalf needs to configure this set up.
• To do this, the customer/Partner enters the test SFTP account username and password into the scheduled job in their development instance and alters the file path URL so that the files are saving to a different location in the FTP folder.

1.2. Establishing Connection

• Establish connection only if an operation needs to be performed
• Close connection once the operation is performed and no operations are expected within 3 minutes

Reason for guidance: There is a tendency that clients connecting inbound are opening multiple connections at once, not transferring files and not closing their connections gracefully. The number of these types of connections can be of a large amount (>1mill / 24h) and this results in overloading the EFT service. Every time a user connects to the EFT server it results in a read to the network file share. EFT requests this information so it can return the file listing (folders and files) to the user upon successfully logging in. Depending on the amount of data in the folders and how many requests are coming in to the server this will put a large load on the network file share storage which is why the EFT service can struggle to respond.

2. How are accounts named?

• New SFTP account names will typically match the existing customer Company ID or customer account number.
• SAP recommends keeping account username unchanged. Altering it might lead to data issues in connected systems.

3. Do SFTP accounts have expiration dates?

• No — SAP SuccessFactors SFTP accounts themselves do not have expiration dates in the traditional sense. However, there is an important distinction regarding data stored within those accounts: all files stored in SuccessFactors SFTP accounts are subject to a 14-day data retention (purge) policy, after which files are permanently deleted and cannot be restored.
  
• More information can be found in KBA 2620488 - SuccessFactors SFTP service Purge Policy update

4. Do SFTP passwords have to be changed?

• No - The password will be autogenerated with the following conditions:

  • Minimum 12-character length
  • At least 4 [a-z], [upper case A-Z] [numeric (digits 0-9)], [non-alpha numeric (e.g., !,#,$)]

  Note: Currently the password changes only available via a support ticket, web interface is not allowed. This means that a password cannot be chosen by customers.

5. If password has been forgotten, can it be recovered?

• Yes - KBA 2278826 - SAP SuccessFactors SFTP Account Details provides full information on this details.
• It is the customer responsibility to update all the integrations using the SFTP account with the new password after the password reset to avoid any existing jobs using this password to fail to connect to the SFTP.

• See KBA 2149831 - SAP Professional Services / SAP Certified Partner / SAP Account Management Team [SuccessFactors Cloud] to contact Professional Services, Partner and Account Management Team to arrange any existing jobs with new SFTP account passwords from partner/consulting.

6. Is password-less authentication possible?

• The use of key pairs to provide password-less authentication is supported.
• SuccessFactors strongly recommends the use of password-less authentication. This is especially useful for enabling automation functionality while avoiding scripts which contain references to secure passwords.

7. Can customers create their own key pair to authenticate on SFTP servers?

• Yes — customers can create their own SSH key pair to authenticate on SAP SuccessFactors SFTP servers.
  Customers generate the SSH public and private key pair from their own server (using tools such as ssh-keygen, PuTTYgen, or OpenSSL), retain the private key on their side, and provide only the public key to SuccessFactors for installation on the SFTP account.
• KBA 2653173 - Generating SSH Key pair and uploading on SuccessFactors SFTP servers provides full information on this.

8. How does the customer Data Retention Standard works?

• Timeline: All SFTP stored data has a lifecycle of 14 days maximum. This rule is implemented to maintain a reasonable storage availability.
• Encryption: All SFTP stored data is kept in the same form as it is sent by the customer. No encryption on stored files is currently implemented.

8.1. Extend Data Retention Lifecycle

• This is currently not possible.

8.2. Large File Removal Standard

• SF/SAP SFTP Support maintains the right to remove large data files, either in single file or in aggregate form which causes significant negative impact on our storage availability.
• If stored files are presenting a critical issue to other customers because of exhausted storage volume resources, SAP may remove these files with express approval of Management.
• Management will notify the customer prior to service request fulfillment.

9. What is the Maximum Storage supported in a SFTP Account?

• Currently, there is no storage limit on the SFTP accounts.

• All SFTP stored data has a lifecycle of 14 days maximum and can be removed in shorted time, as per mentioned in item 8.2.

10. What is the Maximum File Count Restrictions?

• If a folder is found to contain more than 20k files without the use of subfolders, the account runs the risk of being disabled until the files are organized into smaller separated containers.
• This restriction is in place due to the large memory hit which occurs when automation must iterate the metadata associated with files located in a target directory.
• If concurrent connections exist for a single user with high file counts, this can negatively impact the performance and can result in a service degradation for all users.
• All user folders are monitored for total file count

11. What is the File Naming Standard?

• GlobalScape products follow the standard Windows naming conventions, with a few exceptions (such as no support for Unicode characters).
• Customers can name files using almost any character for a name, except for the following reserved characters: < > : " / \ | ? *
• The maximum length for the file path+name is 255 characters.
  • This 255-character length limit is for the entire path on the FTP server, which includes:
    • A prefix path before the customer visible path, which is not visible for the customer or external systems.
      • The length of this prefix is not identical for all different datacenters; these prefixes can be 60-80 characters. 
    • The path provided by the customer for the file.
    • The file name.
  • This limitation includes the drive letter, colon, backslash, directories, subdirectories, filename, and extension
  • Due to limitation, the file path+name+extension should be under 175 (so that at least 80 characters are kept from the total limit for the prefix path)

12. Attempt to block the SFTP account

• SFTP accounts are restricted to a maximum of 10 concurrent connections.
• Concurrent connectionsmay affect the speed at which large volumes of files can be transferred in or out.

13. SFTP Folder access limitations in SuccessFactors

• SFTP does not allow assigning permissions at an individual folder level.
• It is not possible to restrict a user to only one folder or grant access to specific directory paths.
• The current EFT server setup does not support assigning read-only access for a particular folder.

14. Is it possible to recover a deleted file from SuccessFactors SFTP Server?

Currently it is not possible to restore deleted files.

15. SFTP Allowlisting / IP Restriction requests

Due to security reasons and server performance impact, we no longer support new requests for SuccessFactors SFTP Allowlisting / IP Restriction.

• If there is an existing IP allowlist opened in the past for a SuccessFactors SFTP account, and there is a business need to add new IP addresses or ranges to it, those requests can be accommodated through support ticket (LOD-SF-PLT-FTPS). These requests include also enabling IP filtering to allow specific addresses and block all others. 
• Requests to open a brand new allowlist for any SFTP account are not supported.

16. Are Client/third-party SFTP allowed?

• SFTP Client such as FileZilla, WinSCP, etc. are allowed to be used - refer to item 1.2. Establishing Connection Please for further guidance.
• SAP Support does not provide assistance with utilizing 3rd party SFTP Clients.

• To be able to connect the SuccessFactors (SF) instance to a new external/third-party SFTP, it is necessary to allowlist:

  • SAP's Data Centers IPs in the third-party servers - refer to KBA 2395508 - How to connect SuccessFactors to a new third-party site (allowlist on third-party side)
  • Third-party site IPs in SAP servers - refer to KBA 3122406 - How to connect SuccessFactors to a new third-party site (allowlist on SAP side)

17. Is it possible to have temporary SFTP account?

Currently, creation of temporary SFTP accounts is not supported.

• KBA 2278826 - SAP SuccessFactors SFTP Account Details
• KBA 2620488 - SuccessFactors SFTP service Purge Policy update
• KBA 2653173 - Generating SSH Key pair and uploading on SuccessFactors SFTP servers
• KBA 2395508 - How to connect SuccessFactors to a new third-party site (allowlist on third-party side)
• KBA 3122406 - How to connect SuccessFactors to a new third-party site (allowlist on SAP side)

sf, successfactors, FTP, Retention Accounts, block, block account, naming, account naming, Allowlisting, allow list, whitelisting, white list, SFTP Account Standards, Request SFTP Account, SFTP folder, platform, deleted file, recover, temporary, storage, size, limit, maximum, retention time, purge, file, folder, limited access, read only , KBA , LOD-SF-PLT-FTPS , SFTP Account Creation, Reset Password & Install SSH Service , How To