3481641 - Viewing pay statements via SF Mobile App asks for additional authentication

You have enabled SAP IAS as your IDP and when trying to access a pay statement in PDF format in a mobile device via the native SAP SuccessFactors app, you are being prompted to enter your IAS credentials manually.
NOTES:
-This impacts both Android and iOS devices.
-This KBA is also applicable to non-IAS customers who encounter a connection reset error in the hybrid screen of their mobile pay statement.

SAP SuccessFactors Mobile App

The SAP SuccessFactors native Mobile app was not leveraging IAS authentication directly. Instead, it used to get a BizX token when a user accessed payroll information which subsequently relied on an IAS token. This process required a separate login process, thus a new prompt for IAS credentials was triggered (pop-up screen).

Short-term workaround (Fully Delivered/Issue Resolved):

Users enter their credentials manually when prompted, this ensures access to the App until the session expires.
Please note this behavior was already present in Android devices. The enhancement on iOS became available in the Salesdemo environments during the 2407 monthly release. It was then delivered to all customer environments during the 2H 2024 release.

Our internal reference: MOB-87448. 

Permanent solution:

Please see the steps in the Resolution section, below.

1. Go to Transaction Code SOAUTH2, Select EC_ESS_OAUTH Client ID, Click on Edit.
   

2. In the list of Scope Assignment, enter HRSFEC_PAYSLIP_PDF_SRV_0001, click Enter and Save.
   

3. Go to Transaction PFCG, give the Z custom role that you want to use to assign OAuth Scope authorizations
   

4. Go to Menu Utilities and select Role Menu Comparison, give your Z role in Role field, Give SAP_CLOUD_ESS_OAUTH in Comparison Role, Click on Adjust
   

5. Move HRSFEC_PAYSLIP_PDF_SRV_0001 from the right to the left side and save:
   

6. From the Menu Tab of your custom role, add the following Authorization Default and Save:
   

7. In the screen below, click on Expert Mode for Profile Generation:
   

8. Select the following option and click on Continue:
   

9. Add HRSFEC_PAYSLIP_PDF_SRV_0001 for OA2_Scope as shown below:
   

10. Save and Generate the Profile.

11. After completion, the Authorizations tab should be displayed in Green:
    

12. Go to transaction code /n/iwfnd/maint_service. Filter for service HRSFEC_PAYSLIP_PDF_SRV and confirm that the ICF Node and System Alias are available as follows. If not available, please create them:
    

IMPORTANT:

It is required that the ECP system should be upgraded to following SP levels for the corresponding components:

EA-HR                 Release 608 – SP E5

S4HCM              Release 100 – SP 34

S4HCM              Release 101 – SP 21

Set up Single Sign-On and Log-Out Using SAML 2.0

Pay Statement

MOB-85140, KI2405, IAS, IDP, Mobile, mobile app, iOS, Android, credentials, password, successfactors, SFSF, SF, payslip, pay statement, MOB-87448, MOB-91552, PAY-31128, app, 1h 2025, 2505, release , KBA , LOD-SF-INT-MAS , SF Mobile APP Pay Statement Mashup , LOD-EC-GCP-PY-MAS , Employee Data Maintenance via Mashups , LOD-SF-PLT-MOB , Mobile Issues , LOD-EC-GCP-PY-PST , EC Payroll Pay Statement , Known Error