Symptom
You are using the SAP SuccessFactors Native Login (not using IAS) and creating user accounts through User OData API, providing a predefined password in the Upsert payload.
The Upsert is successful, but the password provided in the API payload doesn't work when the employee attempts to login.
Environment
- SAP SuccessFactors HCM Suite
- Native Login
- OData API
Reproducing the Issue
- Create a new user in SuccessFactors using OData API.
- Set a predefined password for the user via the API payload.
- Attempt to log in using the predefined credentials.
- Observe that the login fails, and the user is redirected to the sign-in page.
Cause
The option "Password Expiry for Long-Time Unused Passwords" is enabled in "Password & Login Policy Settings" tool.
The system considers users created with a predefined password via OData API as users who have never logged in and never used their initial password. This results in the policy blocking login attempts for such users.
It will block newly created users' login when all 5 conditions below are true:
- The user is newly created.
- The user has a predefined password set via API or import.
- The user has never logged in before.
- The user has not used "Forgot Password?" to reset password.
- The "Password Expiry for Long-Time Unused Passwords" policy is enabled.
Resolution
There are two possible solutions:
Option 1
New users can use the "Forgot Password?" button on the login page. They will receive a password reset email, and once they reset the password, they can log in normally.
Option 2
Disable "Password Expiry for Long-Time Unused Passwords" in the "Password & Login Policy Settings" tool.
See Also
Keywords
OData API, predefined password, login failure, password expiry policy, SuccessFactors, Password & Login Policy settings, user creation, authentication, loginMethod , KBA , LOD-SF-INT-ODATA , OData API Framework , LOD-SF-PLT-MNG , Manage user Issues , Problem
SAP Knowledge Base Article - Public