Azure Data Factory : Successfactors OAuth challenge

Hi @RENOUD Thomas ,

Azure Data Factory (ADF) can integrate with REST APIs and supports OAuth using REST connector or Web activity chaining (token → API call).

However, for SAP SuccessFactors, OAuth is typically implemented using the SAML Bearer Assertion flow, where the token request requires:

• grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer
• assertion=<Base64 encoded SAML assertion>
• ADF REST connector supports multiple authentication types including:
  • OAuth2 Client Credential
  • Service Principal
  • Managed Identity
• For OAuth2 Client Credential flow, ADF expects:
  • tokenEndpoint
  • clientId
  • clientSecret
  • scope/resource
• This model assumes a direct token exchange (client → token endpoint)

SuccessFactors OAuth (Important Difference)

• Token is issued via /oauth/token
• Requires a pre-generated and signed SAML assertion
• Requires trust with an identity provider (certificate-based SAML)
• Token response includes access_token, token_type, expires_in

This makes the flow: **SAML Assertion → OAuth Token → API Call
**ADF Capability vs Requirement

• Web Activity in Azure Data Factory
  • Can call REST endpoints
  • Can pass outputs between activities
  • Can dynamically build headers like:
    Authorization: Bearer <token>
• BUT:
  • No native feature to generate SAML assertions
  • No built-in certificate-based signing or XML transformation logic
  • No identity federation orchestration inside pipelines

In Azure Data Factory, the REST connector operates as a stateless component, meaning it does not manage token lifecycle such as caching, refresh, or reuse, and these aspects must be handled externally. While ADF supports capabilities such as pagination, custom headers, and dynamic expressions for REST calls, the expectation is that authentication or identity flows (such as OAuth token acquisition) are already resolved before invoking the API. Additionally, when using Web Activity - Azure Data Factory & Azure Synapse, there is a response payload limitation of around 4 MB, which can affect scenarios involving large token or service responses. For security, sensitive values like client secrets or tokens must be stored using secure mechanisms such as SecureString or integrated secret stores (for example, Azure Key Vault), and while ADF supports certificate-based authentication, this is limited to client certificate usage and does not extend to generating or signing SAML assertions within the pipeline

Conclusion

• Works directly in ADF:
• If SuccessFactors supports standard OAuth2 Client Credentials
• Not fully supported in ADF alone:
  • If SuccessFactors requires SAML Bearer Assertion, because:
    • Assertion must be generated and signed before /oauth/token
    • ADF does not provide native support for this cryptographic/federation step

The Set up Microsoft Entra ID using SAP SuccessFactors documentation applies to the Power Platform SAP OData connector (SSO scenario), not generic ADF ingestion or REST authentication patterns.

References

• Copy and transform data from and to a REST endpoint - Azure Data Factory & Azure Synapse [Copy and t...soft Learn | Learn.Microsoft.com]
• Web Activity - Azure Data Factory & Azure Synapse [Web Activi...soft Learn | Learn.Microsoft.com]
• SAP SuccessFactors OAuth token API
• Set up Microsoft Entra ID using SAP SuccessFactors - Power Platform [Set up Mic...soft Learn | Learn.Microsoft.com]

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.