Install Adobe Acrobat Sign for SAP SuccessFactors on Cloud Foundry

Last updated on Aug 24, 2026

Install and configure Adobe Acrobat Sign for SAP SuccessFactors in the SAP BTP Cloud Foundry environment.

The installation includes these main stages:

Register and prepare SAP SuccessFactors.
Create the required SAP BTP services.
Configure single sign-on and destinations.
Optionally configure persistent credential storage.
Deploy Adobe Acrobat Sign for SAP SuccessFactors.
Provision SAP SuccessFactors.
Connect SAP SuccessFactors to Adobe Acrobat Sign.
Optionally configure the Job Application status.
Troubleshoot installation and connection issues.

Register and prepare SAP SuccessFactors

Register your SAP SuccessFactors system in your global SAP BTP account to generate the integration token used to configure the integration.

In the SAP BTP cockpit, navigate to your global account, and then select System Landscape > Systems.

In the Systems panel, select Register System.

In the Register System dialog:

Enter a name for the system. We recommend sap_hcmcloud_core_odata.
From Type, select SuccessFactors.
Select Register.

Copy the integration token, and then close the dialog.

The SAP SuccessFactors system appears in the registered systems list with a Pending status until configuration is complete.

Configure the integration in SAP SuccessFactors using the method available in your environment.

Configure using Extension Center:

In SAP SuccessFactors Admin Center, navigate to Extension Center.

Note

If you don't have permission to access Extension Center for the SAP SuccessFactors system, provide the integration token to a user who does.

On the Extensions on SAP BTP tab, navigate to Add Integration with SAP BTP.

Paste the integration token into Integration Token, and then select Add.

The system appears in the integration list on the Multi-Cloud Environment screen.
Check the Integration Status column.
To refresh the status, select Check Status and wait for the integration to complete.

Verify the registration in SAP BTP:

Navigate to your global account.
On the Systems page, verify that the system status has changed to Registered.
If you're already on the Systems page, refresh the page to update the status.

Configure the SAP SuccessFactors Extensibility entitlements for the subaccount and assign the api-access service plan to the registered system.

In the SAP BTP cockpit, navigate to your global account.

Select Entitlements > Entity Assignments.

From Select Entities, select your subaccount, and then select Go.

Select Configure Entitlements.

Select Add Service Plans, and then select SAP SuccessFactors Extensibility.

Under Available Service Plans, select:

The system you registered.
The api-access service plan.

Select Add Service Plan, and then save the changes.

You must be a Cloud Foundry administrator to complete this procedure.

In your global account, select Entitlements > Entity Assignments.

If Cloud Foundry Runtime isn't listed, select Configure Entitlements.

Select Add Service Plans.

In the dialog:

Select Cloud Foundry Runtime.
Under Available Service Plans, select MEMORY.
Select Add 1 Service Plan.

On the Entity Assignments page, in the Cloud Foundry Runtime service row, select + to add at least one quota to the subaccount.

Select Save.

Create the required SAP BTP services

Create a Destination service instance for access to the SAP SuccessFactors HXM Suite OData APIs.

In the SAP BTP cockpit, navigate to your subaccount and select Services > Service Marketplace.

Search for the Destination service.

From the Destination service tile, select Create and follow the wizard.

Under Basic Info, configure:

Plan: Lite
Runtime Environment: Cloud Foundry
Space: The space you're working with
Instance Name: destination

Under Parameters, leave the JSON field empty.

Review the configuration and select Create.

In the SAP BTP cockpit, navigate to your subaccount and select Services > Service Marketplace.

Search for Connectivity Service.

From the Connectivity Service tile, select Create and follow the wizard.

Under Basic Info, configure:

Plan: lite
Runtime Environment: Cloud Foundry
Space: The space you're working with
Instance Name: connectivity

Under Parameters, leave the JSON field empty.

Select Create.

Create the SAP SuccessFactors Extensibility service instance used to access the SAP SuccessFactors APIs.

In the SAP BTP cockpit, navigate to your subaccount and select Services > Service Marketplace.

Search for SAP SuccessFactors Extensibility.

From the SAP SuccessFactors Extensibility service tile, select Create and follow the wizard.

Under Basic Info, configure:

Plan: api-access
Runtime Environment: Cloud Foundry
Space: The space you're working with
System Name: Your registered SAP SuccessFactors system
Instance Name: sap_hcmcloud_core_odata

Under Parameters, leave the preconfigured JSON unchanged and select Next.

Select Create.

Create an Authorization and Trust Management (XSUAA) service instance for authentication.

In the SAP BTP cockpit, navigate to your subaccount and select Services > Service Marketplace

Search for Authorization & Trust Management.

From the service tile, select Create and follow the wizard.

Under Basic Info, configure:

Plan: application
Runtime Environment: Cloud Foundry
Space: The space you're working with
Instance Name: xsuaa

Under Parameters, provide:

{
"xsappname": "extension-app",
"tenant-mode": "dedicated"
}

Select Create.

Configure single sign-on and destinations

Single sign-on configuration requires two procedures:

Establish trust between SAP SuccessFactors and SAP BTP.
Register the Assertion Consumer Service for the subaccount in SAP SuccessFactors.

Establish trust between SAP SuccessFactors and SAP BTP

Download the SAML metadata from SAP SuccessFactors:

Open:

https://<sap_successfactors_system>/idp/samlmetadata?company=<company_id>&cert=sha2

where:
- <sap_successfactors_system> is the hostname of your SAP SuccessFactors system.
- <company_id> is your SAP SuccessFactors company ID.
When prompted, save the file locally and change its extension to .xml.

Open the SAP BTP cockpit and navigate to your subaccount.
Select Security > Trust Configuration.
Select New Trust Configuration.

Select Upload, and then select the XML file you downloaded.

Some fields are populated automatically. In Name, enter a valid name for the trust configuration.

Make the SAP SuccessFactors identity provider the only trust configuration available for user logon:

For each other trust configuration, open edit mode and deselect Available for User Logon.
Select Save.

Register the Assertion Consumer Service

Download the service-provider SAML metadata from SAP BTP:

Navigate to your subaccount and select Security > Trust Configuration.
Select SAML Metadata to download the SAML 2.0 metadata XML file.
Open the XML file in a text editor and record:
- The Location value of the AssertionConsumerService element using HTTP-POST binding.
- The Location value of the SingleLogoutService element using HTTP-POST binding.
- The EntityID value of the EntityDescriptor element.

In SAP SuccessFactors Provisioning, open your company and select Authorized SP Assertion Consumer Service Settings under Service Provider Settings.

Select Add another Service Provider ACS, and configure:

Assertion Consumer Service: Enter the Location value from the AssertionConsumerService element.
Logout URL: Enter the Location value from the SingleLogoutService element.
Audience URL: Enter the EntityID value from the EntityDescriptor element.
Application Name: Select SAP Business Technology Platform.

Go to your subaccount and select Destinations.
Edit the sap_hcmcloud_core_odata destination, select Dedicated, and then select Save.

Note

Even if Dedicated already appears selected, select it again and save the destination.

Create the sap_hcmcloud_core_tech technical destination for background callbacks, such as notifications that an offer letter was sent, signed, declined, approved, or expired. Because callbacks run without a signed-in user, the destination requires its own authentication.

The technical destination supports OAuth 2.0 client credentials through SAP Identity Authentication Service, client-certificate authentication using mutual TLS, and Basic authentication. Choose the method appropriate for your environment.

Option A — OAuth 2.0 client credentials

Configure SAP IAS and SAP SuccessFactors

Complete steps 1–20 in SAP's Register Your Own Application to Communicate with SAP SuccessFactors HCM Suite with OpenID Connect procedure.

In SAP SuccessFactors, navigate to Security Center > Manage OIDC OAuth Client Application.

For the client application created in step 14 of the SAP procedure, bind an administrator using Bind to User.

For steps 19–20 of the SAP procedure, use Bind to User.

Create the destination in SAP BTP

Open your subaccount.

Select Destinations.

Select Create > From Scratch.

Configure:

Name: sap_hcmcloud_core_tech
Type: HTTP
Proxy Type: Internet
URL: The same endpoint used by sap_hcmcloud_core_odata
Authentication: OAuth2ClientCredentials
Client ID: Client ID created in step 12 of the SAP OpenID Connect procedure
Client Secret: Client secret created in step 12
Token Service URL: https://<ias-host>/oauth2/token
Token Service URL Type: Dedicated

Add these additional properties:

sf.api.user.name: An SAP SuccessFactors user that exists in the account
tokenService.body.resource: urn:sap:identity:application:provider:name:<dependency-name>

Use the dependency name created in step 10 of the SAP OpenID Connect procedure.

Create the destination.

Option B — Client certificate authentication using mutual TLS

Create the certificate in SAP BTP

In SAP BTP, go to Destination Certificates and select Create.

Configure:

Name: Any preferred name, such as sf_mtls
Generation Service: SAP Certificate Service
File Extension: PEM
Common Name (CN): sf_mtls.pem
Validity: 1 year
Automatic Renewal: On

Create the certificate.

Export the certificate and retain the downloaded file.

Create the destination

Go to Destinations.

Select Create > From Scratch.

Configure:

Name: sap_hcmcloud_core_tech
Authentication: ClientCertificateAuthentication
Type: HTTP
Key Store Source: DestinationService
Key Store Location: The location provided when generating the certificate
Key Store Password: The password specified when generating the certificate, if applicable
Proxy Type: Internet
URL: The SAP SuccessFactors mTLS certificate server for your data center, for example https://api<dc>.cert.sapsf.com

Add:

Key: sf.api.user.name
Value: An SAP SuccessFactors user in your account that is mapped to the X.509 certificate

Create the destination.

Map the certificate in SAP SuccessFactors

In SAP SuccessFactors, navigate to Security Center > X.509 Public Certificate Mapping and select Add.

Configure:

Configuration Name: Any preferred name
Integration Name: Business Technology Platform
Certificate File: Upload the certificate exported from SAP BTP
Login Name: The same SAP SuccessFactors user specified in sf.api.user.name

Save the mapping.

Option C — Basic authentication

Basic authentication remains supported.

Go to your subaccount and select Destinations.

Create a new destination and configure:

Name: sap_hcmcloud_core_tech
Type: HTTP
Destination: sap_hcmcloud_core_tech
URL: The same endpoint used by sap_hcmcloud_core_odata
Proxy Type: Internet
Authentication: BasicAuthentication
User: <yourAPIuser@company>

Select Save.

Validate the destination

Validate the technical destination before using it with the integration.

Existing installations

If sap_hcmcloud_core_tech already exists:

Create the new destination using the temporary name sap_hcmcloud_core_tech_test.

Validate the temporary destination.

After validation succeeds, delete or rename the existing destination.

Rename the tested destination to sap_hcmcloud_core_tech.

This lets you validate the new configuration without disrupting the active integration.

New installations

Create the destination directly as sap_hcmcloud_core_tech, and then validate it.

Run the health check

While signed in to the application, open:

https://<your-app-host>/DestinationHealthCheck?destination=<destination-name>&api=User?$top=1

For example:

https://<your-app-host>/DestinationHealthCheck?destination=sap_hcmcloud_core_tech_test&api=User?$top=1

An HTTP 200 response confirms that the destination is configured correctly and can connect to SAP SuccessFactors.

If validation fails, review the destination authentication configuration and try again.

Configure optional persistent credential storage

By default, users must sign in to Adobe Acrobat Sign again after the SAP BTP application restarts. Optionally, use an SAP HANA database to retain credentials across restarts.

Verify that an SAP HANA database is available in the SAP BTP subaccount where the application is deployed.

Navigate to Services > Service Marketplace.

Search for SAP HANA Schemas & HDI Containers.

From the service tile, select Create and follow the wizard.

On Basic Info:

Select SAP HANA Schemas & HDI Containers.
For Plan, select schema.
For Instance Name, enter hana_adobe.
Select Next.

On Parameters:

1. Enter:

{
"schema": "hana_adobe"
}

2. Select Next.

3. On the next page, select Create.

4. For a pre-existing HANA_ADOBE database schema, verify that the ADOBEADMIN table contains the required columns. If required, add the missing columns:

ALTER TABLE HANA_ADOBE.ADOBEADMIN ADD(
OAUTH_STATE VARCHAR(150),
OAUTH_STATE_DATE VARCHAR(150)
);

After the service instance is created, it automatically links to the HANA database.

Deploy Adobe Acrobat Sign for SAP SuccessFactors

Download SuccessFactors_Deployment_Package_2026_v5_0_0.zip and extract it to a local folder.

Open manifest.yml in an editor and replace:

<company> with your company value.
<api> with the API value from the SAP BTP cockpit.

Example values:

<company> = 10384
<api> = eu10.hana.ondemand.com

Example application configuration:

name = AcrobatSign--10384
memory = 1024M
timeout = 300
route = adobesign10384.cfapps.eu10.hana.ondemand.com

Verify that the Adobe Acrobat Sign application uses:

sap_hcmcloud_core_odata
xsuaa
destination
connectivity

Note

If you configured SAP HANA to retain user credentials, remove the leading # to enable the hana_adobe service in manifest.yml.

Verify that the Application Router uses only:

xsuaa

Enable the applicable parameters by removing the leading # from the corresponding lines in manifest.yml:

SF_OPERATOR_AS_APPROVER: Maps the property name of type JobRequisitionOperator used for the approver workflow. The approver's email address is automatically populated in the recipient configuration.
SF_OPERATOR_AS_CC: Maps the JobRequisitionOperator property used for the CC workflow. The specified operator's email address is automatically populated in the CC field.
JOB_APP_STATUS_LABEL_FOR_OFFER_REJECTED: Updates the Job Application status to a value other than the default Declined Offer when the candidate rejects the offer letter.
CUSTOM_FIELD_NAME_FOR_OFFER_STATUS: Maps the custom text field used to track offer-letter status. When configured, updates to the standard Status field are blocked.

Example values:

SF_OPERATOR_AS_APPROVER: sourcer
SF_OPERATOR_AS_CC: hiringManager
JOB_APP_STATUS_LABEL_FOR_OFFER_REJECTED: Declined Offer
CUSTOM_FIELD_NAME_FOR_OFFER_STATUS: cust_adobeOffer_status

The Template Settings page with the custom Field ID value highlighted.

Configure actor tracking

The integration can record the email address of the next signer or pending approver in a Job Application custom field. Create the field, and then set:

CUSTOM_FIELD_NAME_FOR_ACTOR: <Job Application custom field name>

When configured, the integration:

Stores the next signer's email address when a signature is pending.
Stores the pending approver's email address while approval is pending.
Clears the field when the agreement is signed, declined, or expires.

If CUSTOM_FIELD_NAME_FOR_ACTOR isn't set, actor tracking is disabled. If the configured field isn't a valid Job Application property, the actor update is skipped without affecting offer-status updates.

Set IS_OFFER_SENDER_ADMIN to false to allow individual SAP SuccessFactors users, such as recruiters, to send agreements instead of an administrator.

Save manifest.yml in the same folder.

Download and install the Cloud Foundary Command Line Interface, as follows:

Go to the SAP Development Tools.
Under SAP BTP Command Line Interface (btp CLI), download the BTP Command Line Interface file for your operating system.

Open the CF console and connect to the SAP BTP account:

Run cf api <api-name>, where <api-name> is available from the SAP BTP cockpit.
Run cf login to authenticate to the subaccount.

Deploy the application:

cf push -f <PATH_TO_APP_MANIFEST>

After deployment, verify in the SAP BTP cockpit that these applications are running:

The Adobe Acrobat Sign application endpoint, used to configure SAP SuccessFactors tiles and templates.
The Adobe Acrobat Sign application router endpoint, used by the SAP SuccessFactors template button.

Note

To create or update an application parameter after deployment, go to User-Provided Variables. Select Edit to modify an existing parameter or Create Variable to add one, and then restart the application.

Application dialog with access to user-provided variables

Configure SAP SuccessFactors

After deployment, configure SAP SuccessFactors for the integration.

Add a field for storing signed offer letters

Open Provisioning and download the Job Requisition and Application Template.

Add the following adobeSignAttachment field definition to the Requisition application template:

<field-definition id="adobeSignAttachment"
    type="multiattachment"
    required="false"
    custom="true"
    public="false"
    readOnly="false"
    anonymize="false"
    forward-intact="false"
    sensitive="false">
    <field-label mime-type="text-plain"><![CDATA[Adobe Offer Signed]]></field-label>
    <field-description><![CDATA[Adobe Offer Signed]]></field-description>
</field-definition>

Add field permissions based on the single-stage or multi-stage implementation method.

Upload the templates in Provisioning and verify the changes.

Add a button for saving offer letters

Open Provisioning and export the language pack.

Refer to this Example Source file from Provisioning.

Select your language, and then select Download default labels.

Modify the downloaded CSV as shown in the existing example, and import the updated language pack into Provisioning.

Refer to this Example language pack file to be uploaded to provisioning.

Create a field for the offer letter in the Candidate Profile

Modify the 'Candidate Profile Template' XML by adding the following lines:

Field definition:

<field-definition sensitive="false"
    anonymize="false"
    custom="true"
    required="false"
    type="text"
    id="cust_offerLetter">
    <field-label mime-type="text-plain"><![CDATA[Documents ]]></field-label>
    <field-label lang="en_GB" mime-type="text-plain"><![CDATA[Offer Letter]]></field-label>
    <field-label lang="en_US" mime-type="text-plain"><![CDATA[Offer Letter]]></field-label>
    <field-description><![CDATA[Offer Letter ]]></field-description>
    <field-description lang="en_GB"><![CDATA[Offer Letter]]></field-description>
    <field-description lang="en_US"><![CDATA[Offer Letter]]></field-description>
</field-definition>

Field permissions:

<field-permission type="read"><role-name><![CDATA[Candidate]]>

</role-name><country><![CDATA[*]]></country><source><![CDATA[Internal]]></source>

Configure the reportable custom field:

Navigate to Provisioning > Configure Reportable Custom Fields.
Enter the custom fields defined in the XML file.
Select Save Extended Field Mapping.
Select Synchronize Existing Data.

Use Synchronize Existing Data after adding or changing custom Candidate reporting fields to update existing reportable data.

Modify the offer-letter template

Go to Admin Center > Recruiting.

Select Manage Offer Letter Templates.

Select the applicable offer-letter template, and then select Edit.

From the toolbar, select the Image icon.

On Image Info, configure:

Width: 100%
Height: 117
URL: Your account-specific image URL

Learn how to determine your account specific image URL

Determine the account-specific image URL

Navigate to the adobesign web application running in the provider subaccount.
Copy the Application URL.
Example: https://adobesign10384.cfapps.eu10.hana.ondemand.com
Append:
/Images/Recruiting - Offer Letter.png

Example:

https://adobesign10384.cfapps.eu10.hana.ondemand.com/Images/Recruiting - Offer Letter.png

Select the Link tab.

Enter the account-specific Link URL.

Set Target to Same Window (_self).

Determine the account-specific Link URL

Navigate to the adobesign router application running in the provider subaccount.
Copy the Router Application URL.
Example: https://adobesignWeb10384.cfapps.us10-001.hana.ondemand.com
Append:
/AdobeSign?JobApplication=[[APPLICATION_ID]]

Example:

https://adobesignWeb10384.cfapps.eu10.hana.ondemand.com/AdobeSign?JobApplication=[[APPLICATION_ID]]

Add the Adobe Acrobat Sign admin tile

Select Manage Home Page > Add Custom Tile.

Configure the tile:

General

Tile Name: AcrobatSign
Description: Free text

Tile

Type: Static
Tile: Acrobat Sign
Icon: sap-icon://account, or another appropriate icon

Navigation

Target: URL
Open Link in a new Window/Tab: Selected
URL: https://***.cfapps.***.hana.ondemand.com/AdobeAdminRecruiting
Example:
https://adobesignWeb10384.cfapps.eu10.hana.ondemand.com/AdobeAdminRecruiting

Assignments

Configure the appropriate sections for the User Groups defined by your RBP configuration.

Verify OData Recruiting permissions

Verify that the required OData Recruiting permissions are assigned to the Recruiting user and the SAP SuccessFactors user associated with the technical destination.

Connect SAP SuccessFactors to Adobe Acrobat Sign

An Adobe Acrobat Sign account or group administrator must connect SAP SuccessFactors to Adobe Acrobat Sign.

Navigate to Home, and then select the Acrobat Sign tile.

Enter the Adobe Acrobat Sign administrator email address and password, and then select Sign in.

In the permissions dialog, select Allow Access.

A confirmation message appears when the connection is established.

Configure the Job Application status

Optionally, add Offer Accepted as a Job Application status.

Go to Provisioning > Applicant Status Configuration > Edit Base.

Configure:

Type: In Progress
Status Name: Offer Accepted

The status becomes available for use in status sets.

Acrobat Sign for SAP SuccessFactors: Change job application status

Go to Provisioning > Applicant Status Configuration > Add New.

The new status set is populated with system statuses. You can add additional statuses from the base to the pipeline.

Go to Edit Applicant Status Configuration and edit the Status Set marked as Default.

Select Add New, select Offer Accepted from the picklist, and configure the required options.

Troubleshoot

Error when opening the Acrobat Sign admin tile

You Need to Be A Paid Subscriber of Acrobat Sign to use this integration With SuccessFactors

This error can occur when the user connecting SAP SuccessFactors to Adobe Acrobat Sign doesn't have account or group administrator privileges.

Verify that the user signing in through the Acrobat Sign admin tile is an Adobe Acrobat Sign account or group administrator.

Error when sending an offer letter

Please connect to Acrobat Sign!

This error occurs when SAP SuccessFactors isn't connected to Adobe Acrobat Sign.

Sign in through the Acrobat Sign admin tile using Adobe Acrobat Sign account or group administrator credentials before sending the offer letter.

Error when opening the Acrobat Sign admin tile: redirect_uri has an invalid domain

In the SAP BTP cockpit, go to your subaccount and select Services > Instances and Subscriptions.

Under Instances, select the Authorization & Trust Management Service icon, and then select Update.

Under Parameters, provide the following JSON and replace <router-App-url> with the application-router URL for your environment:

{
    "xsappname": "extension-app",
    "tenant-mode": "dedicated",
    "oauth2-configuration": {
        "redirect-uris": [
            "<router-App-url>/**"
         ]
    }
}

For example, if the Router Application URL is:

https://adobesignWeb10384.cfapps.eu10.hana.ondemand.com

the redirect-uris value is:

https://adobesignWeb10384.cfapps.eu10.hana.ondemand.com/**

Select Update Instance.

Streamline your work with Acrobat Sign
Manage and sign documents online quickly and easily.

Open the app

Adobe Acrobat Sign for SAP SuccessFactors Recruiting

Learn

Learn with step-by-step video tutorials and hands-on guidance right in the app.

Community

Join discussions, find answers, learn from experts, and share your knowledge.

Adobe Home

Access your favorite Creative Cloud apps, services, file management, and more.