Joule After a SuccessFactors Instance Refresh: Restoring Global User IDs and Rebuilding the IAS/Work Zone Identity Chain
Introduction
Recently, while validating Joule in an SAP SuccessFactors QA environment after an instance refresh, I came across an interesting identity-related issue.
Joule itself was available. The Joule icon was visible in SuccessFactors, and some users could use it successfully.
However, for other users:
- Joule opened but displayed a blank panel.
- Some Employee Central use cases could not retrieve user-specific information.
- Global User ID was blank in Manage Login Accounts.
- Identity Provisioning synchronization produced different errors across IAS and SAP Build Work Zone.
The troubleshooting eventually highlighted an important point:
When SuccessFactors is integrated with Joule, an instance refresh should be treated as an identity-integration event, not just a SuccessFactors data refresh.
This blog documents the troubleshooting approach and the lessons learned.
Landscape
The relevant components in this scenario were:
SAP SuccessFactors
↓
SAP Cloud Identity Services - Identity Authentication
↓
Identity Provisioning
↓
SAP Build Work Zone, standard edition
↓
Joule
A corporate identity provider was also connected through Identity Authentication.
This is important because Joule requires consistent user identity across the participating SAP applications. SAP specifically requires the same Global User ID to represent the user across Joule and the integrated applications.
What Changed During the Instance Refresh?
One setting deserves special attention when creating a SuccessFactors instance refresh request:
Do not delete global user IDs
SAP documentation states:
- When this option is selected, Global User IDs are retained.
- When it is not selected, Global User IDs are deleted.
- The option is unchecked by default.
SAP Help Portal - Creating an Instance Refresh Request
This can easily be overlooked.
SAP also explicitly lists Joule as a technical gap of the Instance Refresh tool. Only SuccessFactors user data, permissions, and configuration are migrated as part of the refresh; Joule itself is not copied as a complete integrated landscape. Post-refresh configuration and user-related activities may therefore be required.
SAP Help Portal - Known Technical Gaps of Instance Refresh Tool
Screenshot 1: Instance Refresh screen showing Do not delete global user IDs.
Symptom 1: Global User ID Was Blank
The first useful diagnostic was:
Admin Center → Manage Login Accounts
For an affected user, the result looked like this:
| Attribute | Status |
|---|---|
| Account ID | Populated |
| Person ID | Populated |
| Person UUID | Populated |
| Global User ID | Blank |
| Status | Active |
| Login Method | SSO |
A working user, on the other hand, had a Global User ID.
This distinction turned out to be critical.
SAP's Joule troubleshooting guidance specifically identifies the following as a cause of Joule not responding:
Global User ID is blank in SuccessFactors or does not match the user's Global User ID in IAS.
SAP recommends running a Read/Resync job from the SuccessFactors source to the IAS target to realign the identity.
Screenshot 2: Manage Login Accounts with the Global User ID column visible.
Understanding the Global User ID Flow
It is useful to distinguish three identifiers:
Person UUID
Account ID
Global User ID
They are not interchangeable.
In a SuccessFactors → Identity Authentication provisioning scenario, IAS maintains the user's cross-system identity, and Identity Provisioning can write the IAS user UUID back into SuccessFactors as the Global User ID.
For Joule, this cross-system identity becomes particularly important because the request:
What is my cost center?
first requires the system to establish:
Who is "my"?
The authenticated user in IAS must map consistently to the corresponding SuccessFactors user.
Step 1: Identify the Correct IPS Provisioning Flow
This was one of the easiest places to make a mistake.
There were two different SuccessFactors provisioning scenarios.
SuccessFactors → Work Zone
SuccessFactors - <tenant> - Joule
|
v
SAP Build Work Zone
This flow provisions users, SuccessFactors roles/groups, and identity information required by Work Zone/Joule.
SuccessFactors → IAS
SuccessFactors - <tenant> - source
|
v
Identity Authentication - target
This is the flow required to restore or reconcile the Global User ID.
For Global User ID recovery, the second flow is the important one.
Screenshot 3: Identity Authentication target showing:
Type: Identity Authentication
Source Systems:
SuccessFactors - <tenant> - source
Step 2: Run the SuccessFactors → IAS Resync
Navigate to:
Cloud Identity Services
→ Identity Provisioning
→ Source Systems
→ SuccessFactors - <tenant> - source
→ Jobs
→ Resync Job
→ Run Now
Initially, our job failed immediately with:
401
[LGN0015] Authentication failed.
You have entered an incorrect username or password.
This was not a Joule error.
IPS could not authenticate to the refreshed SuccessFactors tenant, so it could not even read the users.
After correcting the SuccessFactors API authentication used by the IPS source, the Resync completed successfully.
Result: Global User IDs Started Reappearing
After the successful SF → IAS Resync:
Manage Login Accounts
started showing Global User IDs again for users that had previously been blank.
Example:
Before Resync
Global User ID:
<blank>
became:
After Resync
Global User ID:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
The same Global User ID could also be found for that user in Identity Authentication.
This was an important confirmation that the identity chain had been restored for those users.
Screenshot 4: Before/after comparison of Manage Login Accounts.
Step 3: An Interesting 403 for IAS Administrator Users
Not every user synchronized successfully.
For one affected user, IPS returned:
HTTP operation failed invoking
/service/scim/Users/P000005
statusCode: 403
The interesting detail was that this IAS business user was also being used directly as an IAS administrator identity.
Another affected user showed the same pattern.
A working administrator, however, had:
Business identity: User A
Administrator identity: User B
rather than using the same IAS record for both purposes.
After temporarily removing the administrative assignment from the affected business-user identity and running the SF → IAS Resync again, the user's Global User ID was successfully written back into SuccessFactors.
This was a useful reminder to be careful about combining privileged administration identities and normal business-user identities in identity-provisioning scenarios.
Step 4: Reconcile SuccessFactors With Work Zone
Restoring the Global User IDs was only the first part.
Next, we ran:
SuccessFactors → SAP Build Work Zone Resync
using the Joule-specific SuccessFactors source.
During troubleshooting, the target originally produced errors such as:
PUT
/roleMapping/scim/v1/Users/<id>
409 Resource already exists
Bulk processing initially hid most of the useful error information.
Temporarily changing:
cflp.support.bulk.operation = false
made the actual SCIM response visible.
This proved useful diagnostically because instead of a generic bulk failure we could see the actual Work Zone response:
409
Resource already exists
After correcting the upstream identity information, the Work Zone provisioning flow could be rerun against a much cleaner user population.
Step 5: Validate the Joule IAS Application
SAP's Joule troubleshooting guidance has two prerequisites that are worth checking explicitly.
Subject Name Identifier
Navigate to:
Cloud Identity Services
→ Applications & Resources
→ Joule application, typically:
das-ias (<Joule subaccount>)
→ Trust
→ Subject Name Identifier
The primary attribute should be:
Source: Identity Directory
Value: Global User ID
In our environment, it had been configured as:
Value: Email
That was corrected to:
Value: Global User ID
SAP explicitly requires Global User ID as the Subject Name Identifier when troubleshooting this Joule no-response scenario.
Screenshot 5: Subject Name Identifier showing:
Identity Directory
Global User ID
Step 6: Check Corporate IdP Identity Federation
If Identity Authentication is acting as a proxy for a corporate identity provider, also check:
Identity Providers
→ Corporate Identity Provider
→ Identity Federation
The following should be enabled:
Use Identity Authentication user store
This allows the user to authenticate through the corporate IdP while IAS uses the corresponding IAS identity information when generating the identity sent to the application.
SAP explicitly lists this setting together with the Global User ID Subject Name Identifier as a Joule troubleshooting prerequisite.
Screenshot 6: Corporate IdP → Identity Federation with:
Use Identity Authentication user store = ON
Step 7: Do Not Forget SuccessFactors RBP
Identity was not the only layer checked.
For affected users we also validated:
Admin Center → RBP Troubleshooting
and searched for:
User Search
SAP identifies missing User Search permission as another possible reason why Joule does not respond to SuccessFactors commands.
In our case, the affected user already had this permission.
That allowed us to eliminate RBP as the cause at that stage.
Screenshot 7: RBP Troubleshooting showing User Search.
What the Troubleshooting Flow Looks Like Now
After this experience, this is the sequence I would recommend for a Joule-enabled SuccessFactors tenant after an instance refresh:
1. Check Global User ID in SuccessFactors
|
v
2. Compare it with IAS
|
v
3. Run SuccessFactors → IAS Resync
|
v
4. Confirm Global User ID write-back
|
v
5. Run SuccessFactors → Work Zone Resync
|
v
6. Validate Work Zone role provisioning
|
v
7. Validate Joule Subject Name Identifier
|
v
8. Validate Corporate IdP Identity Federation
|
v
9. Validate SuccessFactors RBP
|
v
10. Refresh the SFSF content channel
|
v
11. Retest Joule
|
v
12. If still failing, capture browser Network/HAR/Console
This order avoids randomly changing Joule configuration when the actual problem may be further upstream in identity provisioning.
One Important Troubleshooting Lesson
A visible Joule icon does not prove that the entire Joule integration is healthy.
In our testing we reached a state where:
Joule icon ✅
Joule panel opens ✅
SAP logo appears ✅
Global User ID populated ✅
IAS identity exists ✅
Work Zone roles available ✅
User Search permission ✅
Joule conversation loads ❌
At that point, configuration guessing becomes less useful.
The correct next step is browser-level diagnostics:
Chrome DevTools
→ Network
→ Keep log
→ Disable cache
→ reproduce Joule issue
→ export HAR
The Console and Network traces then help determine whether the remaining problem is authentication, token exchange, browser initialization, WebSocket connectivity, or another runtime issue.
Recommendations Before Your Next Instance Refresh
For a SuccessFactors tenant already integrated with Joule, I would include these activities in the refresh checklist:
- Review Do not delete global user IDs before submitting the refresh request.
- Document Global User IDs for representative test users.
- Verify the SuccessFactors → IAS IPS integration credentials after refresh.
- Run SF → IAS identity reconciliation before troubleshooting Joule itself.
- Verify Global User IDs in Manage Login Accounts.
- Run the SuccessFactors → Work Zone Resync.
- Refresh the SuccessFactors content channel in Work Zone.
- Test Joule with more than one persona.
- Include both normal business users and privileged/admin users in testing.
- Capture HAR traces only after the identity and authorization layers have been validated.
The particularly important refresh setting is documented by SAP: if Do not delete global user IDs is not selected, the Global User IDs are deleted during the refresh, and the option is unchecked by default.
SAP Help Portal - Creating an Instance Refresh Request
Conclusion
The biggest lesson from this troubleshooting exercise was not about one Joule configuration.
It was about identity continuity.
A request such as:
Who is my manager?
or:
What is my cost center?
looks simple to the employee.
Architecturally, however, the word “my” depends on the user being represented consistently across SuccessFactors, Identity Authentication, Identity Provisioning, Work Zone, and Joule.
That is why Global User ID deserves much more attention during instance-refresh planning for Joule-enabled landscapes.
And because SAP explicitly states that the Instance Refresh tool does not support Joule as a complete refresh scenario, post-refresh identity reconciliation should be part of the deployment checklist rather than something discovered only when the Joule window turns blank.
SAP Help Portal - Known Technical Gaps of Instance Refresh Tool
I would be interested to hear from others running Joule with SuccessFactors: have you added Global User ID validation and IPS reconciliation to your post-refresh checklist?
References
-
SAP Help Portal - Creating an Instance Refresh Request
Documents the Do not delete global user IDs option and its default behavior.
Open SAP Help documentation -
SAP Help Portal - Known Technical Gaps of Instance Refresh Tool
Documents the Instance Refresh limitation for Joule.
Open SAP Help documentation -
SAP KBA 3655338 - Joule does not respond to any command in SAP SuccessFactors
Covers Global User ID alignment, Subject Name Identifier, Identity Federation, User Search, and additional Joule troubleshooting checks.
Open SAP KBA 3655338 -
SAP KBA 2906040
Relevant to Identity Authentication provisioning failures involving administrator users and HTTP 403 responses.
Open SAP KBA 2906040
Suggested Topics: SAP SuccessFactors HCM, Joule, SAP Cloud Identity Services, SAP Build Work Zone
Suggested Tags: Joule, Global User ID, Identity Authentication, Identity Provisioning, Instance Refresh, SAP SuccessFactors
No comments:
Post a Comment