01Overview
SAP SuccessFactors is one of the world's most widely deployed HR SaaS platforms, holding a company's most sensitive data: employee PII, compensation, org structure, and payroll feeds. Yet its security posture is governed by a sprawl of RBP permission roles, OAuth clients, Integration Center jobs, SAML/MFA settings, and data-retention rules that no single admin screen presents holistically. This project is a purpose-built SaaS Security Posture Management (SSPM) toolkit that audits exactly that surface.
It ships as two complementary, standalone scanners. The Offline Scanner is a modular, zero-dependency (Python stdlib only) tool that ingests exported CSV/JSON configuration data and runs 49 checks across 7 audit modules, producing an interactive HTML dashboard with severity ratings and remediation. The Online Scanner is a single-file tool that connects live to a running instance over the standard SAP SuccessFactors OData v2 REST API using read-only credentials, running 35 posture checks across 8 categories with no agent or plugin to install.
The dual-mode design maps directly to how real assessments happen: use the Offline Scanner for air-gapped reviews, deep RBP/permission analysis from exports, or when you only have data dumps; use the Online Scanner when you hold read-only API credentials and want a real-time posture snapshot of password policy, users, SSO, audit logging, privacy, and integrations. Both are strictly non-destructive, both emit severity-ranked findings with remediation, and both exit non-zero on CRITICAL/HIGH findings so they drop cleanly into CI or assessment pipelines.
It is built for HR-security and GRC teams, SAP administrators, and offensive/defensive security consultants who need SuccessFactors-specific coverage that generic SaaS scanners lack. Findings are grounded in concrete controls (RBP over-privilege, SoD conflicts, terminated-employee access, OAuth scope sprawl, GDPR purge jobs, audit-log gaps) and annotated with CWE identifiers and framework alignment rather than vague scores.
02Key Capabilities
Dual-mode scanning (offline + online)
One toolkit covers both air-gapped config-export review and live OData API scanning, so you can audit whether or not you have instance credentials.
Zero-dependency offline auditor
The offline scanner runs on Python 3.8+ stdlib alone, making it trivial to drop into a locked-down or air-gapped assessment environment.
Agentless live OData v2 scanning
The online scanner queries a running instance read-only over the standard SAP SuccessFactors OData v2 REST API with only the requests library and no plugin to install.
Deep RBP and Segregation-of-Duties analysis
Detects over-privileged roles, admin sprawl, wildcard populations, unused roles, and SoD conflicts such as role-admin combined with user-admin or export combined with PII access.
Terminated and dormant account detection
Flags terminated employees who still hold active accounts, dormant users inactive 90+ days, and service accounts with hygiene issues before they become an attack path.
Integration and OAuth security checks
Surfaces broad-scope OAuth clients, deprecated grant types, unauthenticated or non-TLS Integration Center jobs, and integrations exporting sensitive HR data.
Data privacy and GDPR coverage
Validates field masking of PII, data-retention and purge policies, consent management, and unrestricted bulk export controls.
Interactive HTML dashboards
Both scanners emit a self-contained HTML report with severity breakdown, category charts, and per-finding remediation; the online scanner also outputs coloured console and JSON.
Modular, selectable audit modules
Run all seven offline modules or target specific ones (e.g. rbp api privacy) and filter output by minimum severity for focused assessments.
CWE-annotated, framework-aligned findings
Findings carry CWE identifiers and are aligned to NIST SP 800-63B, GDPR, CIS HR SaaS practices, OWASP, and the SAP SuccessFactors hardening guidance.
Multi-data-center aware
Ships a reference map of SAP SuccessFactors DC API hosts (US, EU, APAC, Canada) so the online scanner points at the right regional endpoint.
CI-friendly exit codes
Both scanners return a non-zero exit code when CRITICAL or HIGH findings exist, enabling gating in security pipelines.
03Architecture
The toolkit is two independent scanners sharing a common finding/severity model. The offline scanner is a thin CLI orchestrator that loads exported CSV/JSON via a DataLoader, then dispatches to seven BaseAuditor subclasses (one per domain) that each emit structured finding dicts, which a ReportGenerator renders into an interactive HTML dashboard. The online scanner is a single-file OData v2 client that authenticates with read-only Basic Auth (username@companyId), pages through nine SuccessFactors entities, and runs eight check groups (including 10 data-driven password-policy rules) that produce Finding objects rendered to console, JSON, and HTML.
04Project Structure
successfactors_offlinescanner.pyOffline scanner CLI entry point; orchestrates DataLoader, the 7 auditor modules, severity filtering, and report generation.successfactors_onlinescanner.pySingle-file live OData v2 API scanner (~1,599 lines); auth, entity fetch, 8 check groups, and console/JSON/HTML output.modules/base_auditor.pyBaseAuditor class defining the severity constants and the finding() helper shared by all offline modules.modules/data_loader.pyLoads exported CSV/JSON configuration files from the data directory; every input file is optional.modules/rbp_permissions.pyRBP-* checks: over-privileged roles, admin sprawl, SoD conflicts, sensitive-data and wildcard-population access (7 checks).modules/sso_auth.pySSO-* checks: SAML config weaknesses, MFA enforcement, IP restrictions, session timeout, certificate health, brute-force patterns (9 checks).modules/api_integration.pyAPI-* checks: OAuth scope/grant/idle, sensitive OData entity exposure, Integration Center auth/TLS, broad API access (8 checks).modules/data_privacy.pyPRIV-* checks: field masking, data retention/purge, MDF PII classification, picklist and bulk-export controls (8 checks).modules/report_generator.py748-line HTML dashboard generator with severity/category breakdowns and per-finding remediation.sample_data/22 demo config files (CSV/JSON) plus a sample_report.html so the offline scanner runs out of the box.CLAUDE.mdProject instructions documenting both scanners, rule-ID formats, and architecture.README.mdFull usage, module/check catalogues, data-source reference, and DC host map.05Security Controls
06Technology Stack
- Language
- Python (offline 3.8+, online 3.10+)
- Offline dependencies
- None — standard library only (argparse, csv, json, pathlib)
- Online dependencies
- requests (HTTPBasicAuth) — single external package
- API
- SAP SuccessFactors OData v2 REST API ($format=json, $top/$skip pagination)
- Architecture
- Offline: modular BaseAuditor classes; Online: single-file ~1,599-line scanner
- Reporting
- Self-contained HTML dashboards, JSON export, coloured ANSI console
- License
- MIT
07Quick Start
$ git clone https://github.com/Krishcalin/SAP-SuccessFactors.git && cd SAP-SuccessFactors $ python successfactors_offlinescanner.py --data-dir ./sample_data --output report.html $ python successfactors_offlinescanner.py --data-dir ./exports --modules rbp api privacy --severity HIGH $ pip install requests $ python successfactors_onlinescanner.py --api-host api4.successfactors.com --company-id MYCOMPANY --username admin.readonly --password secret --json report.json --html report.html $ SF_API_HOST/SF_COMPANY_ID/SF_USERNAME/SF_PASSWORD env vars can replace CLI flags for the online scanner
08Compliance & Frameworks
09Integrations & Outputs
Explore SAP SuccessFactors SSPM
Full source, documentation, and deployment guides live on GitHub.