SAP SuccessFactors and OpenText: Basic Auth ends 21 May 2027, plan the OAuth move
If SAP SuccessFactors sends employee documents to OpenText with a user ID and password, that connection has a deletion date: 21 May 2027. SAP's 2H 2026 release blog for Document Management Service says Basic Authentication for outbound calls from SuccessFactors to OpenText will be removed then. Before that date the connection has to move to OAuth 2.0.
SAP lists three milestones:
MilestoneDateWhat it meansEnd of development14 Nov 2025No new enhancements to Basic Auth for this integrationEnd of maintenance14 May 2026SAP no longer fixes Basic Auth bugs hereDeleted21 May 2027Basic Auth stops working
One date moved. SAP's 2H 2025 post on the same change gave the deletion date as 20 November 2026. The 2H 2026 post says 21 May 2027. If your team planned against November, the plan still stands, with six more months. Make sure the tracker carries the newer date.
Two other points from the same post. Since 1H 2026, new customers can't enable Basic Auth for the OpenText integration at all. And a customer who switches to OAuth 2.0 can't switch back. Admin Center shows a warning banner on the configuration page while Basic Auth is still in use.
Which direction is affected. Outbound only: SuccessFactors Document Management calling OpenText. SAP says calls from OpenText into SuccessFactors already use OAuth 2.0. Keep that straight, because a second retirement is running at the same time. SAP Knowledge Base Article 3796078 says Basic Auth for API access to SuccessFactors itself is being removed in November 2027. That one covers systems that call SuccessFactors, such as middleware. Two deadlines, two directions, and quite possibly two owners. Give them separate lines.
Check the OpenText release first. SAP says OAuth 2.0 support depends on your Extended ECM release, and an instance below the required release must be upgraded before the switch. OpenText's own advisory on My Support (KB0859978, which we read on 10 October 2026) draws the line at 22.3: releases from 22.3 on can use the certificate connection, and 22.2 and earlier must upgrade. On 22.2 or older, the authentication change is really an upgrade project. Plan it as one.
The switch itself is short. SAP describes three steps. Create a self-signed certificate in SuccessFactors Security Center. Register the same certificate in the OpenText instance. Select it on the Configure Document Management screen.
The certificate is what lasts. A password connection tends to break the day someone changes the password. A certificate breaks on a date chosen up to three years earlier, which is the maximum validity SAP allows for a Security Center certificate. SAP's rotation advice avoids an outage: OpenText accepts up to two registered certificates, so register the new one next to the old, point SuccessFactors at it, then delete the older one. Security Center can email administrators from 30 days before expiry, then weekly.
What we'd write down before the change:
The certificate owner. A named HR systems administrator subscribed to the expiry emails, plus a backup.
The expiry date, on the same calendar as your other OpenText dates.
The OpenText release, read from the system, against the 22.3 line.
A test after the switch. Upload a document in SuccessFactors and confirm it lands in the right employee workspace in OpenText. The 2H 2026 Manage Documents page adds a Storage Location column (SuccessFactors or OpenText) that makes the check quick.
Small change, long tail. Treat the certificate like the credential it is.
