Authentication Administration

On 8 December 2020, SAP Concur released a new Company Request Token self-service tool that enables clients to generate the Company Request Token that is required to request a JSON Web Token (JWT) when connecting to APIs in the SAP Concur platform.

An admin with the Web Services Administrator permission can navigate to the Company Request Tokens page through the link provided by CWS, enter the Client ID they obtained from CWS into the App ID field and then click Submit to generate a Company Request Token. They will also be able to generate a replacement token if one is needed.

The new self-service tool enables an admin with the required permissions to generate a Company Request Token without relying on SAP Concur internal staff. The new tool also enables the admin to generate a replacement Company Request Token without assistance from SAP Concur support if their Company Request Token expires or is lost.

Authorised Support Contacts

SAP Concur solutions has added an option to the SAP Concur support portal that enables Authorised Support Contacts (ASCs) to designate whether they should be contacted regarding a security or data protection topic.

This enhancement gives clients more control over who in their company is contacted regarding security or data protection topics, and provides greater control over which notifications an ASC receives.

Flight

In November 2020, we announced an upcoming retirement of the A.I.D.A. virtual card programme feature of Concur Travel. After some new developments, SAP Concur and AirPlus will continue support of the existing AirPlus A.I.D.A. programme.

Miscellaneous

Starting with the January 2021 release, SAP Concur Technical Publications will no longer publish the preview release notes. This change is being made to streamline our client communication. With this change, only two sets of release notes will be published for each monthly release cycle: draft release notes and final release notes.

This change simplifies the release notes communications.

Support for the Director SAML service is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel will soon begin assisting customers who currently use Director SAML to migrate to SAP Concur SAML v2 SSO (SAML v2).

Clients currently using Director SAML are encouraged to migrate to SAML V2 as soon as possible.

This change provides better security and improved support for users logging in to SAP Concur products and services.

**Ongoing** Deprecation of HMAC Initiates Migration to SSO Self-Service

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to set up their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

**Ongoing** SAP Concur Legacy File Move Migration

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 31 July 2021.

These changes provide greater security and efficiency for file transfers.

Travel Arranger Support

TripIt has launched Travel Arranger support via plans@tripit.com. A Concur Travel Arranger can now add plans for a Travel Arrangee by adding the Arrangee’s email address to the subject line before forwarding their confirmation email to plans@tripit.com.

The plan will be added to the Arrangee’s TripIt account with the Arranger designated as a Planner. If the trip is shared with SAP Concur, the plan will also synchronise to Concur Travel and be available in Traveller and Arranger views.

This feature provides a consistent user experience across Concur Travel and TripIt.

Files transferred to SAP Concur solutions must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

The SAP Concur legacy PGP key remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

The rotating public PGP key provides greater security for file transfers.

Authentication

**Planned Changes** PSD2 Strong Customer Authentication

Payment Services Directive (PSD2) is a European regulation for electronic payment services. It seeks to make payments more secure in Europe, boost innovation and help banking services adapt to new technologies. One major development in PSD2 is the introduction of new security requirements, known as Strong Customer Authentication (SCA).

SCA is a European requirement created to make online payments more secure. The directive requires that purchasers be authenticated using multi-factor techniques to increase the security and reduce fraud opportunities. It is up to each supplier and bank/card issuer to determine on a transaction-by-transaction basis whether this extra level of authentication is required.

SAP Concur will deliver an SCA solution in partnership with our 3DS provider. We will communicate our progress and provide updates through future release notes.

Flight

**Planned Changes** CIBT – Retirement of Legacy Integration

In February 2020, SAP Concur and CIBT launched a new integration method through the Concur App Centre, where the new CIBT app has been available since then. The legacy integration method with CIBT is still supported during a transition period but SAP Concur will eventually retire the Legacy Batch File protocol integration method. The original retirement date announced with the release notes in February 2020 was November 2020. To give our customers and business partners more time for the transition and to ease a little the impact that the COVID-19 pandemic may have had on some organisations, SAP Concur has decided to extend the transition period. The retirement is planned for the second half of 2021. More details will be provided closer to the retirement date.

Benefits of the new integration method: the CIBT service is available for additional countries. Travellers whose profiles are associated with a Concur Travel configuration based in Denmark, Finland, Ireland, Norway or Sweden can now benefit from CIBT’s visa services.

CIBT has integrated with SAP Concur’s Itinerary API and Travel Profile API and has released an App Centre Connector to facilitate the continuous, real-time flow of itineraries to better serve clients and travellers.

**Planned Changes** Express Checkout No Longer Supported

Express Checkout is an enhanced user experience that reduces the finalisation process from five pages to two: the Review and Book page and the Confirmed page. The Express Checkout feature was intended to replace the current 5-page checkout experience for all travel segment types, such as hotel and car.

The first phase was well received, however most of the development work for the additional phases would be required before achieving the necessary adoption level to benefit a majority of Concur Travel’s customers. SAP Concur will no longer support the existing Express Checkout functionality in February 2021.

Hotel

**Planned Changes** Corporate Discounts Notes Support for Custom Hotel Sourcing (Professional Edition Only)

Corporate Discounts Notes allows Concur Travel administrators to include additional information specific to the hotel to help travellers compare and select their hotel choice, such as Parking, Fitness Centre, Airport Shuttle, Breakfast and so on.

Currently, Corporate Discounts Notes is configured through the Manage Corporate Discounts Administration page and is only available for properties returned in search results that have GDS rates. This excludes properties returned in search results from Custom Hotel Sourcing partners.

Targeted for the first quarter of 2021, Custom Hotel Sourcing providers will be able to link Corporate Discount Notes written against GDS properties in Concur Travel to the same properties they return to Concur Travel via the Hotel Service v2 interface. The link will be facilitated by mapping between the CHS Provider IDs and the GDS IDs via the properties’ GIATA IDs. More specifically, the TPA_PropertyReferenceInfo extension has been added to allow providers to include the property’s GIATA ID in the Hotel Service v2 API Search Response.

This enhancement will ensure a consistent experience for all users by providing the ability to view Corporate Discounts Notes for properties which were previously not available through Custom Hotel Sourcing.

Profile

**Planned Changes** Travel Profile API LastModifiedDate Parameter

In the current Travel Profile 2.0 API, the request to get travel profile summaries has one required parameter: LastModifiedDate. This allows users to get profile summaries of other users whose profiles have changed since that date. SAP Concur development discovered a defect where this required parameter is not enforced. So today, if a user omits the parameter LastModifiedDate, they receive profile summaries for all of their users.

Beginning in February 2021, SAP Concur development will enforce the inclusion of the LastModifiedDate parameter, as documented. Users who omit LastModifiedDate will receive an error.

Fixing this defect to match current documentation ensures a consistent and improved experience for all users.