NextGen UI for Concur Request

The continued evolution of the Concur Request solution user interface experience is the result of thoughtful design and research that provides a modern, intuitive and streamlined experience for the request process.

Concur Request customers will have the ability to preview and then opt in to the NextGen UI before the mandatory move.

Business Purpose / Client Benefit: The result is the next generation of the Concur Request user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

Authentication

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

Support for the Director SAML service is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel will soon begin assisting customers who currently use Director SAML to migrate to SAP Concur SAML v2 SSO (SAML v2).

Clients currently using Director SAML are encouraged to migrate to SAML V2 as soon as possible.

Deprecation of support for the Director SAML service is dependent on the following requirements:

• SAP Concur technicians and TMCs assist existing SAP Concur clients to migrate from the Director SAML service to SAML V2.
• All clients that currently rely on the Director SAML service have migrated from Director SAML to SAML V2.

Migration from Director SAML to SAML V2 requires the following general steps:

• The client identifies an admin to act as the SSO admin and assigns the proper permission/role.
• The SSO admin coordinates with their SAP Concur technician to obtain the SAP Concur SP metadata.
• The SSO admin configures the SSO settings at the IdP based on information from SP metadata.
• The SSO admin retrieves IdP metadata from the IdP and delivers the metadata to the SAP Concur technician.
• The SSO admin adds a few testing users and tests the new SSO connection.
• With successful testing, the company rolls out SSO to their SAP Concur users.

For more detailed information about migrating to SAML v2, refer to the SSO Service: Overview Guide (English Only) and the Shared: SSO Management Setup Guide (English Only).

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

In Q3 of 2020, SAP Concur plans to provide a self-service tool that will enable client admins to set up their SAML v2 connections without involving an SAP Concur support representative.

The HMAC deprecation includes two phases:

PHASE I:

• Clients must have an identity provider (IdP) or a custom SAML 2.0 compliant solution.
• Clients begin testing authentication using SAML v2.
• TMCs prepare to onboard new SAP Concur clients to SAML v2.
• Once the SSO self-service tool is available, customers will be notified via release notes about the official deprecation date of HMAC. As of the official deprecation date, no new clients can be onboarded using HMAC; new clients must be onboarded to SAML v2.
• Existing clients using HMAC must migrate to SAML v2.

PHASE II:

• TMCs have migrated all existing SAP Concur clients from the HMAC service to SAML v2.
• The HMAC service is deprecated. Phase II is targeted to end mid-year in 2021.

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

File Transfer Updates

This Release Note is intended for the technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange, SAP is maintaining our SAP Concur file transfer subsystem to provide greater security for those file transfers.

SAP will begin migrating SAP Concur entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and the end of 2020. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

Imaging

SAP is updating the Imaging XML API to clarify two error codes. The service currently returns an HTTP 200 code even when the API returns an error 500 in the XML response. This update corrects the HTTP error code, returning HTTP 500 if the API response includes the 500 error code. Additionally, the Imaging response error code 503 (Storage Unavailable) will be changed to error code 122, to reduce confusion with the HTTP 503 error code.

The Imaging XML API is separate from the Imaging v1.0 or v3.0 APIs, and very few clients are using it. SAP has reached out individually to those clients in order to coordinate this change.

List Import

Beginning with the July release, Start Date and End Date information that is included in the concur-standard.xml or concur-standard-71.xml import definition files is no longer stored by SAP Concur solutions.

Business Purpose / Client Benefit: The Start Date and End Date information is not referenced or used by SAP Concur solutions and does not need to be stored.

Miscellaneous

The certificate provided by the SAP Concur SAMLv2 service, which is used to establish a Single-Sign On (SSO) connection with an IdP, expired on 25 June, 2020. A new certificate is available for renewal. Users might be prevented from successfully signing in to SAP Concur products if the expired certificate is not renewed.

SAP Concur solutions offer SSO to help make the user sign-in process easier and more secure. SSO requires that trust be established between the Identity Provider (IdP) and the Service Provider (SP). This trust is established in part by cryptographic use of certificates provided by the service provider, in this case, SAP Concur solutions.

Business Purpose / Client Benefit: To ensure that the SSO certificate adheres to the latest security standards and processes, the certificate is configured to expire and be renewed periodically.

On 22 June 2020, SAP Concur solutions removed support for connections to *.concursolutions.com and *api.concursolutions.com that use the following TLSv1.2 ciphers:

• AES256-GCM-SHA384
• AES128-GCM-SHA256

In response to the needs of our clients, support for these ciphers was restored on 25 June.

SAP Concur Platform

SAP will be retiring the existing Concur Request APIs (v1.0, v3.0 and v3.1) in a future release (targeted to begin 1 December 2020), in accordance with the SAP Concur API Lifecycle & Deprecation Policy. These APIs are replaced by the Concur Request v4 APIs. SAP will no longer support these APIs after retirement.

Decommissioning of the v1.0, v3.0 and v3.1 APIs will start three months after retiring the APIs. The specific dates for decommissioning are dependent on the individual client's API migration.

API Timeline for v1.0, v3.0, v3.1:

• Deprecation – 1 March 2020 - 30 November 2020
• Retirement – 1 December 2020 - 31 May 2021
• Decommission – starts after 3 months of inactivity at the retired state

Business Purpose / Client Benefit: The Concur Request APIs v1.0, v3.0 and v3.1 only support the previous authentication method, which is not best security practice and does not meet the Oauth2 standards. In addition, the previous versions of the Concur Request APIs provided limited possibilities for moving a Request through the approval workflow, as well as managing custom simple & connected list fields. These issues are resolved with the new Concur Request v4 APIs.

In addition, SAP has run a backward compatibility project between the current Concur Request APIs and the new Concur Request v4 APIs (not ISO-compatibility) in order to have the vast majority of use cases managed in the previous versions also be managed in the Concur Request v4 APIs.

There are no planned changes this month.