Administration

Concur Travel is constantly updating infrastructure to improve performance and security, fix bugs and keep up with changes in technology, such as supplier updates. We strive to make these changes transparent to our users. However, occasionally there are updates that result in a changed user experience.

There have been recent upgrades to the infrastructure and code surrounding the Unused Tickets process that have resulted in visible changes. One change is standardising our domain names as we prepare to migrate into AWS.

API

Our API deprecation policy has changed to further align with SAP.

For more information, refer to the SAP Concur Developer Centre release notes.

Authentication

Targeted for late August, a new Company Request Token self-service tool will be available to SAP Concur administrators who have been assigned the Company Admin or Web Services Admin role.

The Company Request Token self-service tool enables clients to generate the Company Request Token that is required to request a JSON web token (JWT) when connecting to APIs on the SAP Concur platform.

The Company Request Token self-service tool enables clients to generate Company Request Tokens without contacting SAP Concur support. This tool also enables clients to generate a replacement Company Request Token without assistance from SAP Concur support if their Company Request Token expires or is lost.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) has been deprecated.

SAP Concur provides a Single Sign-On self-service option that enables client administrators to set up their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

Client Web Services

On 21 August, the Register Partner Application page will no longer be active and all new authentication applications must use the new application management self-service tool.

The new application management self-service tool replaces the Register Partner Application page.

The new application management tool enables clients who have SAP Concur Client Web Services to generate Client IDs (App IDs) and Client Secrets without contacting SAP Concur support.

The new self-service tool for application management also enables clients to create OAuth 2.0 compliant applications.

Beginning in late August, clients who have SAP Concur Client Web Services can request access to a new application management self-service tool. The application management self-service tool can be enabled by the Client Web Services team for SAP Concur Web Services clients who request it.

When enabled, the tool will be available in the SAP Concur web UI to admin users who have been assigned the Web Services Admin role.

The application management tool enables clients to generate Client IDs (App IDs) and Client Secrets without contacting SAP Concur support.

Flight

In February 2020, SAP Concur and CIBT (CIBTvisas) launched a new integration method through the SAP Concur App Centre, where the new CIBT app is available. SAP Concur retired the Legacy Batch File protocol integration method on 1 August 2021.

With the new integration through the SAP Concur App Centre, the CIBT service is available for additional countries. Travellers whose profiles are associated with a Concur Travel configuration based in Denmark, Finland, Ireland, Norway or Sweden can now benefit from CIBT’s visa services.

CIBT has integrated with the SAP Concur Itinerary API and Travel Profile API and has released an App Centre Connector to facilitate the continuous, real-time flow of itineraries to better serve clients and travellers.

CIBT is able to support clients and travellers in more countries, with a more stable, scalable integration. The new integration method also reduces the configuration effort for admin users in Concur Travel.

Effective 19 August, Virgin Australia (VA) will update fare structures to Australian domestic markets.

Concur Travel has made the necessary updates to support these changes.

In prior updates, SAP Concur has limited the Mobile Phone field to contain only digits, dashes, spaces and brackets on the My Profile - Personal Information user interface and the Travel Profile 2.0 API. With this change, SAP Concur will similarly limit the allowed characters in the Cell Phone field in the 350 Travel Addendum (Employee) Import file. Specifically, SAP Concur will remove any unallowed characters (i.e. anything that is not a digit, space, dash or bracket) when saving information to the database.

Clients do NOT need to make any changes to their import files. Everything that is currently in the import file itself will continue to be allowed. However, the information saved on import in the SAP Concur database, which is returned in subsequent API calls and displayed to the user, will only include allowed characters in the Cell Phone field.

SAP Concur is taking steps to standardise customer data to help reduce errors.

SAP Concur User Assistance

SAP is now publishing the SAP Concur solutions’ online help information on SAP Help Portal (http://help.sap.com). SAP Help Portal has a new look and feel for the help, and additional functionality. The content remains the same.

New functionality:

• Search with advanced options
• Provide feedback on each page
• Change the font size
• Create a custom PDF by selecting a subset of pages in the help
• Share a page via link, email or social media
• Mark pages as favourites, and limit search to only those pages (if logged in to SAP Help Portal, available for free)

Customers can view SAP Concur online help and links to all documentation by accessing the product pages for the relevant product.

Concur Expense: https://help.sap.com/viewer/product/CONCUR_EXPENSE/LATEST/en-US

Concur Invoice: https://help.sap.com/viewer/product/CONCUR_INVOICE/LATEST/en-US

Concur Request: https://help.sap.com/viewer/product/CONCUR_REQUEST/LATEST/en-US

Concur Travel: https://help.sap.com/viewer/product/CONCUR_TRAVEL/LATEST/en-US

This update increases the functionality available in the online help and consolidates the SAP Concur solutions documentation with other SAP products on the central SAP Help Portal.

Supported Configurations

Because web browsers are frequently updated, for ease of maintenance and to ensure that our documented supported browser information does not become out of date, we no longer publish the specific version data for supported browsers in the Concur Travel & Expense Supported Configurations Guide. In addition, the Monthly Browser Certifications document is now retired and will no longer be updated with supported browser version information each month.

For the most responsive, reliable and secure user experience with our products, SAP Concur recommends that users implement the most recent technology that is compliant with manufacturer's distribution and your company’s support and security policies.

This change helps to ensure that the supported browser information in the Concur Travel & Expense Supported Configurations Guide remains up to date.

Providing up-to-date supported browser information to users ensures that they have a better user experience while accessing the web version of SAP Concur.

Travel Operations / Technical Essentials

In October 2021, Concur Travel will begin enforcing the required ID remarks when attempting to input PNRs from GDS queues through the PNR acquisition process. The process includes PNRs created outside of Concur Travel, as well as PNRs created within Concur Travel that have been updated outside of Concur Travel. The required remarks will be Company ID (CLIQCID) and Login ID/User ID (CLIQUSER). Although not mandatory, Configuration ID (CLIQCONFIGID) is highly recommended.

During the PNR acquisition process, some of the required ID elements may be missing or in a format that Concur Travel is unable to parse. In such cases the PNRs will require correction. This will often be a manual process whereby the TMC will add the required remarks to the PNR and then re-input it into Concur Travel.

To reduce the number of PNRs that require ID remark correction, Concur Travel will begin auditing all PNRs as they are created within the booking tool and adding any missing or incorrectly formatted ID remarks. Concur Travel will not correct any PNRs created before this enhancement or any PNRs created directly by the TMCs or any other booking source.

All PNRs created within Concur Travel will include all necessary ID required remarks. This should reduce the number of corrections required by the TMCs, increase the accuracy in reporting and improve data integrity.

Miscellaneous

Beginning with the August release, clients can configure a link to their company’s privacy statement. The link will appear in the footer of their SAP Concur site with the text “Customer Privacy Statement”.

This change enables clients to meet GDPR and other legal requirements to provide their privacy statement to their customers.

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.
• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.
• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• st-eu.concursolutions.com
• vs.concursolutions.com
• vs.concurcdc.cn

These changes provide greater security for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption subkey.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• • Next expiry date: 4 September, 2022.
  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 24 January 2022. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur solutions will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

Administration

With the upcoming migration to an AWS-based data centre, the customers of a TMC may be split across two data centres. This is a temporary condition that may continue for a number of months. To mitigate this condition, the Travel System Admin interface will include a new look-up tool to help TMCs manage their customers from the correct data centre.

This change ensures that a customer is managed from the correct data centre, allowing, when necessary, the TMC to switch between data centres under a single login.

With the upcoming migration to an AWS-based data centre, to prevent accidental lockouts of a Sabre account, SAP Concur will temporarily remove the ability for a TMC to change their Sabre login password on the user interface. Once all customers have been migrated, we will reinstate this functionality and confirm its availability by release note.

As customers are migrated, their Sabre login password may be used across multiple data centres. Changing a password for a customer within one data centre and not the other can cause a lock out. We are disabling the change password functionality for TMCs so that this will be prevented. To change a password, please open a support case with reasonable notice for planned changes. SAP Concur support can update a password across all data centres, so the account will not be locked out.

Flight

Currently, users are not able to make changes to Travelport Southwest flights after the ticket has been issued. Targeted for October 2021, Southwest Post-Ticket change functionality will be available for Travelport customers with the Post-Ticket Change feature enabled in configuration.

This change will enable users to change Southwest airline flights via Travelport through Concur Travel after a ticket is issued.

Profile

Concur Locate will be decommissioned after 1 September 2021. As a result, the My Profile > Contact Information page will be updated to remove the Concur Mobile Devices fields. Instead, two additional fields will be added to the My Profile > Contact Information section: Mobile Phone Country/Region and Mobile Phone.

The XML Profile Sync, which is used to synchronise Concur Travel user profile data with TMC partners, will no longer be available, and this is targeted for the end of 2021. We advise all partners to engage with SAP Concur representatives to adopt the Travel Profile v2 API for managing Concur Travel user profiles.

The XML Profile Sync was officially decommissioned in 2016 due to instability and other issues. The Travel Profile v2 API was built to replace this legacy synchronisation process. It has now reached such a level of stability and maturity that there is no longer any reason to maintain multiple profile sync options.

Travel Operations / Technical Essentials

In order for Concur Travel to process offline bookings and updates to online bookings, specific information must be present in the PNR. Today, both of the following are required pieces of information:

1. Company ID (CLIQCID)
2. Login ID (CLIQUSER)

However, while both of these have been required historically, SAP Concur did not always reject PNRs when the required fields were missing. With this update, this requirement will be enforced. Any Sabre, Amadeus or Worldspan PNRs missing either of the required pieces of information will be rejected and placed in the error queue. Galileo and Apollo PNRs missing required information will be rejected.

By enforcing data requirements, we are improving data security.

Concur Travel uses the Travel Configuration ID to match trips to the correct configuration. This information will be used to identify Compleat-integrated customers. Without it, Concur Travel/Compleat integration features will not be available for these customers.