Troubleshooting

The following error is received during stylesheet compilation:

Exception : net.sf.saxon.s9api.SaxonApiException: Errors were reported during stylesheet compilation

Resolution: Ensure that All XPaths added are correct and no space is in Xpath Value

Resolution:

The following changes need to be made in the application.XML:

• Increase the value of Page size to 999

• Increase the value of Connection Timeout to 10

• Increase the value of retry count to 10

• Add the “Connection timed out” error message to the list of retryable errors.

Resolution : Increase the number of operators an XPath expression can contain by following parameter Djdk.xml.xpathExprOpLimit

For example: If following error observed “XPath expression contains '101' operators which exceeds a limit of '100'“ set the value of parameter as follows: Djdk.xml.xpathExprOpLimit=200

The Past_Termination_Offset parameter can be used to limit the aggregation of termination records based on offset days provided in the application. If there are multiple termination records for a worker, however, the user might experience a problem of the incorrect termination record getting picked up during aggregation.

Resolution: If the problem persists even after using the Past_Termination_Offset parameter to extend or reduce the past termination date offset, then add the splitPastTerminationOffsetBy parameter to the application debug page which will split the terminated workers aggregation into two steps.

For more information on the ‘Past_Termination_Offset’ parameter, refer Aggregation Settings.

For example:

• Today's Date: 31May2019
  Past_Termination_Offset: 60
  splitPastTerminationOffsetBy: 30
  First iteration would bring terminated accounts from 1 May 2019 to 31 May 2019 Second iteration would bring terminated accounts from 30 Apr 2019 to 1 Apr 2019.

• Today'sDate: 31May2019
  Past_Termination_Offset: Not specifiedsplitPastTerminationOffsetBy: 30
  First Iteration will bring terminated accounts from 1 May 2019 to 31 May 2019 Second Iteration will bring terminated accounts from 30 Apr 2019 to 1 Jan 1970.

The splitPastTerminationOffsetBy parameter is optional and fetches the latest record for multiple termination record for a file number in short span of time. This would ensure that correct record is fetched and no multiple records are toggled during aggregations.

The following error is received when testing the connection for the Workday connector:

Processing error occurred. PermGen space

This message is a Workday error that indicates the Workday server has run out of memory.

For example, the server may be processing a report that is consuming the server’s available memory. You need to work with your Workday team to resolve the server memory issues.

Resolutions: The following lists the possible exceptions and their solution:

• Test Connection Failed

• UnknownHostException

• FileNotFoundException

• HTTP response code: 500

Ensure that the Workday URL is correct and is case sensitive.

Test connection fails with the following error message due to Weblogic Server not using standard SUN HTTPS implementation provided by jdk:

openconnector.ConnectorException: javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received

The Weblogic Server uses the weblogic.net.http.SOAPHttpsUrlConnection class instead of the javax.net.ssl.HttpsUrlConnection class.

Resolution: Start the Weblogic Server with the following argument so that it will use SUN HTTPS default handler:

-DUseSunHttpHandler=true jvm

Complete the following steps:

1. Open WebLogic Sever installed directory and go to \user_projects\domains\base_domain\bin directory.

2. Edit the startManagedWebLogic.cmd file and set JAVA_OPTIONS=-DUseSunHttpHandler=true%JAVA_OPTIONS%

3. Save the startManagedWebLogic.cmd file.

4. Edit the startManagedWebLogic.sh file and set JAVA_OPTIONS="-DUseSunHttpHandler=true" ${JAVA_OPTIONS}"

5. Save the startManagedWebLogic.sh file.

6. Start the Managed Server.

While provisioning the PHONE_HOME, PHONE_WORK, ADDITIONAL_PHONE_HOME, and ADDITIONAL_PHONE_WORK attributes the following error message is displayed:

not Valid ID value for type="Phone_Device_Type_ID"

The above error message appears as the Workday connector uses the default phone device reference ID. The phone device reference ID varies according to the tenant. The Workday connector contains a ReferenceIDMap that contains phone device type id map.

Resolution: To change the reference ID of a specific phone device type, modify the Phone_Device_Type_ID map as follows :

<entry key="ReferenceIDMap">
    <value>
        <Map>
            <entry key="Phone_Device_Type_ID">
                <value>
                    <Map>
                        <entry key="Mobile" value="1063.1"/>
                        <entry key="Telephone" value="1063.5"/>
                        <entry key="Fax" value="1063.4"/>
                        <entry key="Pager" value="1063.6"/>
                    </Map>
                </value>
            </entry>
        </Map>
    </value>
</entry> 

Complete the following to find Phone_Device_Type_Reference_Id:

1. Search View Workday ID report.

2. Enter Phone Device Type as class name in the report and select OK.

3. Select Related action of phone device type > Integration IDs > View Reference IDs.

   The Reference ID values of Phone Device type ID are listed.

If the EMPLOYEE_TYPE value for any contingent worker is not correct, for example, 382.2 which is the ID of the EMPLOYEE_TYPE.

Resolution: The application contains a default map as follows for mapping the incorrect IDs with employee type:

<entry key="ReferenceIDMap">
    <value>
        <Map>
            <entry key="Employee_Type_ID">
                <value>
                    <Map>
                        <entry key="382.1" value="Consultant"/>
                        <entry key="382.2" value="Contractor"/>
                        <entry key="382.3" value="Vendor"/>
                    </Map>
                </value>
            </entry>
        </Map>
    </value>
</entry>

The above default map, would map 382.2 key with Contractor string. For numeric value issues in EMPLOYEE_TYPE account attribute in IdentityIQ, if the actual Contractor string is not obtained then copy the value of the appropriate reference id of that employee type from the Workday managed system and add it in Workday application Employee_Type_ID map.

For example, in IdentityIQ for a value of 382.2 in EMPLOYEE_TYPE complete the following steps:

1. In Workday managed system search for Contingent Worker Type and select it.

2. For each row a related action option exists. Open Related action > Integration ID > View IDs and find the type of contingent worker assigned to 382.2.

3. After finding the correct value of the contingent worker type, add the value to the Employee_Type_ID map in the application debug page.

   For the correct changes to be reflected perform full aggregation task.

While updating contingent worker data for existing applications, the following error message is displayed:

Invalid ID value. '21430' is not valid ID value for type='Employee_ID

Resolution: If the provided Employee_ID belongs to the contingent worker, add the following map in the application debug page:

<entry key="EmployeeTypeMap">
    <value>
        <Map>
            <entry key="EmployeeTypes">
                <value>
                    <List>
                        <String>Regular</String>
                        <String>Casual</String>
                        <String>Expatriate</String>
                        <String>Fixed Term Contract</String>
                        <String>Seasonal</String>
                        <String>Temporary</String>
                        <String>Trainee</String>
                    </List>
                </value>
            </entry>
            <entry key="ContingentWorkerTypes">
                <value>
                    <List>
                        <String>Contractor</String>
                        <String>Consultant</String>
                        <String>Vendor</String>
                    </List>
                </value>
            </entry>
        </Map>
    </value>
</entry>

Note
This map is present for new connectors.

Complete the following to find the supported employee type:

1. In Workday managed system, search for reports of type Employee Types.

2. In the displayed report, verify if any additional employee type is listed on the Workday managed system. If a new employee type is listed, add it in EmployeeTypeMap > EmployeeTypes.

   For example, if an additional employee type is found in Trainee then add the following entry under EmployeeTypeMap > EmployeeTypes:

   <String>Trainee</String>

Complete the following to find supported contingent worker types:

1. In Workday managed system, search for reports of type Contingent worker Types.

2. In the displayed report, verify if any additional contingent worker type is listed on the Workday managed system. If a new contingent worker type is listed, add it in EmployeeTypeMap > ContingentWorkerTypes.

   For example, if additional employee type is found in Trainee Consultant then add the following entry under EmployeeTypeMap > ContingentWorkerTypes:

   <String>Consultant</String>

While updating the Workday account email or phone attribute, the following error message is displayed:

The task submitted is not authorized

Resolution: The error message indicates that user is not authorized with some permission. The Workday administrator must verify if the specific integration security group is added to Maintain Contact Information (Web Service).

By default, the connector retrieves BenefitEligibility data while retrieving the workers.

Resolution: To exclude retrieving BenefitEligibility data, add the following in the application debug page:

<entry key="Configure_Response_Group">
    <value>
        <Map>
            <entry key="excludeBenefitEligibility" value="true"/>
        </Map>
    </value>
</entry> 

By default, the connector does not retrieve Supervisory Organization data while retrieving the workers.

Resolution: To retrieve Supervisory Organization data, add the following in the application debug page:

<entry key="Configure_Response_Group">
    <value>
        <Map>
            <entry key="Exclude_Supervisory_Organizations" value="false"/>
        </Map>
    </value>
</entry> 

Resolution: When Reference IDs are updated in Workday, you must complete the following:

1. Delete the ReferenceIDMap entry from the debug page.

2. Delete the following relevant entries from the XpathAttributesMap:

   • (Phone Reference IDs) WORK_MOBILE, WORK_TELEPHONE, HOME_MOBILE, and HOME_TELEPHONE

   • (Employee Type Reference ID) EMPLOYEE_TYPE

   • (Contingent Worker Type Reference ID) Contingent_Worker_Type

3. Perform aggregation.

   The Workday connector updates the latest IDs in the application along with latest Xpath for the attributes listed in Step 2 above.

Delta aggregation uses the last aggregation time set by IdentityIQ, which results in a time difference on the machine with the following error message:

java.lang.RuntimeException - sailpoint.connector.ConnectorException: openconnector.ConnectorException: Updated From must be less than or equal to Updated Through!

Resolution: Synchronize the machine system time with current time of the Effective Time Zone added in the Workday application configuration.

For more information on Effective Time Zone, see Configuration Parameters.

After aggregation, blank values are obtained in IdentityIQ as XPath is not added to the following new phone attributes in the default Workday schema:

• WORK_PAGER

• WORK_FAX

• HOME_PAGER

• HOME_FAX

Resolution: Add the XPath attributes to the phone attributes. For more information, refer to XPATH to Support Additional Standard Attributes in Schema.

Fixed intermittent issue of Timeout waiting for connection with the following error message:

Exception: org.apache.axis2.AxisFault: Timeout waiting for connection

Resolution: Specify HTTP connection pool size by adding the following application attribute:

<entry key="http_conn_pool_size" value="50"/>

By default the value for http_conn_pool_size is 50.

On 23 March 2018, the Workday managed system has new server certificates. Therefore, for customers using a Workday connector created prior to 23 March 2018, the following error message is displayed:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Resolution: Complete the following:

1. Log on to Workday application instance or the login page.

2. Find the certificate details by selecting the padlock icon in the browser and copy the certificate name.

3. Search the above copied certificate name in https://www.digicert.com/digicert-root-certificates.htm and download the root certificate.

   Save the downloaded certificate in a folder. For example, D:\\workdaycert\DigiCertGlobalRootG2.crt

4. Go to the JRE path > lib\security folder and ensure that the cacerts file is present.

   As an administrator, open a command prompt and go to the JRE path > bin folder.

5. Execute the following command:

   keytool -import -alias <your alias> -file "<path to new downloaded certificate including filename>" -keystore "<path to cacerts including filename>" -storepass changeit

   In the above command:
   

   • <paths...> - replace with the paths as identified in the above steps.

   • <alias> - select an appropriate alias.

6. For example, keytool -import -alias workday-cert -file D:\\workdaycert\DigiCertGlobalRootG2.crt -keystore cacerts -storepass changeit

   Respond as Y when prompted to import the certificate.

7. Restart the Web Server.

When access token expires, an error message appears. The Workday connector checks the following strings in error messages in order to generate new access token:

• 400

• 401

• Unknown Error

• Invalid access token

Resolution: In cases where the error message does not contain any of the above mentioned strings, then configure the oauth2Errors attribute to accommodate the additional error sub-strings as follows:

<entry key="oauth2Errors">
    <value>
        <List>
            <String>Token expired</String>
            <String>MY_CUSTOM_ERROR</String>
        </List>
    </value>
</entry>

The Past_Termination_Offset parameter can be used to limit the aggregation of termination records based on offset days provided in the application. However if there are multiple termination records for a worker the user might experience a problem of incorrect termination record getting picked up during aggregation.

Resolution: If the problem persists even after using the Past_Termination_Offset parameter to extend or reduce the past termination date offset, then add the splitPastTerminationOffsetBy parameter to the application debug page which will split the terminated workers aggregation into two steps.

Key: connector_splitPastTerminationOffsetBy

Value: number of days

Note
For more information on the Past_Termination_Offset parameter, refer to Additional Configuration Parameters.

Example 1:

• Today's Date: 31 May 2019

• Past_Termination_Offset: 60

• splitPastTerminationOffsetBy: 30

• First iteration would bring terminated accounts from 1 May 2019 to 31 May 2019

• Second iteration would bring terminated accounts from 30 Apr 2019 to 1 Apr 2019
  

Example 2:

• Today's Date: 31 May 2019

• Past_Termination_Offset: Not specified

• splitPastTerminationOffsetBy: 30

• First Iteration will bring terminated accounts from 1 May 2019 to 31 May 2019

• Second Iteration will bring terminated accounts from 30 Apr 2019 to 1 Jan 1970

The splitPastTerminationOffsetBy parameter is optional and fetches the latest record for multiple termination record for a file number in short span of time. This would ensure that correct record is fetched and no multiple records are toggled during aggregation.

Test connection fails with the following error message when Workday connector is deployed on Websphere:

[ConnectorException] [Error details] Exception: Received fatal alert: handshake_failure

Resolution: Add the com.ibm.jsse2.overrideDefaultTLS property with the value as true in Java properties using one of the following methods:

• Go to Servers >Java and Process Management >Process Definition >JVM >Custom Properties and add the property with a value of true.
  

• Add in the jvm.options file.

For more information, refer to https://www.ibm.com/support/knowledgecenter/SSD28V_liberty/com.ibm.websphere.wlp.core.doc/ae/twlp_admin_customvars.html

While configuring a new Workday connector, aggregation fails with the following error message for an incorrect XPath configured for one of the schema attributes:

SystemId Unknown; Line #1; Column #19566; A location step was expected following the '/' or '//' token.

SystemId Unknown; Line #1; Column #19566; Extra illegal tokens: ''ns1:Hire_Date'

The above error message is an example of incorrect XPath for Hire_Date attribute.

Resolution: Ensure that a valid XPath for the respective attribute is provided.

During aggregation, due to network load or tenant/server connectivity issues, intermittent errors are displayed. By default the Workday connector displays the following error:

Connection reset, 503 Service Unavailable

Resolution: Add the following entries in the application configuration to add this error to the retryable errors list:

retryErrors: This entry contains the list of error strings and can be configured in the debug page. By default, Connection Reset and 503 Service Unavailable handling are included, but you can add one or more error strings.

<entry key="retryErrors">
    <value>
        <List>
            <String>Connection reset</String>
            <String>failed to respond</String>
            <String>503 Service Unavailable</String>
        </List>
    </value>
</entry>

retryCount: This entry can be configured in application debug pagefor retrying the failed request as per the retry count. The default value is 1.

<entry key="retryCount" value="1"/>

Resolution: To fetch rescinded past hires data for a worker, their hire date must be in the Past Rescinded Offset range. Make sure to provide the appropriate number of days in the Past Rescinded Offset field.

Resolution: Make sure Effective Date Offset is either empty or a non-zero integer value per the requirement. Do not set it to 0.

Resolution: The Workday connector requires the following schema attributes and associated XPaths for aggregation:

• HIREDATE - Required for Aggregating Active Worker

• TERMINATION_DATE - Required for Aggregating Terminated Worker

• CONTRACT_END_DATE - Required for Aggregating Contract Terminated Worker

• FILENUMBER - Unique Identity of the Worker

  Do not remove these attributes and their XPaths from the debug page.

During the initial aggregation the connector dynamically updates the source configuration with the ID to name mapping based on the Workday configuration.

Resolution: If some mappings have not been updated and the account is being populated with an ID, you can run a non-optimized aggregation. If needed, remove the following entries from the source config using the API and then run a non-optimized aggregation for a clean start.

• ReferenceIDMap

• Entries from the XpathAttributesMap:

  • (Phone Reference IDs) WORK_MOBILE, WORK_TELEPHONE, HOME_MOBILE, and HOME_TELEPHONE

  • (Employee Type Reference ID) EMPLOYEE_TYPE

  • (Contingent Worker Type Reference ID) Contingent_Worker_Type

It is observed that some of the tenant has the Phone Device Type ‘Telephone’ is defined on the workday manage system as ‘Landline’ due to which the mapping in the application forms as below.

<entry key="Phone_Device_Type_ID">
<value>
<Map>
<entry key="Fax" value="Fax"/>
<entry key="Landline" value="Landline"/>
<entry key="Mobile" value="Mobile"/>
</Map>
</value>
</entry>

This is incorrect as the connector will specifically look for ‘Telephone’ key which is not in the list and will use default device ID-1063.5 to update the land-line number which is not present and will throw the error.

Resolution : Change the mapping :
<entry key="Landline" value="Landline"/> to <entry key="Telephone" value="Landline"/> in the above list, save the application and verify the issue.

By default, the connector adds below the business in delta event list while preparing the request. Hence, there is no need to add below business process in the <Delta_Event_List> additionally.

• Hire Employee

• Terminate Employee

• Contract Contingent Worker

• End Contingent Worker Contract

Explanation: Delta aggregation works on business event as there is no such business event present from Workday for corrected/rescinded data. Delta aggregation does not get corrected/rescinded data.

Resolution: Verify the Phone_Device_Type_ID mapping of ‘Landline’ is set as “Telephone” : “Landline”. Also verify the XPATH for WORK_TELEPHONE is correct .

For Example: If Phone_Device_Type name in Workday tenant is ‘Landline’ and its Reference Id is ‘Landline’ then in connector customer has to update the “Phone_Device_Type_ID” of ‘Landline’ as below:

<entry key="Phone_Device_Type_ID">
<value>
<Map>
<entry key="Telephone" value="Landline"/>
</Map>
</value>
</entry>