Connecting SailPoint and Workday

To connect SailPoint with Workday, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Configure.
5. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.

8. Under Connection Type, select Direct Connection or Flat File.

   • Direct Connection - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
   • Flat File - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.

9. If you selected Direct Connection, in Virtual Appliance Cluster, select the virtual appliance cluster that will be used as the application connector for the source.

10. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
11. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
12. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Select Save.

Connection Settings

Provide the information required to connect to the Workday source. Basic Authentication and OAuth 2.0 Authentication types are supported.

Basic Authentication

1. Enter the Workday URL that is used to connect to the Human Resource module of Workday. Use the following URL format: https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources, where tenant1 is the Workday tenant name.

   Note

   The Workday source only supports the Human Resource module of Workday.

2. Select Basic as the Authentication Type.

3. Provide the following details for the Basic Authentication Type:

   • Service Account - The Workday account with required permissions. The account must be in this format: <username>@<tenantname>

   • Password - The password that belongs to the service account.

   • Provisioning Administrator - The name of the provisioning administrator having permission to update the Workday account.
   • Provisioning Administrator Password - The password of the provisioning administrator with update permission.

REST Client API Configuration

For Basic authentication, enable the REST API option to perform the provisioning operation on custom objects.

1. Enter the REST API Endpoint of the Workday server. For example, https://WORKDAY_HOST/ccx/api/v1/TENANT_NAME

2. In Token Endpoint, enter the Workday token API endpoint. For example, https://WORKDAY_HOST/ccx/oauth2/TENANT_NAME/token

   Note

   The values of the REST API Endpoint and Token Endpoint can be obtained from the View API Clients report in the Workday application.

3. Enter the Workday API Client ID and Client Secret.

4. Enter the Workday API Refresh Token.

   Note

   Ensure that the token never expires.

OAuth 2.0 Authentication

1. Enter the Workday URL that is used to connect to the Human Resource module of Workday. Use the following URL format: https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources, where tenant1 is the Workday tenant name.

   Note

   The Workday source only supports the Human Resource module of Workday.

2. Select OAuth 2.0 as the Authentication Type.

3. Provide the following details for the Refresh Token Grant Type:

   • Client ID - Workday API client ID.
   • Client Secret - Workday API client secret.

   • Refresh Token - Non-expiry Workday API refresh token.

     Note

     To use OAuth 2.0 authentication in preexisting sources, update the source XML with connector_key="encrypted" value="refreshTokenDummy,clientSecretDummy,oauth_token_info" using the SailPoint REST API.

   • REST API Endpoint - The REST API Endpoint of the Workday server. For example, https://WORKDAY_HOST/ccx/api/v1/TENANT_NAME.

Connection Parameters

1. Enter the value for Page Size to fetch the number of records during aggregation in a single call (Limit 1 to 999). Default: 100.
2. Enter the Connection Timeout value in minutes. Default: 1 minute.
3. Enter the number of the Aggregation Thread Size. The default value is 4 (this is the maximum number of threads). You can set it to a lower value (for example, 2 or 3) depending on the system load. This parallel aggregation improves performance by reducing the time required to finish aggregation. The Workday source aggregates the active and terminated accounts.

4. Enter the value in Effective Time Zone that has the location and the time zone based on how the HR data (Hire, Termination, Re-hire, Conversion) is processed. Default: UTC.

   Note

   SailPoint recommends the use of the Effective Time Zone parameter during aggregation to avoid account issues.

   For example, if the Workday server is in the PST time zone then enter the America/Los Angeles time zone in this field. The following examples are supported valid timezones for Effective Time Zone:

   • America/New_York
   • America/Los_Angeles
   • America/Chicago
   • PST
   • HST
   • Asia/Dubai
   • CET
   • GMT
   • ACT
   • Australia/Melbourne

Aggregation Settings

This section provides the details required for aggregating the user accounts.

Refer to Loading Account Data for more information about aggregation.

1. Select Delta Aggregation to configure the delta aggregation parameters.
2. Enter the Past Effective Date Offset value to aggregate an account using delta aggregation that has been back-dated. For example, account details such as a termination date that has been set prior to the last aggregation.
3. Enter the Delta Aggregation Events list, which is used when performing delta aggregation.

Filter Settings

1. Select Exclude Future Terminating Records to skip future termination records during aggregation.

   Note

   Selecting this option removes the values for the following attributes: Future action, Future Date, Last day of work, and Termination date.

2. Select Aggregate Pre-Hires to aggregate Pre-Hires ahead of their start date.

3. Select Aggregate Rescinded Past Hires to retain information for the rescinded past hires to support leaver workflows.
4. In Past Rescinded Offset, enter the number of days (in the past) to aggregate rescinded hires. Default: 60 days. To fetch the rescinded past hires data for a worker, their hire date must be in the Past Rescinded Offset range.
5. Select Aggregate Rescinded Future Hires to fetch information for the rescinded future hire Workday workers to support leaver workflows.

6. In Effective Date Offset, enter the number of days in advance to aggregate future hires and terminations. For example, enter 14 to aggregate Workday workers 14 days in advance of their hire date.

   Note

   • If the Effective Date Offset is set as 0 (zero), the connector does not aggregate future hires and terminations.
   • SailPoint recommends that you perform a full aggregation if the Effective Date Offset is changed. For more information, refer to Future Dated Workers.

7. Enter the Organization Reference IDs to filter the workers' records based on organization. The Organization Reference IDs can be found as follows:

   1. Search for the required organization.
   2. Hover over the action and then select Integration ID.
   3. Select View IDs and note the ID mentioned in front of the organization type.

8. In Integration System ID, provide the System ID of the Integration System to fetch custom or calculated attributes.

9. Provide the Integration Field Override Service name.
10. In Integration Field(s), enter the integration service fields (with multiple fields separated by a comma) to aggregate workers based on the mentioned filter conditions.

11. The Past Termination Offset field determines the offset value in days, which indicates the number of past days to aggregate terminated workers based on their termination date. Default: 60 days. Use the following values for the offset:

    • 0 - aggregates all terminated workers
    • Blank - defaults the offset to 60 days
    • Any positive value - aggregates terminated workers within a specific number of days

    Note

    For more information on support for filtering using eligibility criteria, refer to Support for Filtering Using Eligibility Criteria.

12. Specify the Future Hire Events to include, such as Onboarding or Contract Contingent Worker, by entering the name of the event and selecting Enter. You can add multiple events. Default: Hire Employee, Onboarding, Contract Contingent Worker.

13. Specify Future Termination Events to include, such as Terminate Employee or End Contingent Worker Contract, by entering the name of the event and selecting Enter. You can add multiple events. Default: Terminate Employee, End Contingent Worker Contract.
14. Add Termination Attributes that are included for future terminated workers, such as Termination_Date or Contract End Date, by entering the attribute name and clicking Enter. You can add multiple attributes. Default: TERMINATION_DATE, LAST_DAY_OF_WORK, CONTRACT_END_DATE, PRIMARY_TERMINATION_REASON_REFERENCE.
15. To fetch terminated workers up to the aggregation date, specify Termination Events, such as Terminate Employee or End Contingent Worker Contract, by entering the event name and clicking Enter. You can add multiple attributes. Default: Terminate Employee, End Contingent Worker Contract.
16. Select Fetch Workers By Organization to fetch workers based on the organization type. When Exclude Terminated Worker is selected, Workday uses the default COST_CENTER Organization Type. To change the default, enter the organization type.
17. Select Save.

XPath Schema Mapping

The Workday source provides support to aggregate fields in addition to the fields present in the default account schema in the user interface. This option was previously only available using an API.

The default Workday connector includes XPaths for all default business processes. If you must aggregate future data and future actions for a different business process, you must define the new XPaths for that business process.

1. Select Add Another for each attribute you want to add.
2. Add the Schema Attribute, and provide the XPath for the attribute.
3. Select Save after you have added all the attributes.

Provisioning Settings

Provide the attributes to use for provisioning. This information is not required for your connection.

1. Provide the attributes to use for the Primary Home Phone Type and Primary Work Phone Type.

2. Provide the country code to use for the phone attributes.

3. Update the contact information by enabling Use Change Contact Info API. This option is only available when using API version 30.1 and later.

4. If the Use Change Contact Info API option is enabled, choose whether you want to delete phone or email records by selecting the following checkboxes:

   • Delete All Phone Records
   • Delete All Email Records

5. Select Bypass Provisioning Approvals to bypass the approval process on provisioning requests and automatically process changes.

6. Select Save.

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.