Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The Workday Accounts SaaS connector uses the following default correlation and object configurations.

Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.

When you first create the Workday Accounts SaaS source, the default correlation mapping is:

Account Attribute	Operation	Identity Attribute
FILENUMBER	Equals	SailPoint User Name (uid)

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
FILENUMBER	Account
ID	Group

Default Account Attributes

The Workday Accounts SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Description
USERID	The Workday account user name.
FILENUMBER	The unique identifier for the Employee or Contractor. This identifier can be an alphanumeric value based on the value present in the Workday system. When aggregating service center representative accounts, implementers and integration system accounts, the WID is populated in the `FILENUMBER` attribute. This is an Account ID which must not be changed.
ACCOUNT_DISABLED	Identifies whether the Workday account is disabled.
REQUIRE_NEW_PASSWORD_AT_NEXT_SIGN_IN	Indicates whether the Workday account will require a new password at next sign in.
SESSION_TIMEOUT_MINUTES	Number of minutes the user may be idle.
MULTI_FACTOR_AUTHENTICATION_EXEMPT	Exempt the user from multi-factor authentication.
MULTI_FACTOR_AUTHENTICATION_GRACE_PERIOD_ENABLED	Enable user's multi-factor authentication grace period.
GRACE_PERIOD_LOGINS_REMAINING	Remaining number of times the user can login without providing a multi factor authentication passcode.
ACCOUNT_EXPIRATION_DATE	Prevents the user from signing on to the system after this date.
OPENID_IDENTIFIER	Email address associated with the Open ID account.
OPENID_INTERNAL_IDENTIFIER	Open ID GUID
OPENID_CONNECT_INTERNAL_IDENTIFIER	OpenID Connect subject
EXEMPT_FROM_DELEGATED_AUTHENTICATION	Exempt from Delegated
WORKER_TYPE	Employee, Contingent_Worker, Service Center Representative, Extended Enterprise Learner, Implementer Account, Integration System User
USER_BASED_SECURITY_GROUPS	Enables aggregation of user-based security groups of the account.
SECURITY_GROUPS	Fetches all the security groups of the account except User based security groups.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Group Attributes

The Workday Accounts SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

The following table lists the group attributes for user-based Security Groups:

Attributes	Description	Path
ID	The internal ID for this group. This is an Account ID which must not be changed.	The path is automatically assigned.
COMMENT	The description for this group.	The path is automatically assigned.
DESCRIPTOR	The name for this group.	The path is automatically assigned.

Note

The COMMENT and DESCRIPTOR attributes are only supported for the OAuth 2.0 Authentication Type.

The following table lists the group attributes for SECURITY_GROUPS:

Attributes	Description	Path
ID	The internal ID for the groups.	The path is automatically assigned.
TYPE	The type for this group.	The path is automatically assigned.
NAME	The name for this group.	The path is automatically assigned.

Note

The SECURITY_GROUPS group attributes are only supported for the OAuth 2.0 Authentication Type.

Group Object: OrganizationRole

By default, the OrganizationRole group object is not part of the out-of-the-box schema. Use the createSchema API to create a new group schema for your source.

Note

Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community for more information on SailPoint's REST APIs.

Refer to OAuth 2.0 Authentication for more information on the additional permissions required for aggregating the OrganizationRole group object.

The following table lists the attributes of the OrganizationRole group object:

Attributes	Description	Path
ORG_ROLE##ORG_NAME	Associates an organization role reference ID with an organization name reference ID.	The path is automatically assigned.
ROLE_NAME	Organization role name.	The path is automatically assigned.
ASSOCIATED_SECURITY_GROUP	Associated role-based security group.	The path is automatically assigned.
ORGANIZATION_NAME	Name of the organization.	The path is automatically assigned.

To aggregate custom fields defined for the OrganizationRole group object, refer to Configuring Custom Attributes for the OrganizationRole Group.

Schema Example

The following is an example of API body content for adding entitlements to the source:

{
  "name": "OrganizationRole",
  "nativeObjectType": "OrganizationRole",
  "identityAttribute": "ORG_ROLE##ORG_NAME",
  "displayAttribute": "ORG_ROLE##ORG_NAME",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "ORG_ROLE##ORG_NAME",
      "type": "STRING",
      "schema": null,
      "description": "Associates an organization role reference ID with an organization name reference ID",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "ROLE_NAME",
      "type": "STRING",
      "schema": null,
      "description": "Name of the Role",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "ORGANIZATION_NAME",
      "type": "STRING",
      "schema": null,
      "description": "Name of the organization",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "ASSOCIATED_SECURITY_GROUP",
      "type": "STRING",
      "schema": null,
      "description": "Name of the Associated role-based security group",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}

Note

The new group object is only supported for the OAuth 2.0 Authentication Type.

Configuring Custom Attributes for the OrganizationRole Group

This section describes the procedure for fetching custom attributes from Workday.

The Workday Accounts SaaS supports aggregating custom fields defined for the OrganizationRole group object. To fetch the values of custom and calculated fields for the OrganizationRole group object, ensure that you enter the Integration System ID in the UI. Refer to Manage Additional Group Schema Attributes for more information.

Configure an Integration System in Workday

Perform the following steps to configure the Workday Integration System:

Search for Create Integration Field Override Service in Workday, and create a new Integration Field Override Service.
Assign a name to the Integration Field Override Service and select the business object as Organizations.
Add the fields, as per your requirement, and provide a name for each field:
1. Select the Plus icon to add a new row, and then select OK.
2. Choose a name that will match the schema attribute.
3. Define the required settings for the new fields.
4. Select Done.
5. Repeat these steps for each new field.
Create a new Workday Integration System as follows:
1. On your Workday Home page, go to Integration System > Create Integration System.
2. Provide a name for the Integration System.
3. Select New Using Template and provide the value as Document Transformation.
4. Select OK.
5. Go to Actions > Integration System > Configure Integration Attachment Service.
6. Select the Attachment column and select Create Integration Attachment Service.
7. Attach an empty text file and select OK.
In your new Workday Integration System, add the field override service created in the previous steps, as follows:
1. Go to Custom Integration Services.
2. Select the Plus icon. Under Custom Integration Services, add the field override service you created.
3. Select OK.
Note the System ID for this Workday Integration System. It is required to retrieve the custom or calculated attributes.
Search for View Integration System.
Enter the name of the Workday Integration System you created.
Select OK.
Map the new fields to the correct value:
1. Go to Integration System > Configure Integration Field Overrides.
2. Select the calculated or custom field and map the correct value to it in Override External Field.
3. Select OK.
4. Select Done.
When applicable, grant the required permissions to the service account associated with the source to aggregate the new custom or calculated fields.

Note

Custom and calculated attributes added to the Workday OrganizationRole Group schema must have __c appended to the field names created in Workday. For example, if you added PREVIOUS_EMPLOYER to Workday, you would add PREVIOUS_EMPLOYER__c in the source schema.
Aggregation takes more time for a larger number of configured custom attributes and calculated fields. The value of the calculated fields and custom attributes are calculated at run time, and aggregation is delayed, as it requires extra time to fetch the calculated values.

Organization Roles

The Workday Accounts SaaS aggregates and provisions an organization role with the organization name.

You must add a new schema attribute ORG_ROLE##ORG_NAME in the account schema. The ORG_ROLE##ORG_NAME is a multi-valued entitlement attribute of type OrganizationRole. The ORG_NAME value is used as the organization reference ID while assigning a role to a worker.

Assigning an Organization Other Than the Default Organization

If you want to assign an organization other than the default organization, configure the Organization_Reference_ID_Item attribute in the provisioning policy. This is the reference ID of the organization.

For example, if the value of the ORG_ROLE##ORG_NAME attribute is Admin##Test_Organization and you want to assign the Admin role to a different organization than Test_Organization, you must use the Organization_Reference_ID_Item attribute in the provisioning policy and pass the required organization reference ID.

Excluding Inherited Roles During Aggregation

The Workday Accounts SaaS supports aggregation and provisioning of Organization Roles assigned to the user in Workday. These roles are assigned to the user's parent/direct organization, as well as the underlying inherited organization. By default, the Workday Accounts SaaS aggregates both the direct and underlying inherited roles assigned to the users.

If you want to exclude the inherited roles during account aggregation, then enable the Exclude Inherited Organization Roles checkbox on the Additional Settings configuration page.

Account ID Default Account Attributes Default Correlation Configuration Default Entitlement Attributes Default Group Attributes SaaS Schema Reference Workday Accounts SaaS

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.