# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Workday Accounts SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Workday Accounts SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | FILENUMBER | Equals | SailPoint User Name (uid) | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | FILENUMBER | Account | | ID | Group | ### Default Account Attributes The Workday Accounts SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | USERID | The Workday account user name. | | FILENUMBER | The unique identifier for the Employee or Contractor. This identifier can be an alphanumeric value based on the value present in the Workday system.
When aggregating service center representative accounts, implementers and integration system accounts, the WID is populated in the `FILENUMBER` attribute.
This is an Account ID which must not be changed. | | ACCOUNT\_DISABLED | Identifies whether the Workday account is disabled. | | REQUIRE\_NEW\_PASSWORD\_AT\_NEXT\_SIGN\_IN | Indicates whether the Workday account will require a new password at next sign in. | | SESSION\_TIMEOUT\_MINUTES | Number of minutes the user may be idle. | | MULTI\_FACTOR\_AUTHENTICATION\_EXEMPT | Exempt the user from multi-factor authentication. | | MULTI\_FACTOR\_AUTHENTICATION\_GRACE\_PERIOD\_ENABLED | Enable user's multi-factor authentication grace period. | | GRACE\_PERIOD\_LOGINS\_REMAINING | Remaining number of times the user can login without providing a multi factor authentication passcode. | | ACCOUNT\_EXPIRATION\_DATE | Prevents the user from signing on to the system after this date. | | OPENID\_IDENTIFIER | Email address associated with the Open ID account. | | OPENID\_INTERNAL\_IDENTIFIER | Open ID GUID | | OPENID\_CONNECT\_INTERNAL\_IDENTIFIER | OpenID Connect subject | | EXEMPT\_FROM\_DELEGATED\_AUTHENTICATION | Exempt from Delegated | | WORKER\_TYPE | Employee, Contingent\_Worker, Service Center Representative, Extended Enterprise Learner, Implementer Account, Integration System User | | USER\_BASED\_SECURITY\_GROUPS | Enables aggregation of user-based security groups of the account. | | SECURITY\_GROUPS | Fetches all the security groups of the account except User based security groups. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Workday Accounts SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. The following table lists the group attributes for user-based Security Groups: | Attributes | Description | Path | | --- | --- | --- | | ID | The internal ID for this group. This is an Account ID which must not be changed. | The path is automatically assigned. | | COMMENT | The description for this group. | The path is automatically assigned. | | DESCRIPTOR | The name for this group. | The path is automatically assigned. | > [!NOTE] > > The `COMMENT` and `DESCRIPTOR` attributes are only supported for the OAuth 2.0 Authentication Type. The following table lists the group attributes for `SECURITY_GROUPS`: | Attributes | Description | Path | | --- | --- | --- | | ID | The internal ID for the groups. | The path is automatically assigned. | | TYPE | The type for this group. | The path is automatically assigned. | | NAME | The name for this group. | The path is automatically assigned. | > [!NOTE] > > The `SECURITY_GROUPS` group attributes are only supported for the OAuth 2.0 Authentication Type. #### Group Object: OrganizationRole By default, the `OrganizationRole` group object is not part of the out-of-the-box schema. Use the [createSchema API]() to create a new group schema for your source. > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint's REST APIs. Refer to [OAuth 2.0 Authentication]() for more information on the additional permissions required for aggregating the `OrganizationRole` group object. The following table lists the attributes of the `OrganizationRole` group object: | Attributes | Description | Path | | --- | --- | --- | | ORG\_ROLE\#\#ORG\_NAME | Associates an organization role reference ID with an organization name reference ID. | The path is automatically assigned. | | ROLE\_NAME | Organization role name. | The path is automatically assigned. | | ASSOCIATED\_SECURITY\_GROUP | Associated role-based security group. | The path is automatically assigned. | | ORGANIZATION\_NAME | Name of the organization. | The path is automatically assigned. | To aggregate custom fields defined for the `OrganizationRole` group object, refer to [Configuring Custom Attributes for the OrganizationRole Group](<#configuring-custom-attributes-for-the-organizationrole-group>). ##### Schema Example The following is an example of API body content for adding entitlements to the source: ```json { "name": "OrganizationRole", "nativeObjectType": "OrganizationRole", "identityAttribute": "ORG_ROLE##ORG_NAME", "displayAttribute": "ORG_ROLE##ORG_NAME", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "ORG_ROLE##ORG_NAME", "type": "STRING", "schema": null, "description": "Associates an organization role reference ID with an organization name reference ID", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ROLE_NAME", "type": "STRING", "schema": null, "description": "Name of the Role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ORGANIZATION_NAME", "type": "STRING", "schema": null, "description": "Name of the organization", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ASSOCIATED_SECURITY_GROUP", "type": "STRING", "schema": null, "description": "Name of the Associated role-based security group", "isMulti": false, "isEntitlement": false, "isGroup": false } ] } ``` > [!NOTE] > > The new group object is only supported for the OAuth 2.0 Authentication Type. #### Configuring Custom Attributes for the OrganizationRole Group This section describes the procedure for fetching custom attributes from Workday. The Workday Accounts SaaS supports aggregating custom fields defined for the `OrganizationRole` group object. To fetch the values of custom and calculated fields for the `OrganizationRole` group object, ensure that you enter the **Integration System ID** in the UI. Refer to [Manage Additional Group Schema Attributes]() for more information. ##### Configure an Integration System in Workday Perform the following steps to configure the Workday Integration System: 1. Search for **Create Integration Field Override Service** in Workday, and create a new Integration Field Override Service. 2. Assign a name to the Integration Field Override Service and select the business object as **Organizations**. 3. Add the fields, as per your requirement, and provide a name for each field: 1. Select the **Plus** icon to add a new row, and then select **OK**. 2. Choose a name that will match the schema attribute. 3. Define the required settings for the new fields. 4. Select **Done**. 5. Repeat these steps for each new field. 4. Create a new Workday Integration System as follows: 1. On your Workday Home page, go to **Integration System \> Create Integration System**. 2. Provide a name for the Integration System. 3. Select **New Using Template** and provide the value as **Document Transformation**. 4. Select **OK**. 5. Go to **Actions \> Integration System \> Configure Integration Attachment Service**. 6. Select the Attachment column and select **Create Integration Attachment Service**. 7. Attach an empty text file and select **OK**. 5. In your new Workday Integration System, add the field override service created in the previous steps, as follows: 1. Go to **Custom Integration Services**. 2. Select the **Plus** icon. Under **Custom Integration Services**, add the field override service you created. 3. Select **OK**. 6. Note the System ID for this Workday Integration System. It is required to retrieve the custom or calculated attributes. 7. Search for **View Integration System**. 8. Enter the name of the Workday Integration System you created. 9. Select **OK**. 10. Map the new fields to the correct value: 1. Go to **Integration System \> Configure Integration Field Overrides**. 2. Select the calculated or custom field and map the correct value to it in **Override External Field**. 3. Select **OK**. 4. Select **Done**. 11. When applicable, grant the required permissions to the service account associated with the source to aggregate the new custom or calculated fields. > [!NOTE] > > - Custom and calculated attributes added to the Workday OrganizationRole Group schema must have `__c` appended to the field names created in Workday. For example, if you added `PREVIOUS_EMPLOYER` to Workday, you would add `PREVIOUS_EMPLOYER__c` in the source schema. > - Aggregation takes more time for a larger number of configured custom attributes and calculated fields. The value of the calculated fields and custom attributes are calculated at run time, and aggregation is delayed, as it requires extra time to fetch the calculated values. ## Organization Roles The Workday Accounts SaaS aggregates and provisions an organization role with the organization name. You must add a new schema attribute `ORG_ROLE##ORG_NAME` in the account schema. The `ORG_ROLE##ORG_NAME` is a multi-valued entitlement attribute of type `OrganizationRole`. The `ORG_NAME` value is used as the organization reference ID while assigning a role to a worker. ### Assigning an Organization Other Than the Default Organization If you want to assign an organization other than the default organization, configure the `Organization_Reference_ID_Item` attribute in the provisioning policy. This is the reference ID of the organization. For example, if the value of the `ORG_ROLE##ORG_NAME` attribute is `Admin##Test_Organization` and you want to assign the `Admin` role to a different organization than `Test_Organization`, you must use the `Organization_Reference_ID_Item` attribute in the provisioning policy and pass the required organization reference ID. ### Excluding Inherited Roles During Aggregation The Workday Accounts SaaS supports aggregation and provisioning of Organization Roles assigned to the user in Workday. These roles are assigned to the user's parent/direct organization, as well as the underlying inherited organization. By default, the Workday Accounts SaaS aggregates both the direct and underlying inherited roles assigned to the users. If you want to exclude the inherited roles during account aggregation, then enable the **Exclude Inherited Organization Roles** checkbox on the [Additional Settings]() configuration page.