Schema Reference

The application schema is used to configure the objects returned from a connector.

The Workday Accounts connector uses the following default correlation and object configurations.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

The following table lists the default account IDs for this connector:

Default Account Attributes

The Workday Accounts connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Default Group Attributes

The Workday Accounts connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

The following table lists the group attributes for user-based Security Groups:

By default, "ID" is marked as displayAttribute and descriptionAttribute. To update it, use update-source | SailPoint Developer Community. The following is an example of API body content:

[{
    "op": "add",
    "path": "/configuration/displayAttribute",
    "value": "DESCRIPTOR"
}]

[{
    "op": "add",
    "path": "/configuration/descriptionAttribute",
    "value": "COMMENT"
}]

The following table lists the group attributes for SECURITY_GROUPS:

Group Object: OrganizationRole

By default, the OrganizationRole group object is not part of the out-of-the-box schema. Use the createSchema API to create a new group schema for your source.

Refer to OAuth 2.0 Authentication for more information on the additional permissions required for aggregating the OrganizationRole group object.

The following table lists the attributes of the OrganizationRole group object:

To aggregate custom fields defined for the OrganizationRole group object, refer to Configuring Custom Attributes for the OrganizationRole Group.

Configuring Custom Attributes for the OrganizationRole Group

This section describes the procedure for fetching custom attributes from Workday.

The Workday Accounts supports aggregating custom fields defined for the OrganizationRole group object.

Configure an Integration System in Workday

Perform the following steps to configure the Workday Integration System:

1. Search for Create Integration Field Override Service in Workday, and create a new Integration Field Override Service.
2. Assign a name to the Integration Field Override Service and select the business object as Organizations.

3. Add the fields, as per your requirement, and provide a name for each field:

   1. Select the Plus icon to add a new row, and then select OK.
   2. Choose a name that will match the schema attribute.
   3. Define the required settings for the new fields.
   4. Select Done.
   5. Repeat these steps for each new field.

4. Create a new Workday Integration System as follows:

   1. On your Workday Home page, go to Integration System > Create Integration System.
   2. Provide a name for the Integration System.
   3. Select New Using Template and provide the value as Document Transformation.
   4. Select OK.
   5. Go to Actions > Integration System > Configure Integration Attachment Service.
   6. Select the Attachment column and select Create Integration Attachment Service.
   7. Attach an empty text file and select OK.

5. In your new Workday Integration System, add the field override service created in the previous steps, as follows:

   1. Go to Custom Integration Services.
   2. Select the Plus icon. Under Custom Integration Services, add the field override service you created.
   3. Select OK.

6. Note the System ID for this Workday Integration System. It is required to retrieve the custom or calculated attributes.

7. Search for View Integration System.
8. Enter the name of the Workday Integration System you created.
9. Select OK.

10. Map the new fields to the correct value:

    1. Go to Integration System > Configure Integration Field Overrides.
    2. Select the calculated or custom field and map the correct value to it in Override External Field.
    3. Select OK.
    4. Select Done.

11. When applicable, grant the required permissions to the service account associated with the source to aggregate the new custom or calculated fields.

Organization Roles

The Workday Accounts aggregates and provisions an organization role with the organization name.

You must add a new schema attribute ORG_ROLE##ORG_NAME in the account schema. The ORG_ROLE##ORG_NAME is a multi-valued entitlement attribute of type OrganizationRole. The ORG_NAME value is used as the organization reference ID while assigning a role to a worker.

Assigning an Organization Other Than the Default Organization

If you want to assign an organization other than the default organization, configure the Organization_Reference_ID_Item attribute in the provisioning policy. This is the reference ID of the organization.

For example, if the value of the ORG_ROLE##ORG_NAME attribute is Admin##Test_Organization and you want to assign the Admin role to a different organization than Test_Organization, you must use the Organization_Reference_ID_Item attribute in the provisioning policy and pass the required organization reference ID.

Excluding Inherited Roles During Aggregation

The Workday Accounts supports aggregation and provisioning of Organization Roles assigned to the user in Workday. These roles are assigned to the user's parent/direct organization, as well as the underlying inherited organization. By default, the Workday Accounts aggregates both the direct and underlying inherited roles assigned to the users.

If you want to exclude the inherited roles during account aggregation, then on the Additional Settings configuration page, select the Exclude Inherited Organization Roles checkbox.

Aggregating Security Groups

The Workday Account source supports the aggregation of the security group as a group object.

The new security group schema containing the ID attribute is introduced to aggregate the security group. The object type is SecurityGroup.

For the new Workday Accounts sources, the schema will be populated by default with the ID as an attribute. The aggregation will fetch all user-based security groups present on the Workday Accounts managed system.

For the existing Workday Accounts sources, you must add the USER_BASED_SECURITY_GROUPS attribute to the schema to fetch the groups through entitlement aggregation.

You must add and mark the USER_BASED_SECURITY_GROUPS attribute as a managed, multi-valued attribute, and as an entitlement. Additionally, the group schema must be defined.

Aggregating and Provisioning User-Based Security Groups

The Workday Accounts source supports the aggregation and provisioning of user-based Security Groups.

USER_BASED_SECURITY_GROUPS is the new schema attribute:

• XPath: ns1:Get_Assign_User-Based_Security_Groups_Response/ns1:Response_Data/ns1:Assign_User-Based_Security_Groups

For new Workday Accounts sources, by default, the account schema will have the USER_BASED_SECURITY_GROUPS attribute. Account aggregation fetches all user-based security groups linked to workers.

For existing Workday Accounts sources, you must add the USER_BASED_SECURITY_GROUPS attribute to the schema with values as a managed, multi-valued attribute, and as an entitlement.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.