# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Workday Accounts connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| FILENUMBER | Account |
| ID | Group |

### Default Account Attributes

The Workday Accounts connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| USERID | The Workday account user name. |
| FILENUMBER | The unique ID for Employee, Contractor, Service Center Representative, Extended Enterprise Learner, Implementer, Integration and Students System accounts. This identifier can be an alphanumeric value based on the value present in the Workday system.<br>When aggregating service center representative accounts, implementers and integration system accounts, the WID is populated in the `FILENUMBER` attribute.<br>This is an Account ID which must not be changed. |
| ACCOUNT\_DISABLED | Indicates whether the Workday account is disabled. |
| REQUIRE\_NEW\_PASSWORD\_AT\_NEXT\_SIGN\_IN | Indicates whether the Workday account will require a new password at next sign in. |
| SESSION\_TIMEOUT\_MINUTES | The number of minutes the user may be idle. |
| MULTI\_FACTOR\_AUTHENTICATION\_EXEMPT | Indicates if the user is exempt from multi-factor authentication. |
| MULTI\_FACTOR\_AUTHENTICATION\_GRACE\_PERIOD\_ENABLED | Indicates if the user's multi-factor grace period is enabled. |
| GRACE\_PERIOD\_LOGINS\_REMAINING | The remaining number of times the user can login without providing a multi-factor authentication passcode. |
| ACCOUNT\_EXPIRATION\_DATE | Prevents the user from signing on to the system after this date. |
| OPENID\_IDENTIFIER | The email address associated with the Open ID account. |
| OPENID\_INTERNAL\_IDENTIFIER | Open ID GUID. |
| OPENID\_CONNECT\_INTERNAL\_IDENTIFIER | OpenID Connect subject. |
| EXEMPT\_FROM\_DELEGATED\_AUTHENTICATION | Indicates if the user is exempt from delegated authentication. |
| WORKER\_TYPE | Workers type (Employee\|Contingent\_Worker\|Service Center Representative\|Extended Enterprise Learner\|Implementer Account\|Integration System User\|Applicant Student\|Prospect Student\|Pre-Matriculant Student\|Matriculant Student) |
| USER\_BASED\_SECURITY\_GROUPS | Enables aggregation of user-based security groups of the account. |
| SECURITY\_GROUPS | Fetches all the security groups of the account except user-based security groups. |
| INTEGRATION\_SYSTEM\_ID | Fetches Integration System ID associated with Integration system account. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Workday Accounts connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

The following table lists the group attributes for user-based Security Groups:

| Attributes | Description | Path |
| --- | --- | --- |
| ID | The internal ID for this group. This is an Account ID which must not be changed. | The path is automatically assigned. |
| COMMENT | The description for this group. | The path is automatically assigned. |
| DESCRIPTOR | The name for this group. | The path is automatically assigned. |

> [!NOTE]
>
> The `COMMENT` and `DESCRIPTOR` attributes are only supported for the OAuth 2.0 Authentication Type.

By default, "ID" is marked as `displayAttribute` and `descriptionAttribute`. To update it, use [update-source | SailPoint Developer Community](<https://developer.sailpoint.com/docs/api/v3/update-source>). The following is an example of API body content:

```json
[{
    "op": "add",
    "path": "/configuration/displayAttribute",
    "value": "DESCRIPTOR"
}]
```

```json
[{
    "op": "add",
    "path": "/configuration/descriptionAttribute",
    "value": "COMMENT"
}]
```

The following table lists the group attributes for `SECURITY_GROUPS`:

| Attributes | Description | Path |
| --- | --- | --- |
| ID | The internal ID for the groups. | The path is automatically assigned. |
| TYPE | The type for this group. | The path is automatically assigned. |
| NAME | The name for this group. | The path is automatically assigned. |

> [!NOTE]
>
> The `SECURITY_GROUPS` group attributes are only supported for the OAuth 2.0 Authentication Type.

#### Group Object: OrganizationRole

By default, the `OrganizationRole` group object is not part of the out-of-the-box schema. Use the [createSchema API](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) to create a new group schema for your source.

> [!NOTE]
>
> Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community for more information on SailPoint's REST APIs.

Refer to [OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/workday_accounts/va/help/index.html#oauth-20-authentication>) for more information on the additional permissions required for aggregating the `OrganizationRole` group object.

The following table lists the attributes of the `OrganizationRole` group object:

| Attributes | Description | Path |
| --- | --- | --- |
| ORG\_ROLE\#\#ORG\_NAME | Associates an organization role reference ID with an organization name reference ID. | The path is automatically assigned. |
| ROLE\_NAME | Organization role name. | The path is automatically assigned. |
| ASSOCIATED\_SECURITY\_GROUP | Associated role-based security group. | The path is automatically assigned. |
| ORGANIZATION\_NAME | Name of the organization. | The path is automatically assigned. |

To aggregate custom fields defined for the `OrganizationRole` group object, refer to [Configuring Custom Attributes for the OrganizationRole Group](<#configuring-custom-attributes-for-the-organizationrole-group>).

> [!NOTE]
>
> The new group object is only supported for the OAuth 2.0 Authentication Type.

#### Configuring Custom Attributes for the OrganizationRole Group

This section describes the procedure for fetching custom attributes from Workday.

The Workday Accounts supports aggregating custom fields defined for the `OrganizationRole` group object.

##### Configure an Integration System in Workday

Perform the following steps to configure the Workday Integration System:

1. Search for **Create Integration Field Override Service** in Workday, and create a new Integration Field Override Service.
2. Assign a name to the Integration Field Override Service and select the business object as **Organizations**.
3. Add the fields, as per your requirement, and provide a name for each field:

   1. Select the **Plus** icon to add a new row, and then select **OK**.
   2. Choose a name that will match the schema attribute.
   3. Define the required settings for the new fields.
   4. Select **Done**.
   5. Repeat these steps for each new field.
4. Create a new Workday Integration System as follows:

   1. On your Workday Home page, go to **Integration System \> Create Integration System**.
   2. Provide a name for the Integration System.
   3. Select **New Using Template** and provide the value as **Document Transformation**.
   4. Select **OK**.
   5. Go to **Actions \> Integration System \> Configure Integration Attachment Service**.
   6. Select the Attachment column and select **Create Integration Attachment Service**.
   7. Attach an empty text file and select **OK**.
5. In your new Workday Integration System, add the field override service created in the previous steps, as follows:

   1. Go to **Custom Integration Services**.
   2. Select the **Plus** icon. Under **Custom Integration Services**, add the field override service you created.
   3. Select **OK**.
6. Note the System ID for this Workday Integration System. It is required to retrieve the custom or calculated attributes.
7. Search for **View Integration System**.
8. Enter the name of the Workday Integration System you created.
9. Select **OK**.
10. Map the new fields to the correct value:

    1. Go to **Integration System \> Configure Integration Field Overrides**.
    2. Select the calculated or custom field and map the correct value to it in **Override External Field**.
    3. Select **OK**.
    4. Select **Done**.
11. When applicable, grant the required permissions to the service account associated with the source to aggregate the new custom or calculated fields.

> [!NOTE]
>
> - Custom and calculated attributes added to the Workday OrganizationRole Group schema must have `__c` appended to the field names created in Workday. For example, if you added `PREVIOUS_EMPLOYER` to Workday, you would add `PREVIOUS_EMPLOYER__c` in the source schema.
> - Aggregation takes more time for a larger number of configured custom attributes and calculated fields. The value of the calculated fields and custom attributes are calculated at run time, and aggregation is delayed, as it requires extra time to fetch the calculated values.

## Organization Roles

The Workday Accounts aggregates and provisions an organization role with the organization name.

You must add a new schema attribute `ORG_ROLE##ORG_NAME` in the account schema. The `ORG_ROLE##ORG_NAME` is a multi-valued entitlement attribute of type `OrganizationRole`. The `ORG_NAME` value is used as the organization reference ID while assigning a role to a worker.

### Assigning an Organization Other Than the Default Organization

If you want to assign an organization other than the default organization, configure the `Organization_Reference_ID_Item` attribute in the provisioning policy. This is the reference ID of the organization.

For example, if the value of the `ORG_ROLE##ORG_NAME` attribute is `Admin##Test_Organization` and you want to assign the `Admin` role to a different organization than `Test_Organization`, you must use the `Organization_Reference_ID_Item` attribute in the provisioning policy and pass the required organization reference ID.

### Excluding Inherited Roles During Aggregation

The Workday Accounts supports aggregation and provisioning of Organization Roles assigned to the user in Workday. These roles are assigned to the user's parent/direct organization, as well as the underlying inherited organization. By default, the Workday Accounts aggregates both the direct and underlying inherited roles assigned to the users.

If you want to exclude the inherited roles during account aggregation, then on the **Additional Settings** configuration page, select the **Exclude Inherited Organization Roles** checkbox.

## Aggregating Security Groups

The Workday Account source supports the aggregation of the security group as a group object.

The new security group schema containing the `ID` attribute is introduced to aggregate the security group. The object type is `SecurityGroup`.

For the new Workday Accounts sources, the schema will be populated by default with the ID as an attribute. The aggregation will fetch all user-based security groups present on the Workday Accounts managed system.

For the existing Workday Accounts sources, you must add the `USER_BASED_SECURITY_GROUPS` attribute to the schema to fetch the groups through entitlement aggregation.

You must add and mark the `USER_BASED_SECURITY_GROUPS` attribute as a managed, multi-valued attribute, and as an entitlement. Additionally, the group schema must be defined.

## Aggregating and Provisioning User-Based Security Groups

The Workday Accounts source supports the aggregation and provisioning of user-based Security Groups.

`USER_BASED_SECURITY_GROUPS` is the new schema attribute:

- XPath: `ns1:Get_Assign_User-Based_Security_Groups_Response/ns1:Response_Data/ns1:Assign_User-Based_Security_Groups`

For new Workday Accounts sources, by default, the account schema will have the `USER_BASED_SECURITY_GROUPS` attribute. Account aggregation fetches all user-based security groups linked to workers.

For existing Workday Accounts sources, you must add the `USER_BASED_SECURITY_GROUPS` attribute to the schema with values as a managed, multi-valued attribute, and as an entitlement.