Using the Workday Connectors

6.1 Configuring Reconciliation

You can configure the connector to specify the type of reconciliation and its schedule.

6.1.1 Performing Full and Incremental Reconciliation

Full reconciliation involves reconciling all existing workers from the target system into Oracle Identity Governance. During incremental reconciliation, only records that are added or modified after the last reconciliation run are fetched into Oracle Identity Governance.

After you create the application, you must first perform full reconciliation. In addition, you can switch from incremental reconciliation to full reconciliation whenever you want to ensure that all target system records are reconciled in Oracle Identity Governance.

To perform a full reconciliation, remove (delete) any value assigned to Filter Query and Transaction Days, set Sync Token value to


                <String>0</String>

and run one of the following reconciliation jobs:

For a Workday target application: <Application Name> Workday Target User Reconciliation
For a Workday authoritative application: <Application Name> Workday Trusted User Reconciliation

After the full reconciliation job is completed, the connector updates the Sync Token value with the date and time stamp when the reconciliation run started. Perform a reconciliation operation with Transaction Days after you perform a full reconciliation, to reconcile Future hire date and Future termination date attributes. Ideally, reconciliation with Transaction Days is performed only once as part of initial setup. See Performing Reconciliation with Transaction Days for detailed information.

To perform an incremental reconciliation, make sure the Sync Token is updated with the time stamp of the last reconciliation run and remove (delete) any value assigned to Filter Query and Transaction Days.

Note:

Sync Token is only updated when a Full reconciliation or Incremental reconciliation operation is performed. It does not get updated when a Filter reconciliation or Reconciliation with transaction days is performed.

See Reconciliation Jobs for the Workday Target Connector and Reconciliation Jobs for the Workday Authoritative Connector for information about the jobs for full and incremental reconciliation.

6.1.2 Performing Reconciliation with Transaction Days

Whenever a full or limited reconciliation is performed, the Hire date of a contract employee is not reconciled if he/she is hired with a future effective date. Similarly, the Termination Date of a regular employee is not reconciled if he/she is terminated with a future effective date.

To reconcile these values, you must run the reconciliation job by providing a value for the Transaction Days parameter. This is the value of max number of days a regular employee would be active in an organization after he is terminated, or max number of days contractors can be pre-hired in an organization, whichever is larger.

For example, if an organization has a notice period of 45 days, it means that an employee can be active for a maximum duration of 45 days after the termination process is initiated. If contractor hiring process is initiated 30 days before their original hire date, then provide the value for the Transaction Days parameter as 45.

Note:

Whenever an incremental reconciliation is performed, the Future hire date and Future termination date attribute values are also reconciled. Hence, it is recommended to perform reconciliation with transaction days after a full reconciliation or a filter reconciliation only.

6.1.3 Performing Limited Reconciliation

Limited or filtered reconciliation is the process of limiting the number of records being reconciled based on a set filter criteria.

By default, all target system records that are added or modified after the last reconciliation run are reconciled during the current reconciliation run. You can customize this process by specifying the subset of added or modified target system records that must be reconciled. You do this by creating filters for the reconciliation module.

This connector provides a Filter Query parameter (a reconciliation job parameter) that allows you to use various filter conditions to filter the target system records. When you specify a value for the Filter Query parameter, the connector reconciles only the target system records that match the filter criterion into Oracle Identity Governance.

The following are filters that are supported by the Workday connector:

Filter workers using WID.
For example, WID=06f0036f384a016c1da65076fa5f6d0a

Here any user with WID as 06f0036f384a016c1da65076fa5f6d0a is reconciled.
Filter workers using Employee_ID and Contingent_Worker_ID .
To reconcile regular employees, use Employee_ID=21220, where 22120 is the employee ID of an employee. To reconcile contractors, use Contingent_Worker_ID=22406, where 22406 is contingent worker ID of a contractor.
Filter workers using Organization Id.
For example, Organization_Reference_Id=Global_Modern_Services_supervisory

Here Global_Modern_Services_supervisory is the Organization ID and all users belonging to this organization are reconciled.
Filter workers using Country
For example, Country=US

Here US is the ISO Alpha-2 country code of United States. All users in Workday that belong to US are reconciled.
Filter workers using National Id
For example, National_ID_Type_Code=IND-PAN&Identifier_ID=AXXPX1234K

Here IND-PAN is the National ID Type code of the National ID and AXXPX1234K is the Identification value of National ID.

Note:

Workday connector does not support any other filters.

6.2 Configuring Reconciliation Jobs

Configure reconciliation jobs to perform reconciliation runs that check for new information on your target system periodically and replicates the data in Oracle Identity Governance.

You can apply this procedure to configure the reconciliation jobs for users and entitlements.

To configure a reconciliation job:

Log in to Identity System Administration.
In the left pane, under System Management, click Scheduler.
Search for and open the scheduled job as follows:
1. In the Search field, enter the name of the scheduled job as the search criterion. Alternatively, you can click Advanced Search and specify the search criterion.
2. In the search results table on the left pane, click the scheduled job in the Job Name column.
On the Job Details tab, you can modify the parameters of the scheduled task:
- Retries: Enter an integer value in this field. This number represents the number of times the scheduler tries to start the job before assigning the Stopped status to the job.
- Schedule Type: Depending on the frequency at which you want the job to run, select the appropriate schedule type. See Creating Jobs in Oracle Fusion Middleware Administering Oracle Identity Governance.
In addition to modifying the job details, you can enable or disable a job.
On the Job Details tab, in the Parameters region, specify values for the attributes of the scheduled task.

Note:

Values (either default or user-defined) must be assigned to all the attributes. If even a single attribute value is left empty, then reconciliation is not performed.
Click Apply to save the changes.

Note:

You can use the Scheduler Status page in Identity System Administration to either start, stop, or reinitialize the scheduler.

6.3 Performing Provisioning Operations

Learn about performing provisioning operations in Oracle Identity Governance and the guidelines that you must apply while performing these operations.

6.3.1 Creating Users

You create a new user in Identity Self Service by using the Create User page. You provision or request for accounts on the Accounts tab of the User Details page

To perform provisioning operations in Oracle Identity Governance.

Log in to Identity Self Service.
Create a user as follows.
1. In Identity Self Service, click Manage. The Home tab displays the different Manage option. Click Users. The Manage Users page is displayed.
2. From the Actions menu, select Create. Alternatively, you can click Create on the toolbar. The Create User page is displayed with input fields for user profile attributes.
3. Enter details of the user in the Create User page.
On the Account tab, click Request Accounts.
In the Catalog page, search for and add to cart the application instance for the connector that you configured earlier, and then click Checkout.
Specify value for fields in the application form and then click Ready to Submit.
Click Submit.

6.3.2 Modifying Users

You can update an exisiting user in Identity Self Service by using the Modify User page.

To perform provisioning operations in Oracle Identity Governance:

Log in to Identity Self Service.
From the Users tab, right-click the account you wish to update, and then select Modify.
From the Modify Account page, you can specify and update values for the following fields:
- Work Email
- Home Email
- Work Phone Device Type
- Work Phone
- Home Phone Device Type
- Home Phone
You can also update the Secondary Phone Number and Secondary Email information by specifying values for the respective fields in the child form present at the end of the tab.

Note:
All fields in the secondary phone number child form, except Extension are mandatory.
Click Update, and Submit.

Note:

While updating contact data for a worker, ensure the following:

Provide value for Work Phone or Home Phone attributes in the +91-0123456789x123 format. Here, 91 is the country code with + as prefix, 0123456789 is the phone number with - as prefix, and 123 is the extension number with x as prefix.
You cannot add secondary contact details without adding primary contact details. For example, without adding work phone in the parent form, Workday does not allow you to add secondary phone number of Phone type: Work.
When a worker has primary and secondary contact data of the same type, Workday system does not all allow you to delete primary contact data. You must first delete the secondary contact details, then only you can delete the primary contact details.
If contact data of a worker is updated in Workday with a future effective date, then you cannot update the worker contact data until the transaction is occurred or it is revoked in the Workday system.

6.4 Handling Start Date and End Date

You can configure the Workday Trusted connector to handle Start and End date for workers.

6.4.1 Handling Start Date

When a worker is reconciled from the Workday application (in a Workday Trusted connector), and a user is being created, Oracle Identity Manager evaluates the Start Date attribute. If the attribute is set to the current day or an earlier date, the user is created in Oracle Identity Manager. An event handler evaluates the start date, and Oracle Identity Manager sets this account as Active.

While creating a user with a start date set to a future date, Oracle Identity Manager creates the user in a Disabled until start date state. Once the start date is reached, the Enable User After Start Date evaluates the Start Date attribute and enables all users whose start date has passed during the reconciliation run. This sets the user’s state to Active.

6.4.2 Handling End Date

The End Date attribute controls termination and automates the process ensuring that the account closures do not get lost in the shuffle.

The Disable/Delete User After End Date scheduled job evaluates the End Date attribute, and either disables or deletes all users whose end date is before the current date at the time of the reconciliation run. All accounts provisioned to the user will then be placed in either disabled or revoked state, depending on the configuration of the scheduled job.

Note:

The schedulers for Enable User After Start Date and Disable/Delete User After End Date is often set to run once per day at a specified time. The attributes will not get evaluated until the scheduled job runs. It is recommended to set to run the Enable User After Start Date scheduled job before the normal business hours and Disable/Delete User After End Date scheduled job after the normal business hours.

6.5 Uninstalling the Connector

Uninstalling the connector deletes all the account-related data associated with its resource objects.

If you want to uninstall the connector for any reason, then run the Uninstall Connector utility. Before you run this utility, ensure that you set values for ObjectType and ObjectValues properties in the ConnectorUninstall.properties file. For example, if you want to delete resource objects, scheduled tasks, and scheduled jobs associated with the connector, then enter "ResourceObject", "ScheduleTask", "ScheduleJob" as the value of the ObjectType property and a semicolon-separated list of object values corresponding to your connector as the value of the ObjectValues property.

Below are examples to uninstall ResourceObjects and ScheduleJobs respectively:

ObjectType=ResourceObject

ObjectValues=<Application Name>
ObjectType= ScheduleJob

ObjectValues= <Application Name>Workday Target User Reconciliation

Note:

If you set values for the ConnectorName and Release properties along with the ObjectType and ObjectValue properties, then the deletion of objects listed in the ObjectValues property is performed by the utility and the Connector information is skipped.

For more information, see Uninstalling Connectors in Oracle Fusion Middleware Administering Oracle Identity Governance.