6 Using the Workday Connectors
You can use the Workday Connectors for performing reconciliation and provisioning operations after configuring your application to meet your requirements.
This chapter contains the following sections:
Note:
Perform sections Configuring Reconciliation Jobs and Performing Provisioning Operations if you are using the Workday Target application only.6.1 Configuring Reconciliation
You can configure the connector to specify the type of reconciliation and its schedule.
6.1.1 Performing Full and Incremental Reconciliation
Full reconciliation involves reconciling all existing workers from the target system into Oracle Identity Governance. During incremental reconciliation, only records that are added or modified after the last reconciliation run are fetched into Oracle Identity Governance.
After you create the application, you must first perform full reconciliation. In addition, you can switch from incremental reconciliation to full reconciliation whenever you want to ensure that all target system records are reconciled in Oracle Identity Governance.
<String>0</String>
and run one of the following reconciliation
jobs:
- For a Workday target application:
<Application Name>
Workday Target User Reconciliation - For a Workday authoritative application:
<Application Name>
Workday Trusted User Reconciliation
After the full reconciliation job is completed, the connector updates the Sync Token value with the date and time stamp when the reconciliation run started. Perform a reconciliation operation with Transaction Days after you perform a full reconciliation, to reconcile Future hire date and Future termination date attributes. Ideally, reconciliation with Transaction Days is performed only once as part of initial setup. See Performing Reconciliation with Transaction Days for detailed information.
To perform an incremental reconciliation, make sure the Sync Token is updated with the time stamp of the last reconciliation run and remove (delete) any value assigned to Filter Query and Transaction Days.
Note:
Sync Token is only updated when a Full reconciliation or Incremental reconciliation operation is performed. It does not get updated when a Filter reconciliation or Reconciliation with transaction days is performed.See Reconciliation Jobs for the Workday Target Connector and Reconciliation Jobs for the Workday Authoritative Connector for information about the jobs for full and incremental reconciliation.
6.1.2 Performing Reconciliation with Transaction Days
Whenever a full or limited reconciliation is performed, the Hire date of a contract employee is not reconciled if he/she is hired with a future effective date. Similarly, the Termination Date of a regular employee is not reconciled if he/she is terminated with a future effective date.
To reconcile these values, you must run the reconciliation job by providing a value for the Transaction Days parameter. This is the value of max number of days a regular employee would be active in an organization after he is terminated, or max number of days contractors can be pre-hired in an organization, whichever is larger.
For example, if an organization has a notice period of 45 days, it means that an
employee can be active for a maximum duration of 45 days after the termination process
is initiated. If contractor hiring process is initiated 30 days before their original
hire date, then provide the value for the Transaction Days parameter as
45
.
Note:
Whenever an incremental reconciliation is performed, the Future hire date and Future termination date attribute values are also reconciled. Hence, it is recommended to perform reconciliation with transaction days after a full reconciliation or a filter reconciliation only.6.1.3 Performing Limited Reconciliation
Limited or filtered reconciliation is the process of limiting the number of records being reconciled based on a set filter criteria.
By default, all target system records that are added or modified after the last reconciliation run are reconciled during the current reconciliation run. You can customize this process by specifying the subset of added or modified target system records that must be reconciled. You do this by creating filters for the reconciliation module.
This connector provides a Filter Query parameter (a reconciliation job parameter) that allows you to use various filter conditions to filter the target system records. When you specify a value for the Filter Query parameter, the connector reconciles only the target system records that match the filter criterion into Oracle Identity Governance.
The following are filters that are supported by the Workday connector:
- Filter workers using WID.
For example,
WID=06f0036f384a016c1da65076fa5f6d0a
Here any user with WID as
06f0036f384a016c1da65076fa5f6d0a
is reconciled. - Filter workers using Employee_ID and Contingent_Worker_ID .
To reconcile regular employees, use
Employee_ID=21220
, where 22120 is the employee ID of an employee. To reconcile contractors, useContingent_Worker_ID=22406
, where 22406 is contingent worker ID of a contractor. - Filter workers using Organization Id.
For example,
Organization_Reference_Id=Global_Modern_Services_supervisory
Here
Global_Modern_Services_supervisory
is the Organization ID and all users belonging to this organization are reconciled. - Filter workers using Country
For example,
Country=US
Here US is the ISO Alpha-2 country code of United States. All users in Workday that belong to US are reconciled.
- Filter workers using National Id
For example,
National_ID_Type_Code=IND-PAN&Identifier_ID=AXXPX1234K
Here IND-PAN is the National ID Type code of the National ID and AXXPX1234K is the Identification value of National ID.
Note:
Workday connector does not support any other filters.6.2 Configuring Reconciliation Jobs
Configure reconciliation jobs to perform reconciliation runs that check for new information on your target system periodically and replicates the data in Oracle Identity Governance.
You can apply this procedure to configure the reconciliation jobs for users and entitlements.
6.3 Performing Provisioning Operations
Learn about performing provisioning operations in Oracle Identity Governance and the guidelines that you must apply while performing these operations.
6.3.1 Creating Users
You create a new user in Identity Self Service by using the Create User page. You provision or request for accounts on the Accounts tab of the User Details page
6.3.2 Modifying Users
You can update an exisiting user in Identity Self Service by using the Modify User page.
Note:
While updating contact data for a worker, ensure the following:- Provide value for Work Phone or Home Phone attributes in the
+91-0123456789x123
format. Here,91
is the country code with+
as prefix,0123456789
is the phone number with-
as prefix, and123
is the extension number withx
as prefix. - You cannot add secondary contact details without adding primary contact details. For example, without adding work phone in the parent form, Workday does not allow you to add secondary phone number of Phone type: Work.
- When a worker has primary and secondary contact data of the same type, Workday system does not all allow you to delete primary contact data. You must first delete the secondary contact details, then only you can delete the primary contact details.
- If contact data of a worker is updated in Workday with a future effective date, then you cannot update the worker contact data until the transaction is occurred or it is revoked in the Workday system.
6.4 Handling Start Date and End Date
You can configure the Workday Trusted connector to handle Start and End date for workers.
6.4.1 Handling Start Date
When a worker is reconciled from the Workday application (in a Workday Trusted connector), and a user is being created, Oracle Identity Manager evaluates the Start Date attribute. If the attribute is set to the current day or an earlier date, the user is created in Oracle Identity Manager. An event handler evaluates the start date, and Oracle Identity Manager sets this account as Active.
While creating a user with a start date set to a future date, Oracle Identity Manager creates the user in a Disabled until start date state. Once the start date is reached, the Enable User After Start Date evaluates the Start Date attribute and enables all users whose start date has passed during the reconciliation run. This sets the user’s state to Active.
6.4.2 Handling End Date
The End Date attribute controls termination and automates the process ensuring that the account closures do not get lost in the shuffle.
Note:
The schedulers for Enable User After Start Date and Disable/Delete User After End Date is often set to run once per day at a specified time. The attributes will not get evaluated until the scheduled job runs. It is recommended to set to run the Enable User After Start Date scheduled job before the normal business hours and Disable/Delete User After End Date scheduled job after the normal business hours.6.5 Uninstalling the Connector
Uninstalling the connector deletes all the account-related data associated with its resource objects.
If you want to uninstall the connector for any reason, then run the Uninstall
Connector utility. Before you run this utility, ensure that you set values for
ObjectType
and ObjectValues
properties in the
ConnectorUninstall.properties file. For example, if you want to delete resource
objects, scheduled tasks, and scheduled jobs associated with the connector, then
enter "ResourceObject", "ScheduleTask", "ScheduleJob" as the
value of the ObjectType
property and a semicolon-separated list of
object values corresponding to your connector as the value of the
ObjectValues
property.
Below are examples to uninstall ResourceObjects and ScheduleJobs respectively:
-
ObjectType=ResourceObject
ObjectValues=<Application Name>
-
ObjectType= ScheduleJob
ObjectValues= <Application Name>Workday Target User Reconciliation
Note:
If you set values for theConnectorName
and Release
properties along
with the ObjectType
and ObjectValue
properties,
then the deletion of objects listed in the ObjectValues
property is
performed by the utility and the Connector information is skipped.
For more information, see Uninstalling Connectors in Oracle Fusion Middleware Administering Oracle Identity Governance.