Which Workday connector should I use?

ConductorOne offers two Workday connectors: Workday and Workday Accounts (WQL). How you want to work with Workday in ConductorOne will determine which one you should set up.

• Workday connector: This connector is the best choice if you want to use Workday as a directory. You’ll also need it if you want to enable access requests for Workday role and group assignments.

• Workday Account (WQL) connector: This connector utilizes the Workday Query Language (WQL), which allows it to pull a different data set than the Workday connector. Workday Accounts (WQL) is the best choice if you want to review who has what kind of access to Workday in your organization, including account type and service center assignments.

*If the Workday connector is configured using a custom report, it can also pull in information on the account owner’s organization, title, and manager.

Capabilities

Gather Workday credentials

Configuring the connector requires you to pass in credentials generated in Workday. Gather these credentials before you move on.

A user with the permission to create a new API client in Workday must perform this task.

Look up your Workday REST API endpoint

1. In Workday, use the search bar to look up “View API Clients”. Make sure to select this name from the results, not the similarly named “Register API Client”.

2. Carefully copy and save the Workday REST API endpoint.

Create a new Workday API client

1. In Workday, use the search bar to look up “Register API Client for Integrations”. Make sure to select this name from the results, not the similarly named “Register API Client”.

2. In the modal that appears, give the new API client a name, such as “ConductorOne integration”.

3. In the Scopes box, select Custom Objects and search for “System”. Select System and click OK. The System scope is required to access the WQL API.

4. The newly created client’s client ID and client secret are shown. Carefully copy and save these credentials.

   Do not click Done at the bottom of the page yet.

Create a refresh token

1. Next, click the three dots icon next to the client name and navigate to API Client > Manage Refresh Tokens for Integrations.

2. Select the Workday account you want to associate with the token and click OK.

3. On the Delete or Regenerate Refresh Token page, scroll down and check the Generate New Refresh Token box.

4. Click OK.

5. Carefully copy and save the new refresh token.

Create a new security group

1. Still in Workday, use the search bar to look up “Maintain Permissions for Security Group”.

2. In the Maintain Permissions for Security Group modal, make sure the Maintain button is selected.

3. In the Source Security Group field, navigate to By Type > Integration System Security Group.

4. Create a new security group. Give it a name, such as “ConductorOne WQL integration security group”.

5. On the new group’s Domain Security Policy Permissions tab, leave the Select All box checked.

6. Click the + icon to create five new rows, and fill them out as follows:

1. Click OK.

   Security group permissions will not take effect until they are activated in the following steps.

Activate pending security policy changes

1. Next, activate the security policy changes. Search for “Activate Pending Security Policy Changes”.

2. Add a comment about the change you’re making and click OK.

3. Review the changes. If everything looks good, click the Confirm checkbox, then click OK.

Assign the security group to the Workday account

1. Still in Workday, use the search bar to look up “View Workday Account” and select the Workday account you used when generating the refresh token.

2. Click the three dots icon next to the account name and navigate to Security Profile > Assign Integration System Security Groups.

3. Select the security group you created and click OK.

That’s it! Next, move on to the connector configuration instructions.

Configure the Workday Accounts connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Workday Accounts credentials generated by following the instructions above

# baton-workday-wql-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-workday-wql-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Workday credentials
  BATON_WORKDAY_REST_API_ENDPOINT: <Workday REST API endpoint>
  BATON_WORKDAY_CLIENT_ID: <Workday API client ID>
  BATON_WORKDAY_CLIENT_SECRET: <Workday API client secret>
  BATON_WORKDAY_REFRESH_TOKEN: <Workday API client refresh token>

  # Optional: include if you want to sync service centers
  BATON_SYNC_SERVICE_CENTERS: true

  # Optional: include if you want to limit the synced security groups to the types listed here
  BATON_SECURITY_GROUP_TYPE_FILTER: <List of security group types to sync>

# baton-workday-wql.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-workday-wql
  labels:
    app: baton-workday-wql
spec:
  selector:
    matchLabels:
      app: baton-workday-wql
  template:
    metadata:
      labels:
        app: baton-workday-wql
        baton: true
        baton-app: workday-wql
    spec:
      containers:
      - name: baton-workday-wql
        image: ghcr.io/conductorone/baton-workday-wql:latest
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-workday-wql-secrets