Prerequisites for creating a connection to Workday

This page lists all the prerequisite steps for creating a connection between Integration Service and Workday.

Create an Integration System User (ISU)

1. In the Workday portal, log in to your Workday tenant.
2. In the search bar, type Create Integration System User.
3. Select the Create Integration System User task.
4. On the Create Integration System User page, in the Account Information section, enter a user name and set a password. Select OK.
   
   

   

   
   
   Due to XML encoding, the &, <, and > symbols cannot be included in the password.
5. Make sure the Require New Password at Next Sign In field is disabled. You want to add this user to the list of System Users to make sure the password doesn't expire.

Create a security group and assign an Integration System User

Now, add the Integration System User created earlier to a Security Group.

1. In the search bar, type Create Security Group.
2. Select the Create Security Group task.
3. In the Create Security Group page, choose Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group drop-down menu.
4. In the Name field, enter a name, and select OK.
   
   
   
5. In the Edit Integration System Security Group (Unconstrained) window, in the Name field, enter the same name that you used during the ISU creation process.
   
   
   
6. Select OK.

Configure domain security policy permissions

1. In the search bar, type Maintain Permissions for Security Group.
2. Select the Maintain Permissions for Security Group task.
3. Make sure the Operation field is set to Maintain, and confirm that the Source Security Group matches the security group assigned in the previous section.
   
   
   
4. Add the Domain Security Policy corresponding to your needs. Note that Get Only is meant just to read data, whereas Get and Put are meant to read and create or update data. You can consult your implementation partner or administrator to configure these API permissions.
   
   
   
   Permissions might differ from one implementation to another. Work with your Workday administrator or implementation team to configure them.

Activate security policy changes

1. In the search bar, type Activate Pending Security Policy Changes.
2. The Activate Pending Security Policy Changes task displays a summary of the changes in the security policy that need to be approved.
3. Add any relevant comments in the pop-window, in the Comment field.
   
   
   
4. Select OK to confirm the changes and apply them.
   
   
   

Validate that the authentication policy is sufficient

Check the Manage Authentication Policies window to ensure the ISU you created is added to a policy that can access the necessary domains. It should not be restricted to the SAML Allowed Authentication Types. If this is the case, you can create a new Authentication Policy with a User Name Password Allowed Authentication Type.

1. Select the Edit button to edit an authentication policy.
   
   
   
2. Make sure the Environments field is configured correctly. In this example, we use Implemetation and Sales.
3. Next, establish an Authentication Rule Name and include the Security Group within the rule.
   
   
   
4. Make sure the Allowed Authentication Types is set to Specific, with the User Name Password option selected, or to Any.
   
   
   

Activate all pending authentication policy changes

1. In the search bar, type Activate All Pending Authentication Policy Changes.
2. For this task, add a comment, such as "activating", and enable the Confirm field. Proceed to the next screen, confirming the changes. This saves the Authentication Policy that you just created.
   
   
   

Obtain the web services endpoint for the Workday tenant

In order to successfully create a connection, you also require your specific Workday web services endpoint, which you can find out by performing the following steps:

1. In the search bar, type Public Web Services.
2. Open the Public Web Services Report.
3. Hover over any item and select the More options menu.
4. Navigate to Web Services > View WDSL. Scroll to the bottom of the page, where you can find the Host.
5. Search for a link that contains services, for example: https://wd5-services.1.myworkday.com or https://wd2-impl-services.workday.com.
   
   
   

Enter credentials into Integration Service

At this step you have obtained all the credentials required for creating a connection to the Workday connector:

• Hostname: the Web Services Endpoint retrieved in Obtain the web services endpoint for the Workday tenant.
• Username and Password: the Integration System User's username and password set in Create an Integration System User (ISU).
• Tenant: your Workday Tenant name. For example, if you sign in at https://wd5-services1.workday.com/uipath, enter uipath.