The SailPoint IdentityNow Workday Source by default will retrieve the standard Workday records and associated metadata for employees and contingent workers. However, if you want to retrieve less or additional information from Workday you need to update the configuration for the Workday Response Groups. My first few attempts at modifying the IdentityNow Workday Source for additional response groups appeared to update the configuration as requested. However, on running an aggregation on the Workday source I’d receive the following error message;
[ ConnectorException ] [ Error details ] java.lang.Boolean cannot be cast to java.lang.String
In this post I show how I successfully updated my IdentityNow Workday Source for additional Response Groups. It will help me for next time, and hopefully someone else.
Prerequisites
- A configured Workday Source in IdentityNow.
- Download/Install the SailPoint IdentityNow PowerShell Module.
- Configure your credentials for the IdentityNow Org you will be performing changes to a Workday source on. Details on configuring credentials can be found in the Readme for the module on GitHub here.
Workday Source Configuration
To get the Workday Source Configuration use the Get-IdentityNowSource cmdlet passing it the ID of your Workday Source.
You can get the Workday Source ID from the IdentityNow Admin Portal URL address bar when you have the Source configuration selected or by running the following PowerShell one-liner (assuming you have only one Workday Source configured);
Import-Module -Name SailPointIdentityNow
$WorkdaySourceID = Get-IdentityNowSource | Where-Object {$_.sourceConnectorName -eq 'Workday'} | Select-Object id
Workday Source Response Groups
The following commands will then get the full configuration of the Workday Source and then display the Workday Response Group configuration.
$WorkdaySource = Get-IdentityNowSource -sourceID $WorkdaySourceID.id
$WorkdaySource.Configure_Response_Group
The following are the default Workday Response Groups for a default IdentityNow Workday Source configuration.
Exclude_Companies : false Exclude_Company_Hierarchies : true Exclude_Contingent_Workers : false Exclude_Cost_Center_Hierarchies : false Exclude_Cost_Centers : false Exclude_Custom_Organizations : false Exclude_Employees : false Exclude_Location_Hierarchies : true Exclude_Matrix_Organizations : true Exclude_Organization_Support_Role_Data : true Exclude_Pay_Groups : true Exclude_Region_Hierarchies : true Exclude_Regions : true Exclude_Supervisory_Organizations : true Exclude_Teams : true Include_Account_Provisioning : false Include_Background_Check_Data : false Include_Benefit_Eligibility : false Include_Benefit_Enrollments : false Include_Career : false Include_Compensation : false Include_Development_Items : false Include_Employee_Contract_Data : false Include_Employee_Review : false Include_Employment_Information : true Include_Feedback_Received : false Include_Goals : false Include_Management_Chain_Data : true Include_Organizations : true Include_Personal_Information : true Include_Qualifications : false Include_Reference : true Include_Related_Persons : false Include_Roles : false Include_Skills : false Include_Succession_Profile : false Include_Talent_Assessment : false Include_User_Account : false Include_Worker_Documents : false
Let’s say we don’t want to exclude Contingent workers from being returned. We can update the Response Group configuration to exclude Contingent Workers by changing the Exclude_Contingent_Workers to be true;
$RGroups = $WordaySource.Configure_Response_Group $RGroups.Exclude_Contingent_Workers = "true"
Update the Workday Source Configuration
Using the IdentityNow PowerShell Module Update-IdentityNowSource cmdlet we can then submit the changes back to the Workday Source configuration. First though we need to manipulate the update into a format that the Workday Source can read and execute on. The following example does that by making the update to connector_Configure_Response_Group and making sure the configuration options are read as ‘strings’ and not ‘boolean’ values.
$update = ("connector_Configure_Response_Group=$RGroups").Replace("@","")
$update = $update.Replace("true","'true'")
$update = $update.Replace("false","'false'")
Update-IdentityNowSource -sourceID $WorkdaySourceID.id -update $update
Summary
The format of the Configure_Response_Group configuration item on the Workday Source is very specific. Using the Get-IdentityNowSource and Update-IdentityNowSource cmdlets makes is easy to manipulate.
While you are at it you many also want to increase the Workday Source Health Check Timeout. In my experience, the default isn’t long enough and even Test Connection fails.
To do that use the Update-IdentityNowSource cmdlet again to add the healthCheckTimeout option. Below shows setting it for 60 seconds;
Update-IdentityNowSource -sourceID 12345 "connector_healthCheckTimeout=60"