RSA Identity Governance and Lifecycle Collector Data Sheet for Workday

Transcription

1 RSA Identity Governance and Lifecycle Collector Data Sheet for Workday Version 1.3 January 2018

2 RSA Identity Governance and Lifecycle Collector Datasheet for Workday Contents Purpose... 4 Supported Software... 4 Prerequisites... 5 Identity Data Collector... 7 Configuration... 7 Collector Description... 7 Configuration Information... 8 Configure Extensible Attributes... 9 Map Collector Attributes to User Attributes Account Data Collector Configuration Collector Description Configuration Information Map Collector Attributes to Account Attributes Map Collector Attributes to Account Mapping Attributes Edit User Resolution Rules Edit Member Account Resolution Rules Entitlement Data Collector Configuration Collector Description Configuration Information Map Collector Attributes to App Role Attributes Account Evaluation Appendix Adding Custom Attributes Troubleshooting

3 Revision History Revision Number Version 1.0 Version 1.1 Version 1.2 Version 1.3 Description Workday Collector Added support for the Extensible Attributes configuration Added Workday Extensible attribute(s) related troubleshooting steps Updated document with minimum version support. 3

4 Purpose This data sheet provides the configuration information required to create a new Workday Account, Entitlement, and Identity Data Collector. Supported Software RSA Identity Management and Governance and later RSA Identity Governance and Lifecycle and later Collector Type(s): Identity Data Collector, Account Data Collector, Entitlement Data Collector Endpoint Application: Workday HR Supported API Versions: v20 to v29.1 4

5 Prerequisites Steps to generate the WSDL: 1. Login into a Workday instance with an Account assigned the Integration Administrator permissions. 2. Click the Workbench menu (See Diagram 1, Step 1) 3. Click the Integration icon (See Diagram 1, Step 2) 4. Click Public Web Service and Related Operations (See Diagram 1, Step 3). The Public Web Service and Related Operations page will open. 5. Go to the Human Resources (Public) web service (See Diagram 2). 5

6 6. Right click on the Action icon before the Human Resources (Public) web service link. Click 'Web Service' > 'View WSDL'. (See Diagram 3). A new browser tab/window will open which will display Human Resources' WSDL. 6

7 Identity Data Collector Configuration The configuration of the Identity data Collector is completed through a number of screens. This section helps you to fill in the values for each screen. Collector Description The following table lists the parameters on the Collector Description screen. Field Name Value Collector Name Workday IDC Description Workday Identity Data Collector Data Source Type Workday Agent Agent Business Source Any Created Directory. For Example: Test Workday Directory. Status Active Copy from Select an existing Workday IDC from which to copy configuration details. Scheduled Whether the collection is scheduled. The default is No. 7

8 Configuration Information The following table lists the parameters on the Configuration Information screen. Field Name Value Workday Endpoint <Workday Endpoint URL> Version <Version default: v20> Username <Username> Password <Password> How to retrieve the URL: The user needs to retrieve the correct URL (host) to use the service and enter it in the textbox provided on the Collector Configuration (Settings) Page. Steps: How to get end point URL from WSDL file: Open the WSDL file and search for the element named soapbind:address. The value of attribute "location" is the end point URL. <soapbind:address location=" /service/developer/human_resources/v20"/> For Example, is the end Point in above case. How to retrieve the WSDL: See the Prerequisites Section for more details. Note: The user needs to retrieve correct URL (host) to use the service and enter it in the textbox provided on Collector Configuration (Settings) Page. 8

9 Configure Extensible Attributes Extensible Attributes Extensible attributes are attributes that can be configured and collected separately from supported Workday Identity Data collector attributes. Administrators can use this configuration to collect additional Workday attributes. The administrator can customize the existing collector as needed. To configure extensible attribute(s) refer the below section. Extensible Attribute Configuration You can configure the Extensible attributes if they are not present in the below-mentioned set of already are not included in the following list of supported Workday Identity data collector attributes: WorkerDescriptor FirstName LastName Work JobTitle EmploymentStatus EmployeeID WorkerType PositionID IsTerminated JobCode DateOfHire BusinessUnit ManagerID LastDayOfEmployment Location ManagerName NT_ID Leave_Status Department_Number Only single valued XML element/attribute can be configured as extensible attributes. XML element\attribute must have a value present to evaluate XPath. It should not be empty\null. You must know the XPath of the attribute to configure an extensible attribute. Example: Consider a sample response of Workday GetWorker SOAP API shown below, in which we want to collect employeename. <root xmlns:test=" xmlns:sample=" <employees> <employeename>john Smith</employeeName> <employeename>amy McDonald</employeeName> </employees> </root> 9

10 The extensible attribute configuration is as follows: Attribute Name: employeename XPath: /root/employees/employeename/text () Field name Value Has Extensible Attribute? Select to configure extensible attribute(s) for collection Attribute Name XPath Value Name of extensible attribute Example : Middle_Name XPath value to evaluate the extensible attribute Example: /Envelope/Body/Get_Workers_Response/Response_Data/Worker/Worker_ Data/Personal_Data/Name_Data/Preferred_Name_Data/Name_Detail_Dat a/middle_name/text() Notes: 1. If Has extensible attribute is selected, the administrator must configure at least one extensible attribute 2. Extensible attribute name should be unique. 3. If XPath configured is incorrect, data for the configured attribute won t be collected. Refer to server.logs for more details in this case. Click Add more button to add more extensible attributes. Click Evaluate XPath(s) to evaluate configured XPath(s). On the user mapping screen (next screen), map the extensible attribute name against any of the available user attributes displayed on the screen. 10

11 Editing Extensible Attribute Administrators can edit already configured/mapped attributes using the extensible attribute UI. If an administrator edits an extensible attribute name, mapping for the attribute is also updated on the mapping page. Example: Consider that extensible attribute Middle_Name is configured with appropriate XPath value. This Middle_Name extensible attribute is mapped with custom user attribute named MiddleName on map collector attribute to user attributes screen. If the administrator edits the extensible attribute name to Middle_Name_New then the mapping of MiddleName is also changed to Middle_Name_New. Deleting Extensible Attributes If an extensible attribute is removed, mapping for that extensible attribute against the user attribute is also removed. Example: Consider the above example again. If Middle_Name extensible attribute is removed then the mapping of MiddleName will also be removed from map collector attribute to user attributes screen. 11

12 Evaluate XPath(s) Evaluate XPath option is added to help user for validate and evaluate the configured XPath. Click Evaluate XPath to open the XPath validation summary with collected data for the configured XPath(s). If a configured XPath is invalid, no data will be collected and its status will be shown as Invalid XPath. Click Show Response on the XPath validation summary to see the actual response of the Workday API. You can then find and correct the XPath of the extensible attribute. Example: Four extensible attributes are configured. Two attributes (Organization_Name & Middle_Name) have valid XPaths and the other two attributes (Position_Title & City_of_Birth) have invalid XPaths. The XPath validation summary will show the following result: Position_Title & City_of_Birth reports their status as Invalid XPath and collects no data. Organization_Name & Middle_Name reports their status as Valid XPath and collects data as configured. Map Collector Attributes to User Attributes The following table lists attribute to be collected. Attribute Name Workday Attribute Name First Name FirstName 12

13 Last Name LastName User ID EmployeeID Address Work Job Status EmploymentStatus Worker Descriptor WorkerDescriptor Is Terminated isterminated Title JobTitle Department Department_Number Custom Attribute Name Workday Attribute Name WorkerType WorkerType Position ID PositionID Job Code JobCode Date Of Hire DateOfHire Business Unit BusinessUnit Manager ID ManagerID Last Day Of Employment LastDayOfEmployment 13

14 Location Location NT ID NT_ID Leave Status Leave_Status Custom user attribute Example: Middle Name Any extensible attribute name (if configured) Example: Middle_Name Note: Administrators must create custom attributes as required. See the Appendix section for more details. 14

15 Account Data Collector Configuration The configuration of the account data collector is completed through a number of screens. This section helps to fill in the values for each screen. Collector Description The following table lists the parameters that are configurable on the Collector Description screen during collector creation. Field Name Value Collector Name Workday ADC Description Workday Account Data Collector Data Source Type Workday Agent Agent Business Source Any Created Directory, such as, Test Workday Directory. Status Active Copy from Select any existing Workday ADC from which to copy configuration details. Scheduled Whether the collection is scheduled. The default is No. 15

16 Configuration Information The following table lists the parameters that are configurable on the Collector Description screen during collector creation. Field Name Value Workday Endpoint <Workday Endpoint URL> Version <Version default: v20> Username Password <Username> <Password> How to retrieve the URL Users must retrieve correct URL (host) to use the service and must provide the value in the textbox shown on collector s configuration (Settings) page. Steps How to get end-point URL from WSDL file: Open the WSDL file and search for the element named "soapbind:address". Value of the attribute "location" is end-point URL. <soapbind:address location=" For Example, is the end-point in above case. How to retrieve the WSDL: Refer to the Prerequisites section for more details. 16

17 Map Collector Attributes to Account Attributes The following table lists the attributes to be collected. RSA Identity Governance and Lifecycle Collector Datasheet for Workday Custom Attribute Name Workday Attribute Name ID ID Worker ID WorkerID Position Title PositionTitle User Name UserName Worker Type WorkerType Country ISO Code CountryISOCode Note: Administrators must create custom attributes. Refer Appendix section for more details. Map Collector Attributes to Account Mapping Attributes The following table lists the parameters that can be configured on the Map Collector Attributes to Account Mapping Attributes screen during collector creation. Field Name Value User Reference WorkerID Edit User Resolution Rules The following table lists the parameters that can be configured on the Edit User Resolution Rules screen during collector creation. Field Name Value Target Collector Select a previously created Workday IDC. By default this is Users. 17

18 User Attribute Default value: User Id Edit Member Account Resolution Rules The following table lists the configurable parameters on the Edit Member Account Resolution Rules screen during collector creation. Field Name Value Target Collector Associate a previously created Workday Account Data Collector. Account Attribute Account Name 18

19 Entitlement Data Collector RSA Identity Governance and Lifecycle Collector Datasheet for Workday Configuration The configuration of the entitlement data collector is completed through a number of screens. This section helps to fill in the values for each screen. Collector Description The following table lists the configurable parameters on the Collector Description screen during account creation. Field Name Value Collector Name Workday EDC Description Workday Entitlement Data Collector Data Source Type Workday Agent Agent Business Source Any Created Directory, such as Test Workday Directory. Status Active Copy from Select any existing Workday EDC from which to copy configuration details Scheduled Whether the collection is scheduled. The default is No. 19

20 Configuration Information RSA Identity Governance and Lifecycle Collector Datasheet for Workday The following table lists the configurable parameters on the Configuration Information screen during collector creation. Field Name Value Workday Endpoint <Workday Endpoint URL > Version <Version default: v20> Username <Username> Password <Password> How to retrieve the URL Users must retrieve the correct URL (host) to use the service and enter the value in the textbox shown on collector s configuration (Settings) page. Steps How to get the end-point URL from the WSDL file: Open the WSDL file and search for the element named "soapbind:address". The value of the attribute "location" is end-point URL. <soapbind:address location=" For Example, is the end-point in above case. How to retrieve the WSDL: Refer to the Prerequisites section for more details. 20

21 Map Collector Attributes to App Role Attributes The following table lists the attributes to be collected for Roles. RSA Identity Governance and Lifecycle Collector Datasheet for Workday Custom Attribute Name Workday Attribute Name Job Profile Name JobProfileName Job Summary JobSummary Job ID JobID Job Code JobCode Note: Administrators must create the custom attributes. Refer to the Appendix section for more details. Account Evaluation The following table lists the configurable parameters on the Account Evaluation screen during collector creation. Field Name Value Associated Account Collector Associate a previously created Workday Account Data Collector Account Value Evaluates to Account Name 21

22 Appendix Adding Custom Attributes If the required attributes do not exist in RSA Identity Governance and Lifecycle, you can add custom attributes. 1. Log on to RSA Identity Governance and Lifecycle. 2. Click Admin > Attributes and create following attributes: User In the User tab, add the following attributes: Attribute Name Data Type Database ID Data Source In Detail In Popup Mandatory Worker Descriptor Collected No No No WorkerType Position ID Job Code Collected No No No Date Of Hire Manager ID Business Unit Last Day Of Employment Location NT ID Leave Status 22

23 Account In the account tab, add the following attributes: RSA Identity Governance and Lifecycle Collector Datasheet for Workday Attribute Name Data Type Database ID Data Source In Detail In Popup Mandatory ID Collected No No No Worker ID Position Title Collected No No No User Name Worker Type Country ISO Code Application Role In the Application Role tab, add the following attributes: Attribute Name Data Type Database ID Data Source In Detail In Popup Mandatory Job Code Collected No No No Job ID Job Summary Collected No No No Job Profile Name 23

24 Troubleshooting 1. Corrective action required on exception Failed to add WS-Security header to request While using Workday on WebSphere Server using WS-Security, the following exception may occur during Test Connection or the actual collection: com..common.datareadexception: Data reading failed due to : javax.xml.ws.soap.soapfaultexception: Failed to add WS-Security header to request Cause: Starting from WebSphere Application Server Version 8, the SOAPMessage.getSOAPHeader and getsoapbody methods throw SOAPException if there is no corresponding element in the message. Resolution: Set the value for the system property com.ibm.websphere.webservices.soap.enable.legacy.get.behavior to true Steps to set this property from WebSphere web Console: 1. Open the WebSphere web console. 2. Go to Servers Server Types WebSphere application servers <server_name> 3. Under Server Infrastructure, go to Java and process management Process Definition Java virtual machine Custom properties. 4. Click New to add new custom property 5. Enter property name as com.ibm.websphere.webservices.soap.enable.legacy.get.behavior and property value as true. 6. Click OK and save. 7. Restart the WebSphere Application Server. Note: Repeat steps 3 to 7 to set a system property for each WebSphere node in case of cluster setup. 2. In aveksaserver.log, if error Error occurred while evaluating the XPath Response occurred then, verify the XPath value configured for extensible attribute mentioned in logs. Not able to evaluate the provided XPath value. Please confirm that the configured XPath is valid. Attribute Name: employeename XPath : /root/employees/employeename/text() 3. While evaluating XPath during the extensible attributes configuration, Error while evaluating configured XPaths :Exception occurred while evaluating the XPath is shown on UI with following logs in aveksaserver.log ERROR ([ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.default (self-tuning)') [com.aveksa.gui.pages.admin.collector.identity.edit.newedit.workday.extensibleattributehandle r] Exception occurred while evaluating the XPath 24

25 org.json.jsonexception: A JSONObject text must begin with '{' at 1 [character 2 line 1] at org.json.jsontokener.syntaxerror(jsontokener.java:433) at org.json.jsonobject.<init>(jsonobject.java:188) at org.json.jsonobject.<init>(jsonobject.java:314) at com.aveksa.gui.pages.admin.collector.identity.edit.newedit.workday.extensibleattributehandler.evaluatexpath(extensibleattributehandler.java:122) at com.aveksa.gui.pages.admin.collector.identity.edit.newedit.workday.extensibleattributehandler.handleevaluatexpath(extensibleattributehandler.java:92) at com.aveksa.gui.pages.admin.collector.identity.edit.newedit.workday.extensibleattributehandler.handle(extensibleattributehandler.java:72) at com.aveksa.gui.pages.base.data.pagedata.handlerequest(pagedata.java:112) at com.aveksa.gui.pages.base.data.wizard.wizarddialogdata.handlerequest(wizarddialogdata.java:70 ) at com.aveksa.gui.pages.base.data.wizard.stepwizarddialogdata.handlerequest(stepwizarddialogdata.java:168) at com.aveksa.gui.pages.admin.application.add.baseappwizard.handlerequest(baseappwizard.java:178 ) at com.aveksa.gui.pages.pagemanager.forwardrequest(pagemanager.java:597) Resolution: 1. For Weblogic application server: 1. Update weblogic.xml as below a. unzip -q -X {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear -d /tmp/aveksa.ear b. Locate /tmp/aveksa.ear/aveksa.war/web-inf/weblogic.xml c. Replace <prefer-web-inf-classes>true</prefer-web-inf-classes> with <prefer-application-resources> <resource-name>meta-inf/services/javax.xml.ws.spi.provider</resource-name> </prefer-application-resources> 2. Rename existing {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear to {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear.old a. mv {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear.old 3. Repackage /tmp/aveksa.ear to move to {AVEKSA_HOME}/ACM-WebLogic/ a. cd /tmp/aveksa.ear b. zip -q -r -u {AVEKSA_HOME}/ACM-WebLogic/aveksa.ear * 4. Deploy updated aveksa.ear to Weblogic application server a. Login to weblogic console e.g. b. Go to Deployments -> Server c. Select aveksa.ear and click on Update button d. Select path /home/oracle/acm-weblogic and select aveksa.ear e. Click Next and then Finish it 25

26 2. For Websphere application server: Refer the steps mentioned for 1st case in troubleshooting section i.e., Corrective action required on exception Failed to add WS-Security header to request 26

27 COPYRIGHTS Copyright 2017 Dell Inc. All Rights Reserved. TRADEMARKS Dell, RSA, the RSA Logo, EMC and other trademarks, are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners. For a list of RSA trademarks, go to 27