Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Expand | ||
---|---|---|
| ||
In order to connect EmpowerID to Workday, the following prerequisites need to be met:
|
Step 1 – Generate a self-signed certificate in EmpowerID
On the navbar of the EmpowerID Web interface, expand Apps and Authentication > SSO Connections and select SSO Components.
Select the Certificates tab and then click the Add button in the grid header.
Image ModifiedSelect Generate Self-Signed Certificate.
Image ModifiedEnter the following information:
Certificate Owner – Leave empty
Prefer Local Machine Store – Leave empty
Subject Name – Enter something suitable to the purpose of the certificate, such as CN=AzureCertificate
Requires Password – Select this option; this adds a private key to the certificate
Certificate Password – Enter a password for the certificate
Click Save to create the certificate.
Image Modified
Step 2 – Download the certificate in Base64 format
From the Certificate Details page, return to the SSO Components page by clicking the Find Certificates breadcrumb.
On the SSO Components page, select the Certificates tab and search for the certificate you just created.
Image ModifiedClick the Name link for the certificate to navigate to the View page for the certificate.
On the View page for the certificate, click Export Certificate.
Image ModifiedSelect the desired location in which to save the certificate and click Save.
Step 3 – Register a service principal application in Azure
Log in to your Azure portal as a user with the necessary permissions to create an application in Azure AD.
In Azure, navigate to your Azure Active Directory.
On the Azure navbar, click App registrations.
On the App registrations page, click New registration.
Image ModifiedName the application, select the scope for the application (single or multitenant) and click Register.
Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used when configuring the SCIM app service.
Image ModifiedNavigate to the Certificates & secrets blade for the application and click Upload certificate.
Image ModifiedSelect the base-64 encoded certificate you downloaded from EmpowerID and click Add.
Image Modified
Note |
---|
The public key certificate that you upload to Azure must have a corresponding private key in the EmpowerID certificate store; otherwise, an error will occur when calling Azure’s API. |
Step 4 – Create an app service to host the Workday SCIM microservice
Log in to your Azure portal as a user with the necessary permissions to create an App Service.
In Azure, navigate to All Services > App Services and create a new App service.
Under Project Details, select a Subscription and then create a Resource Group for the App Service.
Under Instance Details, do the following:
Name – Enter a name.
Publish – Select Code.
Runtime Stack – Select .Net Core 3.1 (LTS).
Operating System – Select Linux.
Region – Select the appropriate region.
Click Review + Create.
Click Create.
After the deployment of the app service completes, click Go to resource.
Change the platform for the app service to 64 Bit by doing the following:
On the app service navbar, under Settings, click Configuration.
On the Configuration blade, select the General settings tab.
Under Platform settings, change the Platform to 64 Bit and click Save.
Click Continue to confirm you want to save the changes.
On the Overview page for the app service, copy and save the URL. You will need this when you configure Azure AD Auth for the app service.
Image Modified
Step 5 – Configure authentication for the app service
Navigate to the Authentication blade for the app service and click Add identity provider.
Image ModifiedSelect Microsoft.
Image ModifiedAdd the following identity provider information:
App registration type – Select Pick an existing app registration in this directory.
Name or app ID – Select the service principal you created to provide Azure AD authentication for the microservice.
Issuer URL – Replace the default value with
https://login.microsoftonline.com/<Your Tenant ID>
Restrict access – Select Require authentication.
Unauthenticated requests – Select HTTP 401 Unauthorized: recommended for APIs.
Token Store – Leave selected.
Click Add.
Image Modified
After adding the Identity provider, click the Edit link for it.
Image ModifiedSet the Issuer URL to
https://login.microsoftonline.com/<Your Tenant ID>
.Under Allowed token audiences enter the URL for the app service.
Image ModifiedClick Save.
Under Settings, select Identity.
Turn on system assigned managed identity and click Save.
Image ModifiedClick Yes to confirm you want to enable system assigned managed identity and register the App Service with Azure Active Directory.
Image ModifiedBack in the Overview page for the App Service, click Get Publish Profile. You will need this file when you publish the Workday microservice to Azure.
Image Modified
Step 4 – Publish the Workday Microservice to Azure
Log in to EmpowerID as a person with the necessary access to initiate the SCIM Microservice Publishing workflow.
On the navbar, expand Azure Manager and click Configuration.
Select the Tenants tab and then click the Publish Azure AD SCIM App Service action link.
- Image Added
For Application Type select Microservices and then click SUBMIT.
- Image Added
For Microservice Application select Workday SCIM Microservice and then click SUBMIT.
Image ModifiedClick Choose File and browse for the browse for the Workday SCIM App Service Publisher Profile Settings file you downloaded from Azure.
Once you have selected the file, click Submit.
Click Yes to confirm that you want to publish the Workday SCIM Microservice.
Click OK to close the publish results message.
Step 5 – Create a key vault with secrets to store Workday credentials
In Azure, create a key vault if you do not already have one or want to create a new one.
Navigate to the Key Vault blade for the appropriate key vault.
On the Secrets page, click Generate/Import.
On the Create a secret blade, do the following to create the secret:
Name – Enter userName.
Value – Enter the username of the user account accessing the user data in your Workday instance.
Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the second secret:
Name – Enter Password.
Value – Enter the password of the user account accessing the user data your Workday instance.
Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the third secret:
Name – Enter tenantUrl.
Value – Enter the tenant URL of your Workday instance.
Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the fourth and final secret:
Name – Enter tenantid.
Value – Enter the tenant of your Workday instance.
Click Create.
Image Modified
You should now have the following secrets in the key vault:
Next, navigate to the Workday SCIM App Service you created earlier.
On the navbar for the App Service, under Settings, click Configuration.
Under Application settings, click New application setting.
In the Add/Edit application setting pane, add the following:
Name – Enter WORKDAY_VAULTED_CREDS.
Value – Enter the name of the vaulted creds you created for your Workday secrets.
Click OK.
Image Modified
Click Save on the Configuration blade.
Click Continue to confirm that you want to save changes.
Step 6 – Create an account store for Workday
Image RemovedOn the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
Select the Actions tab and then click Create Account Store.
On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
Select the Actions tab and then click Create Account Store.
Insert excerpt IL:Common Images IL:Common Images name CreateAccountStoreAction nopanel true Under System Types, search for Workday.
Click the record for Workday to select the type and then click Submit.
Enter the following information in the Azure Microservice Configuration form:
Name – Name of the account store
Microservice URL – The URL to the app service hosting the Workday SCIM microservice
Azure AppID – The ID of the application you registered in Azure AD for EmpowerID
Azure Directory (Tenant) ID – The ID of your Azure tenant
Certificate Thumbprint – Thumbprint of the certificate you uploaded to your Azure tenant
When ready, click Submit to create the account store.
Image Modified
Step 7 – Verify Workday resource system parameters
Return to the Find Account Stores page and search for the Workday account store you just created.
Click the Account Store link.
Image ModifiedSelect the Resource System tab and then expand the Configuration Parameters accordion at the bottom of the page.
Verify the following parameters have the correct value:
AzureAppID
AzureTenantID
certificateThumbprint
GetNewOrUpdatedUsersUrl
MicroserviceUrl
Step 8 – Configure Attribute Flow
On the Account Store Details page for the Workday account store, select the Attribute Flow Rules tab.
Review the attribute flow and revise as needed. EmpowerID translates the attributes in Workday to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in Workday flow to the EmpowerID Person, as well as any other user accounts owned by the Person.
To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.
Step 9 – Create Dynamic Hierarchy policies to generate roles and location (Optional)
If desired, you can use Dynamic Hierarchy policies to generate external roles and locations based on specific user attributes, such as Job Title
and Department
. The external roles and locations can then be used to map corresponding EmpowerID logical locations. Please see Use Dynamic Hierarchy Policies to Create External Roles and Locations for information on setting this up. When completed, return to this article and complete steps 10 and 11.
Step 10 – Configure the Workday account store
On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
Search for the Workday account store and click the Account Store link for it.
Image ModifiedOn the Account Store Details page, click the Edit link to put the account store in edit mode.
Image Modified
Image Modified
This opens the edit page for the account store. This page allows you to specify the account proxy used to connect EmpowerID to your Workday instance as well as how you want EmpowerID to handle the user information it discovers in Workday during inventory. Settings that are relevant to Workday are described in the table below the imageInsert excerpt IL:Account Store Settings (Workday) V21 IL:Account Store Settings (Workday) V21 nopanel true Edit the account store settings as needed and then enable inventory as shown below.
Step 11 – Enable Inventory on the account store
By default, EmpowerID inventories account stores once every 10 minutes. However, Workday updates user data once every 24 hours. As this is the case, EmpowerID recommends that you set the interval level to once every 12 hours or once every 24 hours. If you do not change the default, inventory still occurs, but the data in the account store will not update until Workday updates.
On the Account Store Settings page, select the Inventory tab.
Under Inventory Schedule Interval, do the following:
Optionally, select a Start and End date for inventory to occur
Select Hour Interval
Interval – Enter either 12 or 24.
Inventory Enabled – Toggle to enable EmpowerID to inventory Workday.
Click Save to save your changes to the account store.
Now that inventory is enabled for the account store, the next step is to turn on the Account Inbox permanent workflow. This workflow is responsible for fetching and processing new user accounts.
Step 12 – Enable the Account Inbox Permanent Workflow
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Step 13 - Map Role and Locations
On the navbar, expand Identity Lifecycle and select Role and Location Mapper.
Select the Role Mapper tab.
In the External Source Business Role pane of the Role Mapper tab, do the following:
In the first (upper) field - Search for and select the external directory containing the role you want to map, and
In the second (lower) field - Enter the name of the external role you want to map and press ENTER to load the role.
Select the role from the tree.
Select the Location Mapper tab.
In the External Source Location pane of the Location Mapper tab, do the following:
In the first (upper) field - Search for and select the external directory containing the location you want to map and
In the second (lower) field - Enter the name of the external location you want to map and press ENTER to load the location.
Select the location from the tree.
Image Modified
In the Internal Destination Location pane, enter the name of the EmpowerID location to which you want to map the external directory location and then select the location from the tree.
Image ModifiedClick Save to save the mapping.
Repeat for any other mappings you wish to create.
Info |
---|
If you select an external role or an external location that is a parent role or location, the children of that role or location will be mapped to the selected EmpowerID location. |
Macrosuite divider macro | ||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Use Dynamic Hierarchy Policies to Create External Roles and Locations
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Div | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
IN THIS ARTICLE
|
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|