Configuring a SailPoint IdentityNow Workday Source for additional Response Groups

The SailPoint IdentityNow Workday Source by default will retrieve the standard Workday records and associated metadata for employees and contingent workers. However, if you want to retrieve less or additional information from Workday you need to update the configuration for the Workday Response Groups. My first few attempts at modifying the IdentityNow Workday Source for additional response groups appeared to update the configuration as requested. However, on running an aggregation on the Workday source I’d receive the following error message;

[ ConnectorException ] [ Error details ] java.lang.Boolean cannot be cast to java.lang.String

In this post I show how I successfully updated my IdentityNow Workday Source for additional Response Groups. It will help me for next time, and hopefully someone else. 

Prerequisites

  • A configured Workday Source in IdentityNow.
  • Download/Install the SailPoint IdentityNow PowerShell Module.
    • Configure your credentials for the IdentityNow Org you will be performing changes to a Workday source on. Details on configuring credentials can be found in the Readme for the module on GitHub here.

Workday Source Configuration

To get the Workday Source Configuration use the Get-IdentityNowSource cmdlet passing it the ID of your Workday Source.

You can get the Workday Source ID from the IdentityNow Admin Portal URL address bar when you have the Source configuration selected or by running the following PowerShell one-liner (assuming you have only one Workday Source configured);

Import-Module -Name SailPointIdentityNow
$WorkdaySourceID = Get-IdentityNowSource | Where-Object {$_.sourceConnectorName -eq 'Workday'} | Select-Object id

 Workday Source Response Groups

The following commands will then get the full configuration of the Workday Source and then display the Workday Response Group configuration.

$WorkdaySource = Get-IdentityNowSource -sourceID $WorkdaySourceID.id 
$WorkdaySource.Configure_Response_Group

The following are the default Workday Response Groups for a default IdentityNow Workday Source configuration.

Exclude_Companies : false
Exclude_Company_Hierarchies : true
Exclude_Contingent_Workers : false
Exclude_Cost_Center_Hierarchies : false
Exclude_Cost_Centers : false
Exclude_Custom_Organizations : false
Exclude_Employees : false
Exclude_Location_Hierarchies : true
Exclude_Matrix_Organizations : true
Exclude_Organization_Support_Role_Data : true
Exclude_Pay_Groups : true
Exclude_Region_Hierarchies : true
Exclude_Regions : true
Exclude_Supervisory_Organizations : true
Exclude_Teams : true
Include_Account_Provisioning : false
Include_Background_Check_Data : false
Include_Benefit_Eligibility : false
Include_Benefit_Enrollments : false
Include_Career : false
Include_Compensation : false
Include_Development_Items : false
Include_Employee_Contract_Data : false
Include_Employee_Review : false
Include_Employment_Information : true
Include_Feedback_Received : false
Include_Goals : false
Include_Management_Chain_Data : true
Include_Organizations : true
Include_Personal_Information : true
Include_Qualifications : false
Include_Reference : true
Include_Related_Persons : false
Include_Roles : false
Include_Skills : false
Include_Succession_Profile : false
Include_Talent_Assessment : false
Include_User_Account : false
Include_Worker_Documents : false

Let’s say we don’t want to exclude Contingent workers from being returned. We can update the Response Group configuration to exclude Contingent Workers by changing the Exclude_Contingent_Workers to be true;

$RGroups = $WordaySource.Configure_Response_Group
$RGroups.Exclude_Contingent_Workers = "true"

Update the Workday Source Configuration

Using the IdentityNow PowerShell Module Update-IdentityNowSource cmdlet we can then submit the changes back to the Workday Source configuration. First though we need to manipulate the update into a format that the Workday Source can read and execute on. The following example does that by making the update to connector_Configure_Response_Group and making sure the configuration options are read as ‘strings’ and not ‘boolean’ values.

$update = ("connector_Configure_Response_Group=$RGroups").Replace("@","")
$update = $update.Replace("true","'true'")
$update = $update.Replace("false","'false'")
Update-IdentityNowSource -sourceID $WorkdaySourceID.id -update $update 

Summary

The format of the Configure_Response_Group configuration item on the Workday Source is very specific. Using the Get-IdentityNowSource and Update-IdentityNowSource cmdlets makes is easy to manipulate. 

While you are at it you many also want to increase the Workday Source Health Check Timeout. In my experience, the default isn’t long enough and even Test Connection fails. 

To do that use the Update-IdentityNowSource cmdlet again to add the healthCheckTimeout option. Below shows setting it for 60 seconds;

Update-IdentityNowSource -sourceID 12345 "connector_healthCheckTimeout=60"