Nailing the Security Audit with RRCU

ConductorOne docs

Set up a Workday connector

ConductorOne provides identity governance and just-in-time provisioning for Workday. Integrate your Workday instance with ConductorOne to run user access reviews (UARs) and enable just-in-time access requests.

Capabilities

  • Sync user identities from Workday to ConductorOne

  • Resources supported:

    • Workers

Add a new Workday connector

This task requires either the Connector Administrator or Super Administrator role in ConductorOne.

  1. In ConductorOne, click Connectors > Add connector.

  2. Search for Workday and click Add.

    Don’t see the Workday connector? Reach out to support@conductorone.com to add Workday to your Connectors page.

  1. Choose how to set up the new Workday connector:

    • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

    • Add the connector to a managed app (select from the list of existing managed apps)

    • Create a new managed app

    Do you SSO into Workday using your identity, SSO, or federation provider? If so, make sure to add the connector to the unmanaged Workday app that was created automatically when you integrated your provider with ConductorOne, rather than creating a new managed app.

  1. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

    A Workday connector owner must have the following permissions:

    • Connector Administrator or Super Administrator role in ConductorOne
    • Permission to create a new API client in Workday
  1. Click Next.

Next steps

  • If you are the connector owner, proceed to Configure your Workday connector for instructions on integrating Workday with ConductorOne.

  • If someone else is the connector owner, ConductorOne will notify them by email that their help is needed to complete the setup process.

Configure your Workday connector

A user with the Connector Administrator or Super Administrator role in ConductorOne and the permission to create a new API client in Workday must perform this task.

Step 1: Create new Workday credentials

  1. In Workday, use the search bar to look up “Register API Client for Integrations”. Make sure to select this name from the results, not the similarly named “Register API Client”.

  2. In the modal that appears, give the new API client a name, such as “ConductorOne integration”.

  3. In the Scopes box, select Custom Objects and search for “Staffing”. Select Staffing and click OK.

  4. The newly created client’s client ID and client secret are shown. Carefully copy and save these credentials. We’ll use them in Step 3.

    Do not click Done at the bottom of the page yet.

  5. Next, we’ll create a refresh token. Click the three dots icon next to the client name and navigate to API Client > Manage Refresh Tokens for Integrations.

  6. Select the Workday account you want to associate with the token and click OK.

  7. On the Delete or Regenerate Refresh Token page, scroll down and check the Generate New Refresh Token box.

  8. Click OK.

  9. Carefully copy and save the new refresh token. We’ll use this in Step 4.

Step 2: Create a new security group

  1. Still in Workday, use the search bar to look up “Maintain Permissions for Security Group”.

  2. In the Maintain Permissions for Security Group modal, make sure the Maintain button is selected.

  3. In the Source Security Group field, navigate to By Type > Integration System Security Group.

  4. Create a new security group. Give it a name, such as “ConductorOne integration security group”.

  5. On the new group’s Domain Security Policy Permissions tab, leave the Select All box checked.

  6. Click the + icon to create a new row, and fill it out as follows:

    • View/Modify Access: View Only
    • Domain Security Policy: Worker Data: Public Worker Reports

  7. Click OK.

  8. Next, activate the security policy changes. Search for “Activate Pending Security Policy Changes”.

  9. Add a comment about the change you’re making and click OK.

  10. Review the changes and if everything looks good, click the Confirm checkbox, then click OK.

Step 3: Assign the security group to the Workday account

  1. Still in Workday, use the search bar to look up “View Workday Account” and select the Workday account you used when generating the token in Step 1.

  2. Click the three dots icon next to the account name and navigate to Security Profile > Assign Integration System Security Groups.

  3. Select the security group you created in Step 2 and click OK.

Step 4: Add your Workday credentials to ConductorOne

  1. In ConductorOne, navigate to the Workday connector by either:

    • Clicking the Set up connector link in the email you received about configuring the connector.

    • Navigate to Connectors > Workday (if there is more than one Workday listed, click the one with your name listed as owner and the status Not connected).

  2. Find the Settings area of the page and click Edit.

  3. In the Client ID, Client Secret, and Refresh Token fields, enter the credentials you generated in Step 1.

  4. Enter the full URL of your Workday tenant in the Workday URL field.

  5. Enter the Workday tenant name in the Tenant Name field.

  6. Click Save.

  7. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Workday connector is now pulling access data into ConductorOne.

Configure the Workday integration using Terraform

As an alternative to the integration process described above, you can use Terraform to configure the integration between Workday and ConductorOne.

See the ConductorOne Workday integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Troubleshooting the Workday connector

Make sure that the integration security group you created when configuring the connector has the domain security policy applied to Report/Task Permissions only.

  1. In Workday, use the search bar to look up “View Security Group”, then navigate to Security Groups > Integration System Security Group (Unconstrained) and select the security group you just created.

  2. On the security group’s page, click the three dots icon next to the security group name and navigate to Security Group > Manage Domain Permissions for Security Group.

  3. Make sure that Worker Data: Public Worker Reports is shown in the Domain Security Policies permitting View access box.