Workday - Connecting to Workday

1. Overview

For our connection with Workday, we support two authentication methods:

• Basic authentication. 
• OAuth. 

Below are instructions to connect your Workday account via either of these methods:

2.1. Create and Set Up your Integration System User (ISU)

Steps to create your ISU include:

• In your Workday Tenant, in the Search field, type "Create Integration System User". Then select the Create Integration System User task
• Set a user name and password for this user. You can use "Firstbase_ISU" as the user name.
• Keep "Require New Password at Next Sign In" unchecked.
• To ensure the password doesn't expire, you'll want to add this new user to the list of System Users. To do this, search for the Maintain Password Rules task.
• Add the ISU to the System Users exempt from password expiration field.
• Save the user name and password. You'll need the to connect later in the setup flow.

2.2. Create Integration System Security Group

• In Workday, search for "Create Security Group
• On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.
• In the Name field, enter a name for the security group (e.g. Firstbase_Security_Group) and click OK.
• On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section.
• Click OK and save this security group.

2.3. Configure domain security policy permissions for your Security Group

• In the Search field, type Maintain Permissions for Security Group
• Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2
• On the next screen, add the corresponding Domain Security Policies. You'll need the following policies set up:

• Operation	Domain Security Policy
  Get Only	Person Data: Name
  Get Only	Person Data: Personal Data
  Get Only	Person Data: Public Home Email Address Integration
  Get Only	Person Data: Private Home Email Address Integration
  Get Only	Person Data: Home Contact Information
  Get Only	Person Data: Work Contact Information
  Get Only	Person Data: Home Address
  Get Only	Worker Data: Workers
  Get Only	Worker Data: All Positions
  Get Only	Worker Data: Active Employees
  Get Only	Worker Data: Active and Terminated Employees
  Get Only	Worker Data: Public Worker Reports
  Get Only	Worker Data: Current Staffing Information
  Get Only	Worker Data: Employment Data
  Get Only	Worker Data: Organization Information
  Get Only	Worker Data: Current Staffing Information
  Get Only	Manage: Locations
  Get Only	Workday Accounts

2.4. Activate domain security policy changes

• In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved.
• Add any relevant comments, confirm the changes and hit OK.
  

2.5. Validate your authentication policy

• Search for Manage Authentication Policies
• Click Edit on the authentication policy row.
• Create an Authentication Rule.
• Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any.
• Note: You don't have to create a new Authentication Rule if you already have an existing one set to User Name Password or Any. You can add the ISU you created to that rule instead. You will need to create a new rule if SAML is the only Authentication Rule you see for "Allowed Authentication Types."

2.6. Activate all pending authentication policy changes

• In the search bar type, Activate all pending authentication policy changes.​
• Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

2.7. Obtain the web services endpoint URL

2.8. Connect to Workday via the Firstbase "Integrations" Page

• Login to the Firstbase App and visit the "Integrations" Page
• Find "Workday" under the list of Available integrations" and Click on it to start the connection process. Select the "Use my credentials" option.
• Confirm you are an Admin for Workday
• Add the Workday ISU's User ID and Password you created previously
• Enter the Web Services Endpoint URL into the linking flow. Click Next. ​
• You are all set. Once connected, you should see Workday appear under the list of "Active Integrations.

3. Connecting to Workday via OAuth