Integrate with Workday

Leverage this integration to unify user identities and centralize user lifecycle management in JumpCloud. Import new users from Workday into JumpCloud to save time and avoid mistakes, as well as potential security risks, related to manually creating users. Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to Workday with their one user identity.

Read this article to learn how to setup the Workday integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• A Workday Organization Admin account
• Your Workday domain name

Considerations

• Enabling SAML will affect all users who use this application, which means that users will not be able to sign-in through their regular log-in page. If you enable SP-initiated SSO, users will only be able to access the app through JumpCloud.
• The Identity Management integration is for creating new users in JumpCloud from Workday only. The integration does not import updates to existing users.
• User import is one way, from Workday to JumpCloud, and unique users may only be imported once. Changes to users in JumpCloud will not be reflected back to Workday.
• The user import process is manual - there is no ongoing data synchronization after the import is complete.
• JumpCloud imports only JSON formatted data

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.

7. Optionally, expand Advanced Settings to specify a value for the SSO IdP URL. If no value is entered, it will default to https://sso.jumpcloud.com/saml2/<applicationname>.

8. Click Save Application.
9. If successful, click:
   • Configure Application and go to the next section
   • Close to configure your new application at a later time

Configuring the SSO Integration

To configure JumpCloud

1. Create a new application or select it from the Configured Applications list.
2. Select the SSO tab.
3. Add or change any attributes.
4. Click save.

Download the certificate

1. Find your application in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Select the SSO tab and click IDP Certificate Valid > Download certificate.

To configure Workday

1. Log in to Workday as an administrator.
2. Select on the user menu in the upper left corner (your Workday avatar).
3. Select Workbench from the drop-down menu.
4. Select Account Administration.
5. Select Edit Tenant Setup - Security.
6. In the Single Sign-on section under Redirection URLs, select the + icon.
7. Under Redirect Type, select Single URL and enter the following information:
   • Login Redirect URL - copy and paste the JumpCloud IDP URL
   • Logout Redirect URL - enter https://console.jumpcloud.com/userconsole/
   • Environment - click inside the field and select Implementation from the drop-down menu
8. In the SAML Setup section, check the box next to Enable SAML Authentication and SAML Identity Providers and select the + icon. Enter the following information:
   • Identity Provider Name - enter JumpCloud
   • Issuer - enter https://YOURDOMAIN.com (replace YOURDOMAIN with your company’s unique domain)
   • x509 Certificate - select inside the field and select Create x509 Public Key
     • On the Create x509 Public Key page, enter a Name for your certificate
     • Certificate - copy and paste the contents of the certificate downloaded in the previous section
9. Select OK.
10. Back on the Edit Tenant Setup - Security page, leave the Service Provider ID as the default value or, if it is blank, enter http://www.workday.com.
11. Check the box next to Enable SP Initiated SAML Authentication.
12. In the IdP SSO Service URL field, enter the same JumpCloud IDP URL.
13. Select inside the Authentication Request Signature Method field and select SHA-256 from the drop-down menu.
14. Ensure that all other values and checkboxes in both the Single Sign-on and SAML Setup sections of this page (that are not explicitly mentioned above) are blank and unchecked, respectively.
15. Select OK and then Done.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the group of users you want to give access.
5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Configuring the Identity Management Integration

To configure Workday

Creating a Workday Integration System User

1. In Workday, search "create integration system user" and select the resulting task.
2. Specify a User Name and a strong password.
3. Set the session timeout to a value as low as possible.
4. Select Do Not Allow UI Sessions.
5. Select OK, then Done.

Creating a security group

1. In Workday, search "create security group" and select the resulting task.
2. For Type of Tenanted Security Group, select Integration System Security Group (Unconstrained).
3. Specify a name for the group, select OK.
   
4. For Integration System Users, add the user created in the prior step, select OK, then Done.

Assigning the group to domain Security Configuration

In Workday, perform steps 1-4 for each Domain/Permission pair in the table that follows:

Domain	Permission
Workday Accounts	Get
Worker Data Public Worker Reports	Get
Person Data Work Contact Information	Get
Worker Data Current Staffing Information	Get
Worker Data All Positions	Get
Worker Data Business Title on Worker Profile	Get

1. Search "domain security configuration" and select the result.
2. In the Domain field, search the Domain from the table, select the result, select OK.
3. Select the (…) next to the Domain name; under Actions, select Domain > Edit Security Policy Permissions.
   
4. Under Integrated Permissions, add the Security Group created in the above steps and select the Permission.
   
5. Select OK, then Done. If an alert to Activate Pending Security Policy Changes is displayed, do this after all domains have been updated for the security changes to take effect immediately.

To configure JumpCloud

Authorizing Workday

1. In the JumpCloud Admin Portal, navigate to DIRECTORY INTEGRATIONS > HR Directories.
2. Select the Workday tile and click Configure.
3. Under Workday Authorization, click Authorize Workday. Provide JumpCloud with the credentials for the Integration System User created in the steps above.
   
4. Click authorize.

Creating a Custom Report

1. Search "create custom report" and select the result.
2. Specify:
   • Report Name
   • For Report Type, choose Advanced.
   • Data Source: This will depend on the manner Workday is organized. All Active Employees is used here, but your data source may vary.
3. Check Enable As Web Service and select OK.
   
4. Edit Custom Report : (* indicates data required for import) Attributes must be mapped in the Columns tab of the custom report, see also the example JSON data below. The Business Object 'Worker' is used for the following fields:

Field (Your field source may vary)	Column Heading Override XML Alias
Workday ID*	id
Employee ID	employee_id
Email – Primary Work*	email
User Name*	username
First Name	first_name
Last Name	last_name
Hire Date	hire_date
User Name**	WorkdayID

5. Share the report with the integration system user​.
   • Select the Share tab, then Share with all authorized groups and users.
     
6. Get the report URL after completing the new report by selecting the (…) next to the report name; under Actions, select Web Service > View URLs.
7. Copy the provided JSON URL and paste into the JumpCloud Workday setting WORKDAY CUSTOM REPORT URL.

Importing Workday Users

Considerations

• Field validation for required data (asterisk indicates the input must be globally unique):
  • username* - Usernames must only contain letters, numbers or _ and cannot start with a number
  • email* - Must be a valid email address
• Importing large numbers of records may take several minutes to complete. Any import more than 500 records will not return results to the console. A workday import notification will be sent when complete and allow for CSV download of import results.

To import users

1. Select Import Workday Users.
   
2. The Workday Import Creation window will present, allowing the selection of users to import and modification to the name, email, and username attributes prior to import. Select the vertical ellipsis to expand and view additional Preview Attributes.
3. Select Import when ready. Import results will be displayed on the subsequent screen.
4. Users will be imported into an inactive state and can be found on the Imported Users tab. They can now be managed in the same manner as any other JumpCloud user.
5. To notify the user of activation, either in the Imported Users tab or the Users Object, the users can be selected, then select the send/resend activation email button.
6. Once the user is activated in JumpCloud, they will no longer display on the Imported Users tab.

Valid JSON example from the Workday custom report:

Removing the SSO Integration

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.

Deleting the Workday Identity Management Integration

The Workday integration can be deleted using the JumpCloud API. You will need the id of your Workday integration.

To get the Workday integration id

1. Log in to the JumpCloud Admin Portal.
2. Navigate to DIRECTORY INTEGRATIONS > HR Directories.
3. Click on the Workday
4. In the browser navigation bar, copy the id from the URL
   • Example: https://console.jumpcloud.com/#/directories/hr-directories/workday/1a11ab111f111f1ea11af1/details

To delete the Workday integration

From Mac, run the following command from the terminal, replacing {id} with the id copied above:

From Windows, run the following commands in PowerShell, replacing {id} with the id copied above: