Creating a new user via Workday with a username generated by Saviynt EIC

[PVoehrs]

Is there a simple way to allow Saviynt to create usernames (not systemusernames) while importing users from workday SOAP. Ideally the configured Username generation rule is picked for the generation and not a preprocessor logic.

When we tried to remove the username field of the USER_IMPORT_MAPPING, the system complains about empty or missing key field. The reconciliation field in the UserImportJob is ignored in this case, which should be used as the "key" field.

Any idea how to achieve this?

[avinashchhetri]

@PVoehrs,

Username is a mandatory field in the attribute mappings when you are importing users. Username is the PrimaryKey in the Users table.

Could you elaborate on what you mean when you say "Username generation rule is picked for the generation and not a preprocessor" ?

[PVoehrs]

Hi,

The username field should be calculcated based on the rule configured in the registration part of the identity configuration under global config.

We could also use some kind of a pre-processing logic to update the username field, but we want to use the specified rule. 

The goal is to have a unique identifier in the Saviynt platform, which is also used to login. 

The workday instance cannot provide this uniqueness as not all users are coming from one central identity source.

BR

[avinashchhetri]

Hello @PVoehrs,

I have not tried this personally but you should be able to generate a username in Saviynt (Add Register User Rule under Global Configs). However you might need an additional attribute imported in Saviynt, which is unique (in workday), and can be used as Reconciliation Field in subsequent imports for e.g. EmpoyeeID. By default, if the username is missing and no username generation rule is configured, then username should default to the userkey.

In order to use UserName in a pre-procesor, you will have to map the UserName attribute in your Import JSON so that its gets initialized and is available in the temp tables at the time of pre-processing, before the actual insert/update operation. 

In your scenario, a better alternative would be to map the unique attribute say EmployeeID to the userName, also use that as the Recon Field, and then generate the systemUserName in Saviynt and pass the systemUserName to the downstream applications including your SSO IDP.

[shibinvpkvr]

@avinashchhetri 

When we use REST/Workday connector for user import, where do we specify the reconciliation field in the connection? 

[PVoehrs]

@shibinvpkvr You do this on job level in the userImportJob.

[shibinvpkvr · Accepted solution]

Does that mean we always need to map username from a source property and that should be the recon field? Can't we generate username in Saviynt and keep Employee ID as the recon field from Workday? I know this is possible with Schema based user import but wanted to see if its possible with REST based import as well. 

[PVoehrs]

That's what we have currently identified. We tried to leave the username blank and configured the employeeID as customProperty to be used. Also we used this field as the reconcile field in the job, which didn't work out. Let's see what Saviynt SME will come back with.

[PVoehrs]

@avinashchhetri 

Thanks for the reply. That's what we basically tried:

1) Created a username creation rule
2) UserImportJob configured to use CustomProperty1 as the reconcile field
3) CustomProperty1 configured in the connection to use the WorkerID within Workday
4) No mapping for username within the connection

Result: No update, no user creation, error of missing key field.

When providing the username in the connection mapping, a user will be created, but the reconcile field won't be recognised. We renamed a username to something else and when we did a re-run of UserImportJob, it just created a new user and using the reconcile field which was/is still CustomProperty1.

BR
Patrick

[KB99]

I have the same situation generating the user name in the rule and there is no mapping for username in connection.

Could you please tell is there any configuration that has to be done.

pvoth