Workday Connector - Provisioning issue while adding and removing access

[irfan]

Hi Team,

We have imported the workday accounts and security groups using Workday connector type. We are observing issues in provisioning while adding and removing access.

1. Adding Access to a user account: When we submitted a request to add a Security Group access for a user account we observed that post completion of Add Access task, the requested group is assigned to the user account in Workday. However, alongwith addition it has also removed some of the existing access which user already had.

2. Removing Access from a user account: When we submitted a request to remove a Security Group access from a user account we observed that post completion of Remove Access task, the requested group is removed from the user account in Workday. However, alongwith removing the requested group it has also removed some of the existing access which user already had.

We are using the below soap call for performing the add and remove operation in UPDATE_ACCOUNT_PAYLOAD block of the Workday connector

<bsvc:Put_Assign_User-Based_Security_Groups_Request bsvc:version="${API_VERSION}">
<bsvc:Assign_User-Based_Security_Groups_Data>
<bsvc:Workday_Account_Reference bsvc:Descriptor="?">
<bsvc:ID bsvc:type="System_User_ID">${accounts.name}</bsvc:ID>
</bsvc:Workday_Account_Reference>
<bsvc:User-Based_Security_Group_Reference bsvc:Descriptor="User-Based_Security_GroupObject">
<bsvc:ID bsvc:type="WID">${entitlementID}</bsvc:ID>
</bsvc:User-Based_Security_Group_Reference>
</bsvc:Assign_User-Based_Security_Groups_Data>
</bsvc:Put_Assign_User-Based_Security_Groups_Request>

Has anyone come across this issue? Can someone please help and suggest to resolve this? We are on Saviynt v5.5SP3.

Regards,

Irfan

[rushikeshvartak]

Can you attach logs for both use case 

[Srinivas]

Hello,

The Workday Connector utilizes the 'Put_Assign_User-Based_Security_Group' Workday Web Service which performs a FULL REPLACEMENT of security groups. Workday provides no other webservice to do add/remove only for specific Security Groups.

https://community.workday.com/sites/default/files/file-hosting/productionapi/Human_Resources/v38.2/P...

While provisioning, the Saviynt Connector utilizes the specified payload and appends it to all the existing access that the user already has and sends the combined payload.

Example: If we have entitlements A,B,C in Saviynt and you want to add one more entitlement D, Saviynt will append D to A,B,C and sends the payload as A,B,C,D.

While deprovisioning, the Saviynt Connector automatically calculates which access needs to be removed and sends the payload consisting of all existing access minus the ones requested to be removed.

Example: If you have entitlements A,B,C  in saviynt and want to remove entitlement "C", saviynt will send the payload as A,B.

So the recommendation is to bring in all the Security group info into Saviynt via a single report and use the Entitlement Type Configurations (Config for Requestable entitlements, Config for selected entitlements) to filter out and hide the Security groups that the customer does not want to show from the Workday ARS Request Form.

Thanks

Srinivas