For increased security and functionality, you can swap to a Workday Credential that authenticates with a JWT Bearer Grant Token for a:
- Custom Cloud Data Source (CCDS) that connects to Workday via OAuth 2 credential
- Planning Data Source (Adaptive Planning as a data source) that authenticates with username and password
Before You Begin
Contact your Customer Success Manager and verify provisioning turned on Enable Public API for your instance.
- Enable Public API and create an ISU.
- Enable the security policy on the domain Adaptive Planning API Access and provision a group where the new public API ISU you just created resides.
- Enable User Sync and synchronize users at least once.
- Enable the Adaptive Planning functional area if it isn't already set up and activate any pending security policy changes.
In Adaptive Planning
Give the ISU you created a role with Design Integrations permissions and data access.
- Create the Workday Credential in Adaptive Planning.
- Register a Workday API Client with JWT Bearer Grant.
- Swap the Credential in Planning Data Sources and CCDS.
Create the Workday Credential in Adaptive Planning
You can associate a single Workday credential within Adaptive Planning with one or more Workday data sources, CCDS, or loaders.
- Log in as the ISU created for your Public API earlier.
- Navigate to Integrations > Design Integrations.
- Expand the Credentials pane in the Component library and select Create New Credential.
- Select Workday Credential in the Credentials menu.
- Enter a unique name that helps you identify the Workday tenant and user it connects to.
- Select Create. Verify Client Grant Type uses Jwt Bearer Grant.
- For Connection, select External and provide the Remote Tenant ID, Remote UI URL, and Remote Rest URL of the Workday Tenant you want this credential to work with. The Remote Tenant ID, Remote UI URL, and Remote Rest URL fields are case sensitive.
Register a Workday API Client with JWT Bearer Grant
- Select View Certificate to copy the x.509 certificate. You need this certificate to register an API client in Workday.
- Open a new browser window and log in to Workday as a user who can register API clients.
- Search for and select Register API Client.
- Provide a Client Name that makes it clear this API client integrates with Adaptive Planning.
- Select Client Grant Type Jwt Bearer Grant.
- Select Create x509 Public Key and paste the certificate you copied from your Workday Data Source view certificate link.
- Copy in the Redirection URI from Adaptive Planning. Though this is a required field, JWT bearer grant will not call this URL.
- Select Access Token Type Bearer.
- Set Scope (Functional Areas) to Adaptive Planning.
- Select OK to generate the Client ID and other details that identify your new integration client.
- Copy the Client ID so that you can paste it into your Workday credential in Adaptive Planning.
Complete the Workday Credential in Adaptive Planning for JWT Bearer Grant
- Return to the browser window for Adaptive Planning containing the incomplete Workday credential.
- Enter the Workday ISU username you want associated with this credential.
- Paste the Client ID you copied from Workday.
- Select Test Connection in the Actions pane, and select Test. A message indicates if the connection succeeded.
Swap the Credential in Planning Data Sources and CCDS
- Select the CCDS or Planning Data Source you want to swap credentials for.
- Select the new Workday Credential you just created.
- For CCDS, update the content of the CCDS script to retrieve the token to with