Version 2025.1

For details and updates associated with this version of the app, see the App Catalog Changelog.

Introduction

View the Amazon Web Services starting page on the developer forum for more details.

View the Additional Docs for this App for more details.

Overview

This app extends Workday’s delivered onboarding business process to:

1. Guide new hires on uploading a photo for the new badge
2. Provide interactive validation and feedback to new hires on their photo
3. Automate the decision making process of whether the HR Partner should approve the photo
4. Automate the provisioning of a virtual badge

Deploy Instructions

Create Copy (Recommended)

1. Click the “Create Copy” button above.
2. To modify app source code:
   1. Open the app in the Console.
   2. Click Open in App Builder.
3. After making any changes, Save and Deploy.

Workday Configuration Instructions

App Security

Create an ISU

1. Navigate to your app under the App Manager Task.
3. Name this user AWSExtendISU.
4. Set a password for this user.
5. Click the OK button.

Create a New Integration System Security Group (ISSG)

1. Navigate to the task Create Security Group
2. For the Type of Tenanted Security Group choose Integration System Security Group (Unconstrained)
3. Name your Security Group AWSExtendISSG. Click OK.
4. Add the ISU you created AWSExtendISU to the Integration System Users field. Click OK.

Client Credentials Mapping

1. Create Your API Client. Make note of the client ID and client secret of your app. For Redirect URI and Authorized CORS Domains, you can input any value as they will not be used for this application.
2. Navigate to the task Create Client Credentials Mapping in your tenant.
3. For Client ID, input the client ID from Step 1.
4. Add the ISU you created AWSExtendISU to the Integration System User field. Click OK.

Create Model Security Domains

Using App Manager, perform the following steps:

1. In the Model Components section, locate the Security Domain AWS Onboarding App and click Create in the Domain Security Policy column.
2. Check Confirm and click OK.
3. Add the following Report/Task Permissions to the Domain Security Policy: Modify: Employee as Self and AWSExtendISSG

Business Process Security Policy

1. In the Search Bar within your tenant, type in bp: onboarding. Then, choose the definition you would like to modify. For example, choose the Onboarding for Global Modern Services business process definition if you are in a GMS tenant.
2. Next, choose the Related Actions next to the definition, and choose Business Process Policy -> Edit. Click the OK button on the pop-up screen.
3. Add the AWSExtendISSG security group to the View All action.
4. Click the OK button at the bottom of the screen.
5. Run task Activate Pending Security Policy Changes.

Business Process and Notifications

The purpose of this automation is to automatically validate Worker images and provision badges when onboarding new hires. We’ll need to modify the onboarding business process:

1. In the Search Bar within your tenant, type in bp: onboarding. Then, choose the definition you would like to modify. For example, choose the Onboarding for Global Modern Services business process definition if you are in a GMS tenant.
2. Next, choose the Related Actions next to the definition, and choose Business Process -> Edit Definition. Click the OK button on the pop-up screen.
3. Here, click the + button to add a new step to the Business Process:

• Input a new Order. For example, input b so that badge provisioning is the first step after initiation of the business process.
• For Type, choose To Do
• For Specify, choose Get your badge
• For Group, choose Employee as Self and AWSExtendISSG
• Click OK

4. After you’ve added the step, we now need to configure a custom notification to the new hire letting them know their badge has been created. Choose the Related Actions next to the definition, and choose Business Process -> Add Notification. Click the OK button on the pop-up screen.
5. In the Triggers section, choose On Exit and select the business process step you created in step 3. For example, b - To Do: Get your badge.
6. In the Recipients section, choose Employee as Self in the Groups field.
7. In the Message Content section, input Your badge has been created. in the Text field of the Subject sub-section.
8. In the Message Content section, add the following 4 rows in the Body sub-section:

• Text: Congratulations! Your badge has been created.
• Field: Line Break
• Field: Line Break
• Text: \<a href="url"\>www.workday.com\</a\>

AWS Configuration Instructions

All AWS services required for the sample Badge application are already configured in your account. Review the following items in your AWS account as a guide to using AWS services.

Lambda Functions

Your AWS account contains two Lambda Functions. From the AWS Console, navigate to Lambda from the top Service menu. This takes you to the Functions list screen where you see the functions:

• badge-validate-photo – this function validates the photo submitted by the user of the Extend app. It is invoked by the _ validatePhoto _ orchestration in Extend.
• badge-create – this function generates a badge from the photo submitted by the user and places the badge image file in your S3 bucket.

Source code for these Lambda functions is located in your S3 bucket under the apps/badge-create folder. The Python source code for each function is located in a ZIP file, which you can download, open, and review.

S3 Bucket

All files and data for your application are located in one S3 bucket named:

• workday-devcon-hackathon-[team name]

To review the contents of this bucket, navigate to the S3 service using the AWS Console.

Event Bridge

All messages between Extend and AWS are sent on the Event Bridge Event Bus named

• tenant-event-bus

An example of sending messages from Extend to AWS using the event bus can be reviewed in the generateBadge orchestration in Extend.

To send messages from AWS back to Extend, three items are configured in your AWS account. These are all visible by navigating to the Event Bridge service from the Services menu in the AWS Console. These include:

• API Destination Connection named WorkdayExtendConnection. This item contains the OAuth credentials and Endpoint to authenticate requests to your Extend tenant. It is configured with the client Id and secret referred to in the Client Credentials Mapping section above
• API Destination named APIDestination-xxxxxxx. This item is configured to POST messages back to the inboundBadgeComplete orchestration in the Extend sample app. The destination is configured with an endpoint specific to that orchestration. The API Destination uses the API Destination Connection to authenticate the POST request. If you create additional Extend orchestrations to process inbound messages, you must create a new API Destination for each orchestration, but can reuse the same API Destination Connection.
• Event Bus Rules are accessed from the Buses / Rules menu item in Event Bridge and by selecting the tenant-event-bus.
  • APIDestinationInboundRule handles messages put to the tenant-event-bus by the badge-create Lambda function. These messages are posted back to the inboundBadgeComplete orchestration in the Extend sample
  • SampleAppBadgeCreateRule handles messages posted from the generateBadge orchestration in Extend and are routed to the badge-create Lambda function for processing.

Usage Instructions

1. Run the Launch Onboarding task to initiate the onboarding process for a new hire. For example, in a GMS tenant, Logan McNeil can initiate the process for James Walker.
2. Run task Manage Badges to view all badges issued for the current Worker.
3. Click on the Create Badge task in the new hire’s inbox.
4. Run task View My Badge to view the badge for the current Worker.

Note that the last 3 tasks can only be run by the current user for themselves (Employee As Self), per the Create Model Security Domains configuration instructions above.