ODBC Driver for Workday

Build 22.0.8462

Linux DSN Configuration

This section describes how to set up ODBC connectivity and configure DSNs on several Linux distributions: Debian-based systems, like Ubuntu, and Red Hat Linux platforms, like Red Hat Enterprise Linux (RHEL), CentOS, and Fedora.

Minimum Linux Versions

Here are the minimum supported versions for Red Hat-based and Debian-based systems:

OSMin. Version
Ubuntu11.04
Debian7
RHEL6.9
CentOS6.9
Fedora13
SUSE12.1

Installing the Driver Dependencies

Run the following commands as root or with sudo to install the necessary dependencies:

  • Debian/Ubuntu: 
    apt-get install libc6 libstdc++6 zlib1g libgcc1
  • RHEL/CentOS/Fedora: 
    yum install glibc libstdc++ zlib libgcc

Here are the corresponding libraries required by the driver:

Debian/Ubuntu PackageRHEL/CentOS/Fedora PackageFile
libc6glibclinux-vdso.1
libc6glibclibm.so.6
libc6glibclibrt.so.1
libc6glibclibdl.so.2
libc6glibclibpthread.so.0
libc6glibclibc.so.6
libc6glibcld-linux-x86-64.so.2
libstdc++6libstdc++libstdc++.so.6
zlib1gzliblibz.so.1
libgcc1libgcclibgcc_s.so.1

Installing the Driver

You can use standard package management systems to install the driver.

On Debian-based systems, like Ubuntu, run the following command with root or sudo: 

dpkg -i /path/to/driver/setup/WorkdayODBCDriverforUnix.deb

On systems that support the RPM package format, run the following command with root or sudo: 

rpm -ivh /path/to/driver/WorkdayODBCDriverforUnix.rpm

Licensing the Driver

Run the following commands to license the driver. To activate a trial, omit the <key> input. 

cd /opt/cdata/cdata-odbc-driver-for-workday/bin/
sudo ./install-license.sh <key>

Connecting through the Driver Manager

The driver manager loads the driver and passes function calls from the application to the driver. You need to register the driver with the driver manager and you define DSNs in the driver manager's configuration files.

The driver installation registers the driver with the unixODBC driver manager and creates a system DSN. The unixODBC driver manager can be used from Python and from many other applications. Your application may embed another driver manager.

Creating the DSN

See Using unixODBC to install unixODBC and configure DSNs. See Using the DataDirect Driver Manager to create a DSN to connect to OBIEE, Informatica, and SAS.

Connecting to the Workday WQL API

The WQL service must be enabled before connecting:

  1. Open Workday and enter View Domain in the search bar. Enter Workday Query Language for the prompt.
  2. Check that one of the Allowed Security Group Types includes the user you are connecting with.

Configuring the Host and Tenant

To obtain the Host and Tenant properties, log into Workday and search for View API Clients. On this screen, Workday will display the Workday REST API Endpoint which contains both the Host and Tenant. The Tenant is the portion after the last slash, while the Host is the "https://" and the domain name.

For example: if the API endpoint is https://wd3-impl-services1.workday.com/ccx/api/v1/mycompany, the Host is https://wd3-impl-services1.workday.com and the Tenant is mycompany.

You also have the option of connecting to reports when the UseWQL property is enabled. See Fine-Tuning Data Access for details on how to configure this.

Authenticating to Workday

You can authenticate to the Workday WQL API as a normal (non-ISU) user, or an ISU (via either OAuth or OAuthJWT).

Normal User

To authenticate as a normal user in Workday, you must first create an API Client. Please refer to Creating a Custom OAuth Application for details on the procedure.

Once you have an API client configured, set the following properties to connect:

  • AuthScheme: Set this to OAuth.
  • OAuthClientId: The Client ID obtained from the View API Client page.
  • OAuthClientSecret: The Client Secret obtained from the View API Client page. If you are using a public client, leave this blank.
  • Tenant: The tenant for the account.
  • Host: The host for the REST API Endpoint in the View API Clients page.

ISU

To authenticate as an ISU, you must first create either an API Client or an API Client for Integrations. Please refer to Creating a Custom OAuth Application for details on the procedure. You can create either an API Client for Integrations or an API Client using the JWT bearer grant type.

If you created an API Client for Integrations, set the following properties to connect:

  • AuthScheme: Set this to OAuth.
  • InitiateOAuth: Set this to REFRESH.
  • OAuthClientId: The Client ID obtained from the View API Client page.
  • OAuthClientSecret: The Client Secret obtained from the View API Client page.
  • OAuthRefreshToken: The refresh token obtained from the Manage Refresh Tokens for Integrations page.
  • Tenant: The tenant for the account.
  • Host: The host for the REST API Endpoint in the View API Clients page.

If you created an API Client with JWT, set the following properties to connect:

  • AuthScheme: Set this to OAuthJWT.
  • OAuthJWTCertType: Set this to the certificate type. This will be PFXFILE if you created the certificate with keytool or openssl pkcs12.
  • OAuthJWTCert: The path of the certificate file you created.
  • OAuthJWTCertPassword: The password of the certificate file you created.
  • OAuthJWTIssuer: The Client ID obtained from the View API Client page.
  • OAuthJWTSubject: The username of the ISU you are using.
  • Tenant: The tenant for the account.
  • Host: The host for the REST API Endpoint in the View API Clients page.

Connecting to the Workday SOAP API

Connections using the SOAP API support all the same authentication schemes that the WQL and reporting services do, in addition to basic authentication. Each of the above configurations can be used with SOAP by setting the UseWQL property to false.

Basic authentication can also be used with a normal user or an ISU without configuring an API client:

  • UseWQL: Set this to false.
  • AuthScheme: Set this to Basic.
  • User: The Workday user account name.
  • Password: The password used to authenticate the user.
  • Tenant: The tenant for the account.
  • Host: The host for the REST API Endpoint in the View API Clients page.

Other authentication methods are configured the same way as for the WQL and reporting services. Please refer to the corresponding sections for more details on those authentication schemes as well as the Host and Tenant properties.

Refreshing OAuth Values

The driver can refresh the temporary OAuth access tokens obtained during the browser-based OAuth authentication exchange. By default, the driver saves the encrypted tokens in the odbc.ini file corresponding to the DSN. Access to this odbc.ini file can be restricted in the case of System DSNs.

To enable the automatic token exchange, you can give the driver write access to the system odbc.ini.

Installing Dependencies for OAuth Authentication

The OAuth authentication standard requires the authenticating user to interact with Workday, using a web-browser. If the first OAuth interaction is to be done on the same machine the driver is installed on, for example, a desktop application, the driver needs access to the xdg-open program, which opens the default browser.

To satisfy this dependency, install the corresponding package with your package manager:

Debian/Ubuntu PackageRHEL/CentOS/Fedora PackageFile
xdg-utilsxdg-utilsxdg-open

Set the Driver Encoding

The ODBC drivers need to specify which encoding to use with the ODBC Driver Manager. By default, the CData ODBC Drivers for Unix are configured to use UTF-16 which is compatible with unixODBC, but other Driver Managers may require alternative encoding.

Alternatively, if you are using the ODBC driver from an application that uses the ANSI ODBC API it may be necessary to set the ANSI code page. For example, to import Japanese characters in an ANSI application, you can specify the code page in the config file '/opt/cdata/cdata-odbc-driver-for-workday/lib/cdata.odbc.workday.ini': 

[Driver]
AnsiCodePage = 932

Copyright (c) 2023 CData Software, Inc. - All rights reserved.
Build 22.0.8462