Recreate the Workday to Visier Security Integration

Set up an automated process that sends role-based security data from Workday to Visier.

Overview

Workday roles do not have one-to-one counterparts in Visier. As a result, you must set up processes to prepare Workday roles for use in Visier. To provide Visier with a compatible population file:

1. Build the RaaS report that represents your user access roles.
2. Create an XSLT transformation file that reads the RaaS report XML aliases and generates a pipe-delimited file.
3. Configure an outbound Enterprise Interface Builder (EIB) to automate the RaaS report, transformation, and SFTP file delivery to Visier.

The integration follows a robust, three-step pattern for each organization type (e.g., Supervisory, Location), creating a separate data file for each. After completing the integration, the EIB provides a compatible population file for dynamic security in Visier. For more information about dynamic security, see Map a population using a security file.

The three core components:

• Report-as-a-Service (RaaS) report: This advanced Workday report acts as the data source. It uses powerful calculated fields to extract the specific organizations and the workers assigned to key security roles for them.
• Extensible Stylesheet Language Transformations (XSLT) stylesheet: This is a transformation layer. It takes the raw XML data from the RaaS report and reformats it. Its most critical function is to consolidate lists of workers (e.g., multiple HR Partners for one department) into a single, pipe-delimited text field (|), which is the format Visier requires.
• Enterprise Interface Builder (EIB): This is the automation engine. The outbound EIB orchestrates the entire process: it runs the RaaS report, applies the XSLT transformation, and delivers the final, perfectly formatted file to Visier's SFTP server.

This example walks through the creation of a single population access file for Supervisory Organizations. This same pattern can then be cloned to create the files for Location, Company, and other organization types.

Step 1: Build the RaaS report

The foundation of this process is a report that uses calculated fields to pre-process the data, making the transformation step much cleaner.

Create a new custom report

• Task: Create Custom Report
• Report Name: Visier Security - Organization Roles - Supv Org - Extract
• Report Type: Advanced
• Data Source: Top Level Organizations and Subordinates

This ensures the report evaluates every organization in the hierarchy.

Create calculated fields to isolate role assignees

To simplify the logic, create a separate calculated field for each security role to report on. This is a highly effective and maintainable design.

• Task: Create Calculated Field
• Field Name: RPT CF - ESI - HR Vice President (Supv Org)
• Business Object: Organization
• Function: Extract Single Instance (ESI)
• Configuration:
  • Source Field: Role Assignments on Organization
  • Condition: Create a simple condition to check if the role in the selection list is equal to HR Vice President.
  • Field to Return: Workers Assigned. This returns the multi-instance field of all workers in that role.

Repeat this process for every distinct role you need to extract. Create one ESI calculated field per role (e.g., Manager, All Employees View Only).

Define report columns and XML aliases

In the Columns tab of the report, add the organization fields and the new calculated fields. Crucially, you must define a short, unique XML alias for each column. The XSLT transformation depends on these exact aliases.

Define report filters

In the Filter tab, ensure you only extract relevant organizations:

• Filter for Active organizations only (Active equal to Yes).
• Add a filter to only include organizations where at least one of your role-based calculated fields is not empty. This prevents sending blank records.

Enable as web service

Finally, navigate to the Advanced tab of the report definition and select Enable as Web Service. This makes the report a RaaS that the EIB can call.

Step 2: Create the XSLT transformation file

This XSLT code is written to read the specific XML aliases from the RaaS report and generate the final pipe-delimited file.

This XSLT file is a self-contained transformation script. It does not need to be populated with client-specific details like RaaS URLs, passwords, or server information. All of that configuration is handled in the EIB. The only connection between the RaaS report and this stylesheet is the XML alias defined when you build the RaaS report. When the RaaS report runs, it creates an XML output where each column is tagged with its alias. For example, the data for the HR Vice President role will be inside <wd:HRVPSupv> tags.

The XSLT code below looks for the exact tag <xsl:for-each select="wd:HRVPSupv/wd:Workers_Assigned"> to know which data to process for that column. If you add new roles to the RaaS report, add a corresponding <xsl:for-each> loop to this XSLT to process the new data.

To create the XSLT transformation file:

1. Open a plain text editor.
2. Copy and paste the entire code block below. Do not edit the code block.
3. Save the file as Security_Org_Roles_Rules_XSLT.xsl.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="2.0" 
    xmlns:xsl="[http://www.w3.org/1999/XSL/Transform](http://www.w3.org/1999/XSL/Transform)" 
    xmlns:wd="urn:com.workday/bsvc">

    <!-- Set the output to be plain text, not XML -->
    <xsl:output method="text"/>

    <!-- Define variables for the special characters to use for formatting -->
    <xsl:variable name="linefeed" select="' '"/>
    <xsl:variable name="delim" select="','"/>
    <xsl:variable name="pipe" select="'|'"/>

    <!-- This is the main template that starts the entire transformation process -->
    <xsl:template match="/">
        <!-- First, call the separate template to write the header row -->
        <xsl:call-template name="Header"/>

        <!-- Then, loop through each record (each organization) from the RaaS report output -->
        <xsl:for-each select="wd:Report_Data/wd:Report_Entry">
            <xsl:call-template name="Process_Record"/>
        </xsl:for-each>
    </xsl:template>

    <!-- This template is dedicated to writing the header row of the output file -->
    <xsl:template name="Header">
        <xsl:value-of select="'Organisation_Reference_ID,Type,HRVP_WWID,AllEmployeesView_WWID'"/>
        <xsl:value-of select="$linefeed"/>
    </template>

    <!-- This template processes one organization record at a time -->
    <xsl:template name="Process_Record">
        
        <!-- Column 1: Organization ID. It reads the data from the XML element with the 'Reference_ID' alias -->
        <xsl:value-of select="wd:Reference_ID/wd:Descriptor"/>
        <xsl:value-of select="$delim"/>

        <!-- Column 2: Organization Type -->
        <xsl:value-of select="wd:Type/wd:Descriptor"/>
        <xsl:value-of select="$delim"/>

        <!-- Column 3: HR Vice President WWIDs. This loops through all workers found in the 'HRVPSupv' element -->
        <xsl:for-each select="wd:HRVPSupv/wd:Workers_Assigned">
            <xsl:value-of select="wd:ID[@wd:type='Employee_ID']"/>
            <xsl:value-of select="$pipe"/>
        </xsl:for-each>
        <xsl:value-of select="$delim"/>

        <!-- Column 4: All Employees View Only WWIDs. This loops through all workers in the 'AllEEsSupv' element -->
        <xsl:for-each select="wd:AllEEsSupv/wd:Workers_Assigned">
            <xsl:value-of select="wd:ID[@wd:type='Employee_ID']"/>
            <xsl:value-of select="$pipe"/>
        </xsl:for-each>
        
        <!-- End the line for this record -->
        <xsl:value-of select="$linefeed"/>
    </template>

</xsl:stylesheet>

Step 3: Configure the Enterprise Interface Builder (EIB)

The final step is to create the outbound EIB that automates the workflow.

Create a new EIB

• Task: Create EIB
• Name: EIB - Outbound - Visier Population Access (Supv Org)
• Select the Outbound option.

Configure Get Data

• Data Source Type: Custom Report
• Custom Report: Select the RaaS report Visier Security - Organization Roles - Supv Org - Extract you created.

Configure Transform

• Transformation Type: Custom Transformation (XSLT)
• Report Transformation: Upload and attach the Security_Org_Roles_Rules_XSLT.xsl file you created.

Configure Deliver

• Delivery Method: SFTP
• File Name: PopulationAccess_SupvOrg.csv (or as required by Visier)
• SFTP Details: Enter the server address, directory, and credentials provided by Visier for file drops. For more information, see File Upload Using SFTP.

Maintain and extend the integration

This integration is designed to be easily maintained and updated as business needs change.

Handle new organizations (e.g., create a new department)

No changes are required to the report, XSLT, or EIB. This is fully automated. Because the RaaS report uses the Top Level Organizations and Subordinates data source, any new Supervisory Organizations created in Workday are automatically included the next time the integration runs.

Handle new security roles (e.g., add a Talent Partner role)

Adding a new role to the security feed is a three-part process that follows the original integration pattern.

Update the RaaS report

1. Create a new Extract Single Instance (ESI) calculated field for the Talent Partner role.
2. Add this new calculated field as a new column to the RaaS report.
3. Assign it a new, unique XML alias; for example, TalentPrtnrSupv.

Update the XSLT stylesheet

1. Add a new column header. In the <xsl:template name="Header"> section, add the new column name to the comma-separated list (e.g., TalentPartner_WWID).
2. Add a new processing loop. In the <xsl:template name="Process_Record"> section, copy one of the existing <xsl:for-each> blocks and modify it to use the new XML alias wd:TalentPrtnrSupv. This tells the transformation how to process the data for the new role.

Update the EIB

No changes to the EIB's overall structure. In the existing EIB, go to the Transform step and replace the old XSLT file with your newly updated version. Once saved, the integration will include the new Talent Partner role in the output file on its next scheduled run.