The Workspace ONE Experience Workflows integration pack with Kronos - Worker Status connects the Kronos integration pack to your Kronos Punch Clocking In and Out service to retrieve the current working status of your workers.

Note: The Shift-based access control is available now as a Tech Preview. You can install the tech preview in your test environment to participate in the Shift-based Access Control tech preview. This feature is not fully supported and cannot be used in a production environment.

Set up Kronos-Worker Status for Shift-Based Access Control

The sequence of the workflow is as follows.

  • The Boomi process receives the worker clock-in and clock-out activity from the Kronos time keeping system.
  • This workflow scans for worker punches from Kronos and stores the data in intermediate storage that is used to manage when workers can access their Workspace ONE Intelligent Hub content based on when they clocked in and clocked out.


The following lists the UKG Kronos administrator credentials required to configure the Kronos - Worker Status integration pack in Workspace ONE Experience Workflows. For more information about finding this information, see the UKG Dimensions Customer Guide for Engaging Technology Partners Kronos documentation.

  • User name and password of the Kronos user access account. You must create the user access account. The account permissions must provide the appropriate access to perform API calls to an endpoint. See the Create an API Access Account for Your Partner Solution topic in the UKG Dimensions Customer Guide for Engaging Technology Partners.
  • OauthID Client ID and Secret as your company's OAuth authentication ID. If you do not have an Oauth Client ID and Secret, request the ID from UKG Support.
  • The App Key. An app key is a series of letters and numbers that uniquely identifies an application. This app key is required for all API calls.
    1. To generate the app key, in the UKG portal go to the Main Menu > Administration > Application Setup page.
    2. In the Application Setup page, select Common Setup > My Apps.
    3. In the My Apps page, click Add to create the app key.
    4. To view the app key value, select the key you created from the list and click Details. The app key displays in the pane that opens. Copy and save this information.
  • Host URL. In the UKG configuration, this is the vanity URL that you created as your organization's URL in UKG.

Workspace ONE Access User Group that includes all the Kronos users. These are the group that the Boomi scheduling process uses to get the worker status of users. The user names must be the same in the Kronos system and in the Workspace ONE Access directory. See Managing Groups in Workspace ONE Access in the Workspace ONE Access documentation center.

If you are setting up a custom email SMTP connector, know the host, port, and user information.


  1. Log into the Workspace ONE Access console and navigate to the Integration > Hub Configuration > page.
  2. On the Hub Configuration page, click LAUNCH to open the Hub services console.
  3. Navigate to the Home > Experience Workflows page.

    You are automatically logged into your Boomi portal from this page.

  4. In the Boomi portal, select the environment to add the Kronos- Worker Status integration pack, either PROD or TEST.
  5. Click INSTALL A NEW INTEGRATION and search for the Kronos - Worker Status pane and click INSTALL.

    The Configure Integration / Connector page displays the Experience Workflows Connection tabs.

    Workspace ONE Experience Workflows Connector page with Kronos Connector

    The connection URL for the Workspace ONE Hub Services Connector, Workspace ONE Hub Services Patch Connector, and Intermediate Data Storage Connector tabs are automatically configured. Do not change these settings.

  6. Open the Kronos Connector tab and enter your Kronos connector host URL. For example, https://<customerAccountName>
  7. (Optional) Configure your Email SMTP Connector.

    The default SMTP connector that is used to send email messages is the VMware SMTP service. That default value is not displayed on this page.

    Only one SMTP connector is configured in the Workspace ONE Experience Workflows service. The SMTP connector is used for all integration packs that you set up.

    Note: You cannot revert to the default Email SMTP connector settings after you set up your SMTP connector.

    Tab Name



    • HOST. Enter the host name of the SMTP mail server.

    • PORT. Enter the SMTP server port number.

  8. Click Continue. The Configure Integration / Properties page displays the Experience Workflows Properties tabs.
    Workspace ONE Experience Workflows properties tab for Kronos shift-based access configuration

    The Workspace ONE Access Properties settings TENANT URL, REMOTE APP CLIENT ID, AND REMOTE APP SHARED SECRET are preconfigured. Do not change these settings.

  9. Open the Kronos Worker Status Properties tab and configure the Kronos property values.

    Properties Action
    CLIENT ID Enter the OAuth 2.0 Client identifier.
    CLIENT SECRET Enter the client secret.
    USERNAME Enter the Kronos user access account admin user name.
    PASSWORD Enter the Kronos admin user password.
    APP KEY Enter the unique app key that you created in the UKG portal.

    Enter the Workspace ONE Access user group names. Users must have the same user name in both the Workspace ONE Access directory and in the Kronos time keeping system.

    You can add a comma-separated list of group names.

    Important: If you do not enter a user group value, the Boomi scheduled process cannot retrieve the working status of users. Make sure that the user names in the Kronos system and in the Workspace ONE Access directory are always in sync.

    Enter how often the Kronos - Worker Status integration pack retrieves the working status of users from the Kronos time keeping system.

    The default is to check every 30 minutes. The minimum value is 5 minutes and the maximum value that can be set is 1440 minutes. 1440 minutes is 24 hours.


    Enter an email address or distribution list address to receive email alerts when the process fails. Email alerts are sent when a scheduled process fails to run successfully for any reason.

    If you do not enter an email address, error notifications are not sent.

  10. If you configured your SMTP connector in Step 7, in the Email SMTP Properties page, configure the SMTP property values.

    If you are using the default VMware SMTP connector, the property settings re not displayed on this page.

    Properties Action


    In most cases, the EMAIL SMTP CONNECTOR HOST and SENDER'S EMAIL ADDRESS values are the same.


    Enter the user name of the SMTP account.


    Enter the password associated with the user name.

  11. Click CONTINUE.
  12. After you configure the properties value, test the connections associated with the Kronos Worker Status configuration before scheduling when the process runs.
    1. Click SCHEDULE/RUN.
      Workspace ONE Experience Workfows scheduling page for Kronos
    2. In the [Kronos] Worker Status Test Connection row, click RUN NOW to run the test.
    3. Click VIEW EXECUTION HISTORY to see the result of the connection process test.

      The Status column shows the execution results of the test. If the test is successful, Complete is displayed. If the connection process failed, Error is displayed.

    4. To check for details of the test and to see the error message if you have an error, click [Kronos] Worker Status Test Connection in the process column.

      See the Workspace ONE Experience Workflows Boomi Process Error List in the Workspace ONE Experience Workflows Configuration guide to understand what the error might be.

    5. If the test is successful, click Installed in the Boomi Portal header to return to the installed Kronos card and create the schedule for shift-based access.
  13. Click SCHEDULE/RUN and in the [Kronos] Worker Status - Batch [Workspace ONE] row click RUN NOW.

    Monitor the time it takes for the sync to complete and then decide a schedule based on the run time before doing step 14.

  14. Click SCHEDULE/RUN and create a schedule in the [Kronos] Worker Status - Batch [Workspace ONE] row to sync working status data of workers from the Kronos time keeping system.
    Workspace ONE Experience Workflows scheduling page for Kronos
    1. Click SCHEDULE and then click Add a schedule.
    2. Select the days and time to run the process. The frequency will depend on your deployment size, the number of users, and how long each sync takes.
    3. Click Save.

    You do not schedule [Workspace ONE] Worker Status - Listener [Kronos] as it is a listener process that automatically runs when an action is taken in the Kronos Punch Clocking In and Out service.

What to do next

Go to the Hub Services Templates page to restrict access to specific tabs in the Workspace ONE Intelligent Hub and Hub portal. See How to Restrict Access to Specific Features in Workspace ONE Intelligent Hub When Users are Off Shift.