Installation Planning Guide

Guide to Planning a
Workforce Central ®
Installation
A guide to the requirements and features of the installation

process for Workforce Central products, including Workforce
Timekeeper and Workforce HR/Payroll.
Kronos Workforce Central Suite

Version 6
Document Part Number: 4704223-001

Document Revision: A
The information in this document is subject to change without notice and should not be construed as a commitment
by Kronos Incorporated. Kronos Incorporated assumes no responsibility for any errors that may appear in this
manual. This document or any part thereof may not be reproduced in any form without the written permission of
Kronos Incorporated. All rights reserved. Copyright 2009.
Altitude, Altitude Dream, Cambridge Clock, CardSaver, Datakeeper, Datakeeper Central, eForce, Gatekeeper,
Gatekeeper Central, Imagekeeper, Jobkeeper Central, Keep.Trac, Kronos, Kronos Touch ID, the Kronos logo, My
Genies, PeoplePlanner, PeoplePlanner & Design, Schedule Manager & Design, ShiftLogic, ShopTrac, ShopTrac
Pro, StarComm, StarPort, StarSaver, StarTimer, TeleTime, Timekeeper, Timekeeper Central, TimeMaker, Unicru,
Visionware, Workforce Accruals, Workforce Central, Workforce Decisions, Workforce Express, Workforce Genie,
and Workforce TeleTime are registered trademarks of Kronos Incorporated or a related company. Altitude MPP,
Altitude MPPXpress, Altitude Pairing, Altitude PBS, Comm.Mgr, CommLink, DKC/Datalink, eDiagnostics, Experts at
Improving the Performance of People and Business, FasTrack, Hireport, HR and Payroll Answerforce, HyperFind,
Kronos 4500 Touch ID, Kronos 4500, Kronos 4510, Kronos Acquisition, Kronos e-Central, Kronos KnowledgePass,
Kronos TechKnowledgy, KronosWorks, KVC OnDemand, Labor Plus, Momentum Essentials, Momentum Online,
Momentum, MPPXpress, Overall Labor Effectiveness, Schedule Assistant, Smart Scheduler, Smart View, Start
Quality, Start WIP, Starter Series, StartLabor, Timekeeper Decisions, Timekeeper Web, VisionPlus, Winstar Elite,
WIP Plus, Workforce Acquisition, Workforce Activities, Workforce Analytics, Workforce Attendance, Workforce
Central Portal, Workforce Connect, Workforce Employee, Workforce Forecast Manager, Workforce HR, Workforce
Leave, Workforce Manager, Workforce MobileTime, Workforce Operations Planner, Workforce Payroll, Workforce
Record Manager, Workforce Recruiter, Workforce Scheduler, Workforce Smart Scheduler, Workforce Tax Filing,
Workforce Timekeeper, Workforce View, and Workforce Worksheet are trademarks of Kronos Incorporated or a
related company.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://
www.openssl.org). This product includes software written by Eric Young (eay@cryptsoft.com).
Mozilla.org is a registered trademark of the Mozilla Foundation. All other trademarks or registered trademarks used
herein are the property of their respective owners and are used for identification purposes only.
When using and applying the information generated by Kronos products, customers should ensure that they comply
with the applicable requirements of federal and state law, such as the Fair Labor Standards Act. Nothing in this
Guide shall be construed as an assurance or guaranty that Kronos products comply with any such laws.
Published by Kronos Incorporated

297 Billerica Road, Chelmsford, Massachusetts 01824-4119 USA
Phone: 978-250-9800, Fax: 978-367-5900
Kronos Incorporated Global Support: 1-800-394-HELP (1-800-394-4357)
For links to information about international subsidiaries of Kronos Incorporated, go to

http://www.kronos.com
Document Revision History
Document Revision Product Version Release Date
A Workforce Central 6.1 January 2009

Contents
About This Guide

Organization of this guide ........................................................................... 10
Using the Workforce Central installation documentation ........................... 11
Chapter 1: About Workforce Central

Suite products .............................................................................................. 16
Suite system requirements ........................................................................... 18
VMware support .......................................................................................... 19
Hardware and software requirements ................................................... 19
Workforce Central products supported ................................................. 20
Workforce Central architecture ................................................................... 21
Client software ...................................................................................... 21
Workforce Central platform and applications ....................................... 22
Platform components....................................................................... 22
Workforce Central applications....................................................... 22
Database ................................................................................................ 23
Interapplication communication ........................................................... 23
Database support ......................................................................................... 25
Disk allocation ...................................................................................... 25
RAID considerations ....................................................................... 26
Multiple instances of Workforce Central products ...................................... 28
Configuration Manager ......................................................................... 29
Using Configuration Manager .............................................................. 30
General functionality ........................................................................... 30
Reports ......................................................................................................... 33
Contents
Chapter 2: Workforce Timekeeper and other Labor and Scheduling

products
System requirements ....................................................................................37
Client software requirements .................................................................38
Application software system requirements ...........................................40
Database system requirements ..............................................................41
Workforce Central Portal system requirements .....................................43
Workforce Worksheet system requirements .........................................44
Network requirements ...........................................................................45
Active Directory ....................................................................................46
Authentication .......................................................................................46
Citrix MetaFrame support .....................................................................46
Java 1.6 ..................................................................................................47
Database options ..........................................................................................48
Database Manager ................................................................................48
Oracle considerations ............................................................................51
Oracle initialization parameters .......................................................51
Using multiple schemas ...................................................................52
SQL Server considerations ....................................................................54
Workforce Timekeeper installation requirements ........................................55
Operating system options ......................................................................55
Application server options .....................................................................55
Web server options ................................................................................56
Apache web server...........................................................................56
Microsoft IIS web server (Windows Only) .....................................57
Configuration options ..................................................................................58
Typical and custom environment options ....................................................59
Typical server environment option ........................................................59
Custom server environment option .......................................................61
Installing Workforce Central products .........................................................62
Workforce Timekeeper deployment .............................................................65
Installation phase ...................................................................................65
Configuration phase ...............................................................................66
4 Kronos Incorporated
Contents
Reports ......................................................................................................... 70
Basic reporting ...................................................................................... 70
Advanced reporting ............................................................................... 70
Prerequisites .................................................................................... 71
Custom security extension............................................................... 72
Using advanced reporting................................................................ 72
Custom reports ...................................................................................... 73
Using Business Objects ................................................................... 73
Language support ........................................................................................ 75
Service packs ............................................................................................... 76
Load balancing ........................................................................................... 78
Background Processor ................................................................................. 79
Sample configurations ................................................................................. 81
Workforce Timekeeper with no separation or multiple instances ........ 81
No separation, two instances ................................................................. 82
Separation, no multiple instances ......................................................... 84
Separation, two instances ...................................................................... 85
Dedicating machines to certain functions .................................................... 87
Chapter 3: Workforce HR/Payroll

Overview ..................................................................................................... 90
System requirements ................................................................................... 91
Reporting ..................................................................................................... 95
Workforce HR/Payroll Solution Manager ................................................... 96
Multiple instances in a Workforce HR/Payroll environment ...................... 99
Chapter 4: Combined Workforce Timekeeper and Workforce HR/Payroll

installation
Workforce Central platform in an integrated environment ....................... 102
Requirements for a combined environment .............................................. 103
System requirements ................................................................................. 104
Integrating Workforce HR/Payroll and Workforce Timekeeper ............... 105
Guide to Planning a Workforce Central Installation 5

Contents
Data synchronization ..................................................................................107

Scope of data synchronization .............................................................107
Terminology ........................................................................................108
Employee personal data .......................................................................108
Licenses, profiles, roles, and primary accounts ...................................109
Jobs and organizations .........................................................................110
Skills and certifications .......................................................................112
Synchronization processor ...................................................................112
Queue assistants ...................................................................................113
System Queue Assistant.................................................................114
Employee Queue Assistant ............................................................114
Synchronizing data .....................................................................................115
Chapter 5: Licensing Workforce Central products

Required licenses .......................................................................................118
Upgrading from v5.2 ...........................................................................118
Upgrading from v6.0 ...........................................................................119
Types of licenses ........................................................................................120
Suite product licenses ..........................................................................120
Suite interaction licenses .....................................................................121
Licensing process .......................................................................................122
Licensing Workforce Timekeeper ..............................................................124
Licensing Workforce HR/Payroll ..............................................................126
Suite license interaction .............................................................................127
Chapter 6: SSL security considerations

Implementing SSL with Workforce Central ..............................................130
General considerations ...............................................................................131
SSL secured data paths ..............................................................................132
Certificates, keys, and credential stores .....................................................133
Certificates ...........................................................................................134
Credential stores and keys ...................................................................135
SSL and Workforce HR/Payroll ................................................................136
SSL and Workforce Timekeeper ................................................................137
Configuring Workforce Central to use an SSL terminator .........................138
Contents
Chapter 7: Preinstallation requirements and checklists

Preinstallation requirements ...................................................................... 142
Workforce HR/Payroll ........................................................................ 142
Workforce Timekeeper ........................................................................ 143
Preinstallation worksheets ......................................................................... 145
Workforce HR/Payroll preinstallation worksheet ............................... 146
Workforce Timekeeper installation worksheet ................................... 148
Index

Contents
About This Guide
The Kronos® Workforce Central® suite is a comprehensive solution for managing

every phase of the employee relationship—staffing, developing, deploying,
tracking, and rewarding. It consists of a number of separate, yet tightly integrated
applications that are both extensible and unified to provide a centralized data
repository and flexible self-service capabilities.
Most Workforce Central products use a common software architecture platform.
When you install your first Workforce Central base product (Workforce
Timekeeper or Workforce HR/Payroll), the installation program delivers this
common platform.
This document describes the system requirements and background information
that you need to know before you install any Workforce Central v6.1 products.
Workforce Central v6.1 supports different operating environments, application
servers, and web servers, all configured in a number of different ways. Planning
your Workforce Central v6.1 environment is important to a successful installation.
About This Guide
Organization of this guide

This book consists of the following chapters:
• Chapter 1, “About Workforce Central,” on page 15
• Chapter 2, “Workforce Timekeeper and other Labor and Scheduling
products,” on page 35
• Chapter 3, “Workforce HR/Payroll,” on page 89
• Chapter 4, “Combined Workforce Timekeeper and Workforce HR/Payroll
installation,” on page 101
• Chapter 5, “Licensing Workforce Central products,” on page 117
• Chapter 6, “SSL security considerations,” on page 129
• Chapter 7, “Preinstallation requirements and checklists,” on page 141
Using the Workforce Central installation documentation

You should review the content of this document before you install any Workforce
Central products, paying particular attention to the chapters about the base
products that you are installing or upgrading—Workforce Timekeeper, Workforce
HR/Payroll, or both.
You can download the instructions for installing or upgrading Workforce
Timekeeper, Workforce HR/Payroll, and other Workforce Central products from
the Kronos web site. Depending on the product or combination of products you
are installing, select the applicable installation or upgrade scenario from the
following books:
Caution: Each scenario consists of step-by-step instructions. Although it may be

possible to install the desired products in an order that is different from the
documentation, the order presented in the scenarios has been tested. This is
especially important in integrated environments that contain Workforce
Timekeeper and Workforce HR/Payroll, where the platform and single database
may need to be built in a specific order.
• Installing Workforce HR/Payroll describes how to install Workforce HR v6.1

and Workforce Payroll v6.1 on a machine that does not include Workforce
Timekeeper or an earlier version of Workforce HR/Payroll.
• Installing Workforce Timekeeper describes how to install Workforce
Timekeeper on a Windows machine that does not include Workforce HR/
Payroll or an earlier version of Workforce Timekeeper.
This book includes instructions for installing Workforce Scheduler,
Workforce Forecast Manager, Workforce Operations Planner, Workforce
Leave, Workforce Attendance, Workforce Activities, Workforce Device
Manager, Workforce Integration Manager, Process Designer, and Interface
Designer.
• Upgrading Workforce HR/Payroll describes how to upgrade to Workforce
HR/Payroll v6.1 on a machine that has Workforce HR/Payroll v5.2 or v6.0
installed.
11
About This Guide
• Upgrading Workforce Timekeeper describes how to upgrade Workforce

Timekeeper v5.2 or v6.0 to Workforce Timekeeper v6.1 on a Windows
machine that does not include Workforce HR/Payroll.
This book includes instructions for upgrading or installing Workforce
Scheduler, Workforce Forecast Manager, Workforce Operations Planner,
Workforce Leave, Workforce Attendance, Workforce Activities, Process
Designer, and Interface Designer. It also includes instructions for upgrading:
– Data Collection Manager to Workforce Device Manager
– Workforce Connect to Workforce Integration Manager
• Installing Workforce HR/Payroll and Workforce Timekeeper describes how to
install Workforce HR/Payroll v6.1 and Workforce Timekeeper v6.1 on the
same machine, connecting to the same database.
Designer.
• Upgrading Workforce Timekeeper and Installing Workforce HR/Payroll
describes how to upgrade Workforce Timekeeper v5.2 or v6.0 to Workforce
Timekeeper v6.1, and then to install Workforce HR/Payroll v6.1 on the same
machine, connecting to the same database.
• Upgrading Workforce HR/Payroll and Installing Workforce Timekeeper
describes how to upgrade Workforce HR/Payroll v5.2 or v6.0 to Workforce
HR/Payroll v6.1 and to install Workforce Timekeeper v6.1 on the same
machine, connecting to the same database.

Designer.
• Upgrading Workforce HR/Payroll and Workforce Timekeeper describes how
to upgrade from an integrated v5.2 or v6.0 installation of Workforce HR/
Payroll and Workforce Timekeeper to v6.1.
• Installing and Upgrading Workforce Timekeeper on UNIX describes how to
install or upgrade Workforce Timekeeper on a Solaris or AIX machine.
This book also includes instructions for upgrading or installing Workforce
Workforce Leave, Workforce Attendance, Workforce Activities, Workforce
Device Manager, and Workforce Integration Manager.
• Workforce Central Portal Installation Guide describes how to install and
upgrade the Workforce Central Portal product for use with Microsoft
SharePoint 2007.
• Installing the Workforce Worksheet Installation Guide describes how to install
the Workforce Worksheet plug-in to generate Workforce Timekeeper
advanced reports and Workforce Genies with Microsoft Excel 2007.
• Workforce Record Manager Installation Guide describes how to install and
upgrade Workforce Record Manager.
13
About This Guide
Chapter 1
About Workforce Central
This chapter provides an overview of Workforce Central and contains the

following sections:
• “Suite products” on page 16
• “Suite system requirements” on page 18
• “VMware support” on page 19
• “Workforce Central architecture” on page 21
• “Database support” on page 25
• “Multiple instances of Workforce Central products” on page 28
• “Reports” on page 33
Note: Because Workforce Timekeeper is a prerequisite for a number of Workforce

Central product that can all be installed at the same time, references to Workforce
Timekeeper in this chapter also include Workforce Scheduler, Workforce Forecast
Manager, Workforce Operations Planner, Workforce Leave, Workforce
Attendance, Workforce Activities, Workforce Device Manager, Workforce
Integration Manager.
Chapter 1 About Workforce Central
Suite products
The Workforce Central suite contains a number products that can be organized
into the following categories.
• Time and labor products — With Workforce Timekeeper and the optional
Workforce Accruals, Workforce Attendance, Workforce Leave, and
Workforce Activities products, an industry-standard web browser is used to
record employee time, create schedules, track accruals, generate reports,
approve time, and much more.
• Scheduling products — Although Workforce Timekeeper provides basic
scheduling tools for employees who work predictable schedules, the optional
Workforce Scheduler, Workforce Forecast Manager, and Workforce
Operations Planner products provide tools for more complex scheduling
where requirements vary depending on business demand.
• Workforce HR and Workforce Payroll — These products deliver a
complete infrastructure to help organizations optimize their workforce and
enable communication and collaboration across the enterprise by streamlining
the management of the employment life cycle by web-based self-service and
reducing overhead by delivering content through a central portal.
• Workforce Central utilities — Several utilities provide functionality that is
common across the Workforce Central products. Workforce Record Manager
provides the robust functionality needed to create an optimum archiving
process. And Workforce Integration Manager and Interface Designer provide
an easy-to-use, flexible data integration tools that efficiently interfaces
Kronos products with other critical business applications.
• Data collection and self-service products — These scalable data collection
solutions focus on flexible self-service for the hourly worker, using the latest
technology, and provide for web-based configuration and communication that
is integrated into Workforce Central and interfaces with multiple other
applications. Products include Workforce Employee, Workforce Manager,
Kronos 4500 Touch ID, Workforce Device Manager, and Workforce
TeleTime.
Suite products
• Business intelligence and analysis products — Workforce Analytics is the

foundation product of all analytics products from Kronos. It extracts data
from the Workforce Central database and transforms the data into a target data
warehouse model that is designed for optimal reporting and analytics.
Additional analytics products, such as Workforce Analytics for Retail,
Workforce Analytics for Manufacturing, and Workforce Analytics for
Healthcare, build on the features and functionality delivered with the core
Workforce Analytics product.
Contact your Kronos Representative for more information about these Workforce
Central products.

Suite system requirements

Workforce Central v6.1 applications require the following infrastructure:
• Operating system — All Workforce Central applications run on Windows;
most of the products based on Workforce Timekeeper can also run on UNIX.
• Application server — Workforce Central requires a J2EE-compatible
application server. Depending on your requirements, you can have the
Workforce Timekeeper installation program install JBoss or you can use a
preinstalled version of JBoss.
Note: Workforce Timekeeper can also be installed and configured for other
types of application servers. See your Kronos Representative for more
information.
• Web server — All Workforce Central applications use Microsoft IIS web
server software. The products that are based on Workforce Timekeeper can
also use Apache (which may be installed by the Workforce Timekeeper
installation program).
• Database — All Workforce Central applications support a SQL Server
database; the products that are based on Workforce Timekeeper also support
an Oracle database.
Note: If you use both Workforce Timekeeper and Workforce HR/Payroll, you
must use a Windows system with a JBoss application server, Microsoft IIS web
server, and SQL Server database.
VMware support
VMware support
Most Workforce Central v6.1 applications can be run on VMware virtual
machines. Virtualization is a software technology that makes it possible to run
multiple operating systems and multiple applications on the same computer at the
same time, increasing the utilization and flexibility of hardware. By using
virtualization software, an IT department can transform or “virtualize” the
hardware resources of an x86-based computer—including the CPU, RAM, hard
disk, and network controller—to create several fully functional virtual machines
that can each run its own operating system and applications just like a “real”
computer.
Although VMware has a multitude of options for tuning workloads, Kronos
recommends that you keep the VMware configuration as simple as possible.
Performance testing of Workforce Central in a VMware environment obtained
optimal results when running VMware with an “out of the box” configuration,
taking default settings for system parameters and tuning options.
Important: Do not “over commit” the server resources; be sure to reserve the
CPU and memory resources required by Workforce Central so it cannot be
allocated to other virtual machines or applications.
Hardware and software requirements

Performance testing of Workforce Central in a VMware environment used the
following hardware and software. Consult your Kronos Representative for the
requirements specific to your environment.
Hardware
The following hardware represents the minimum requirement for running
Workforce Central on VMware:
• Dual-core systems based on Intel 5130 processor running at 2 GHz or greater
• Quad-core systems based on Intel 5335 processor running at 2 GHz or greater
• Dual-core systems based on AMD 2200 series processor running at 2.4 GHz

• All AMD quad-core processor systems

• 4 GB memory per processor core (depending on the number and size of the
virtual machines)
Software
• ESX Server 3.5 or 3i
Workforce Central products supported

The following products are supported on VMware ESX Server Version 3.5 or
later.
• Workforce Timekeeper
• Workforce Activities
• Workforce Attendance
• Workforce Accruals
• Workforce Leave
• Workforce Scheduler
• Workforce Forecast Manager
• Workforce Operations Planner
• Workforce Record Manager
• Workforce Integration Manager
• Workforce Device Manager
• Workforce Central Portal
• Reporting and Advanced Reporting (SSRS)
• Workforce Central database
• Workforce HR/Payroll
Note: Workforce Analytics products are not supported on VMware.
Workforce Central architecture

The Workforce Central suite is a Java 2 Enterprise Edition (J2EE) compatible set
of applications that uses a three-tier structure:
1. Client software — The client accesses a Workforce Central application
through a Web Uniform Resource Locator (URL) using a browser.
Application functions are implemented as Hypertext Markup Language
(HTML) pages or Java applets. The pages and applets connect to the web-
based Workforce Central application. The applets are downloaded via .jar
files and use a sticky cache, which means that applets are only downloaded
the first time that the client accesses the applet.
2. Workforce Central platform and applications — Contains the common
infrastructure, applications, application server, and web server.
3. Database — Stores all of the application data.
Client software
The client layer contains browsers, operating systems, a Java Runtime
Environment (JRE), and other supporting technologies (such as Adobe Acrobat
Reader).
Several Workforce Central products operate at the client level:
• Process Designer — The visual process design tool used to modify
preconfigured process templates that are included with Process Manager.
• Interface Designer — The tool used to create custom interfaces for
Workforce Integration Manager on a client machine.
• Workforce Worksheet — An Excel 2007 plug-in that enables users to
dynamically retrieve a number of Workforce Central reports and Genies using
Microsoft Excel. Any Excel worksheet created from this data can be refreshed
on demand or dynamically with live data from Workforce Central.

Workforce Central platform and applications

The middle tier of Workforce Central v6.1 provides the business logic and
connections to the back-end database. In order to make the Workforce Central
products independent, yet tightly integrated, this tier of the suite architecture
consists of three parts:
• A base platform, which consists of data, code, business logic, GUIs, and APIs
• A modular set of applications and components, installed as needed, that use
various extensibility mechanisms
• “Loosely coupled” integration technologies that connect these pieces with
each other and with third-party applications
Platform components
A set of common components is installed automatically when you install the first
base Workforce Central product (Workforce Timekeeper or Workforce HR/
Payroll). It consists of the following set of layers, from lowest to highest:
• J2EE layer — The Java runtime and J2EE application container services,
such as database connectivity, session management, servlets, and JSPs
• Kernel layer — Basic domain-independent components (logging,
persistence, etc.) and the UI, API, and extensibility frameworks
• Core business layer — Business objects essential to all Kronos ERM
applications (People, Organizations, Process Manager, and so forth) and
business objects essential to the Kronos brand (HyperFind, Genies, etc.)
• Shared business layer — Business objects shared by two or more
applications, but not universally used.
Workforce Central applications
The application layer (not part of the common platform itself), consists of major
functional areas (Workforce Timekeeper, Workforce HR/Payroll, Workforce
Scheduler, and so forth) that are installed and licensed separately and use the
platform functionality in the layers below.
The application layer of a Workforce Central installation includes:

• A web server component that contains all static content and listens for
browser requests and passes these requests to the application server.
• An application server component that contains all dynamic content and
centralizes application services such as business components and access to
back-end enterprise systems and uses technologies such as caching and
connection pooling to improve resource use and application performance.
Database
Workforce HR/Payroll and Workforce Timekeeper can use a single Workforce
Central database.
• When only Workforce Timekeeper is installed, this database—which can be
SQL Server or Oracle—contains the Workforce Timekeeper and platform
tables. The Workforce HR/Payroll tables and application are not present.
• When only Workforce HR/Payroll is installed, the Workforce Central
database—which must be SQL Server—contains the Workforce HR/Payroll
tables, and also all the Workforce Timekeeper and platform tables (although
the Workforce Timekeeper tables are not used).
• When both Workforce HR/Payroll and Workforce Timekeeper are installed,
the schemas exist side-by-side in the database. Because Workforce HR/
Payroll only supports SQL Server, Oracle is not supported for combined
installations.
Interapplication communication
A complete installation of the Workforce Central suite includes many separate
components that need to communicate with each other. Depending on the
component, the following types of communication are used:
• Database access (by JDBC) — Database access is the most straightforward
way for components to communicate. Each application is configured when it
is installed with the location of its database.
• Java RMI — The Process Manager engine is the only component to use
RMI. Process Manager RMI is managed completely by the Process Manager

engine, which locates other servers in its cluster from database tables in the
Process Manager schema.
• XML APIs (using the HTTP protocol) — For XML APIs, the caller needs
to identify the location of the target (web server or application server).
• Common logon handshaking — Workforce HR/Payroll uses common logon
handshaking to communicate with the platform using HTTP. For the common
logon handshaking, each application needs to identify the other to log on and
maintain sessions between the two web servers. Properties files (configured
when Workforce HR/Payroll is installed) store the locations and protocols for
the two servers.
• Workforce HR/Payroll private web service — The Workforce HR/Payroll
private web service is called by the platform when processing XML API
requests implemented by Workforce HR/Payroll .NET business objects. The
platform identifies the Workforce HR/Payroll server by using the same
properties used by common logon.
• Cookies — A cookie is a small piece of information, often no more than a
short session identifier, that the server sends to the browser when the browser
connects for the first time.
Workforce Timekeeper relies on cookies for session management. It uses
cookies to track the user session ID and a Boolean logoff flag. The cookies are
strictly session cookies and are not persistent, which means that they are not
stored on the user’s system. A cookie is simply loaded into the browser’s
cache and is active only as long as the session is active. After the user logs off,
the cookie is gone.
Workforce Timekeeper cookies are not encrypted in any way. There is
currently no other encryption of logon information, cookies, or other data,
outside of an Secure Socket Layer (SSL) installation. If it is necessary to have
any HTTP request or response information encrypted during transmission,
you should implement SSL with the Workforce Timekeeper installation.
If cookies are disabled, you can log on to Workforce Timekeeper, but the
default Genie will not load and the following error message will be generated:
Cannot retrieve data from server.
To avoid this problem, ensure that cookies are enabled in your browser.
Database support
Database support
Workforce Central v6.1 uses Unicode-compliant SQL Server and Oracle
Relational Database Management Systems (RDBMS).
Unicode is an industry standard that was designed to allow text and symbols from
all the writing systems of the world to be consistently represented and
manipulated by computers. The Unicode Standard includes character properties
that enable Kronos databases to convert existing non-Unicode text characters to
multibyte characters that are used in any major language text.
The database installation and upgrade procedures are not affected by the use of the
Unicode multibyte characters.
The following table lists the Kronos database documentation data type labels:
Unicode Data Types Non-Unicode Data Types

SQL
• nChar • Char
• nVarChar • VarChar
• nText
Oracle
• nChar • Char
• nVarChar2 • VarChar2
• NCLOB
Disk allocation
With Workforce Timekeeper v6.1, you can specify the file groups that are needed
for the installation or you can use RAID (Redundant Array of Independent Disks).
• RAID storage — Your specific RAID implementation will determine how to
allocate the required tablespaces.
• Non-RAID disk allocation — If you are not using RAID, Kronos
recommends that you use at least nine disks when installing a Workforce
Timekeeper database. Assign file groups tkcs1–tkcs9 to each disk.

Refer to Installing Workforce Timekeeper for more information.
RAID considerations
RAID (Redundant Array of Independent Disks) technology combines two or more

physical hard disks into a single logical unit. Although many RAID
implementations are available, Kronos recommends using hardware level RAID
storage or SAN disk storage with production quality drives.
The following lists some sample RAID configurations for varying sized
installations. See your Kronos Representative for recommendations specific to
your environment.
• Small installation (fewer than 5,000 employees)
– A hardware RAID controller with at least three drives for the database
storage. (Disk I/O performance improves as the number of disks
increases.)
– A logical drive created as a RAID partition with the available drives
should be used for all the tablespaces in Oracle and file groups in SQL
Server.
• Medium installations (5,000–20,000 employees)
– One or more hardware RAID controllers with five or more disk drives for
database storage. (Disk I/O performance improves as the number of disks
increases.)
Server.
– SAN storage also may be used for database disk storage. (With SAN, disk
I/O performance improves as the number of disks increases.)
– Log files should be located on logical units (LUNs) that are separate from
the data LUNs.
Database support
• Large installations (more than 20,000 employees)

– One or more hardware RAID controllers with seven or more disk drives
for database storage. (Disk I/O performance improves as the number of
disks increases.)
Server.
– SAN storage also may be used for database disk storage. (With SAN, disk
I/O performance improves as the number of disks increases.)
– Log files should be located on drives that are separate from the data.
– Log files should be located on logical units (LUNs) that are separate from
the data LUNs.

Multiple instances of Workforce Central products

Depending on the Kronos products that you purchased as well as a number of
other factors, Kronos provides hardware recommendations that are specific to
your environment to accommodate the anticipated load on the system. These
recommendations may include installing more than one instance of your
Workforce Central products. These instances can be installed on different physical
machines or the same physical machine.
Refer to your Hardware Recommendation Report or contact your Kronos
Representative for guidelines specific to your environment.
Multiple instances of Workforce Central products that connect to the same
database must include the same Workforce Central products and service packs.
This is true whether they are installed on separate machines or on the same
machine. For example, you cannot install Workforce Timekeeper and Workforce
HR/Payroll on one instance and Workforce Timekeeper and Workforce Scheduler
on another instance if all instances use the same database. Likewise, you cannot
install a service pack only on one instance.
Note: Dedicated Background Processor machines that are created by the

Workforce Timekeeper installation program, however, do not need to include the
same set of Workforce Central products as other machines in your environment.
The only exception to this is that if you use Workforce Activities, it must be
installed on the Background Processor machine as well as all other machines in
the Workforce Central environment.
If you have multiple instances of Workforce Central products that connect to

different databases, each instance can include different products and service
packs.
Configuration Manager
Configuration Manager, which is delivered when you install Workforce
Timekeeper or Workforce HR/Payroll v6.1, is used to create, modify, and remove
multiple instances of Workforce Central products running on the same physical
server:
• Each instance is independent and does not share code or temporary files.
• Each instance has its own runtime directory area for storing objects such as
custom properties files, log files, reports, localized strings, and so forth.
• Each instance must run with the same version of third-party software.
The Workforce Timekeeper or Workforce HR/Payroll installation program creates
the first instance of Workforce Central. By default, this instance is named wfc.
You cannot rename this instance.
After the wfc instance is created, you can use Configuration Manager to create a
new instance, modify an instance, or delete an instance (including the wfc
instance). You can name new instances anything (maximum 50 characters).
Typically, Configuration Manager is used to support:
• Multiple databases — You can install several instances of Workforce Central
products running on the same physical server, but each instance is connected
to a separate database. Typically, you use this configuration when separate
instances and databases are required for training, testing, and production.
• Multiple languages — You can install multiple instances of Workforce
Timekeeper on the same physical server with each instance supporting a
different language. All instances can point to the same database. Refer to
“Language support” on page 75 for more information about non-English
languages. Workforce HR/Payroll does not support multiple languages.
• Multiple versions — You can run different service packs on different
instances provided they point to different databases (Report constraint).
In an integrated Workforce HR/Payroll-Workforce Timekeeper environment,
Configuration Manager is typically used to support multiple databases.

Using Configuration Manager

When you create an instance, Configuration Manager lists the products that are
installed in the wfc instance. When you modify an instance, Configuration
Manager lists the products that are installed on the instance that you plan to
modify. In either case, you can add or remove products from this list.
You cannot, however, remove products that are prerequisites for other products
nor can you add products that require products that are not installed. For example,
you cannot remove Workforce Timekeeper from the following instance because it
is a prerequisite for Workforce Scheduler, Workforce Attendance, Workforce
Leave, and Workforce Activities.
Gray text indicates that these

are prerequisites to other
products listed. You cannot
select these until all
prerequisites are cleared.
General functionality
Guidelines to consider before installing multiple instances of Workforce Central
include the following:
• Instances do not share static application resources. Static resources are served
by the web server and include Help files, images, HTML pages, JavaScript
files, client .jar files, JRE plug-in, and so forth. Each instance must have its
own complete copy of all static resources.
This means that if the web server is on a machine that is separate from the
application server and you create a second instance on the application server,
you must also create a second instance on the web server.
• Each instance can be configured separately and independently by established
configuration mechanisms such as System Settings and custom properties
files.
• Multiple instances can run concurrently. That means that user A can log on to
instance 1 at the same time that user B logs on to instance 2. Kronos does not,
however, support multiple browsers that are open on the same physical
machine.
• Each instance of Workforce Timekeeper can support a different language. The
only restriction is that all languages must use the same code page when the
instances are running concurrently, because only one code page can be used
by an application server at the same time.
• All instances connected to the same database must have the same product set
installed. If you want to install different products on different instances, each
instance must connect to a separate database.
• Users connect to each Workforce Central instance by a unique URL. For
example, to log on to an English version of Workforce Timekeeper, the user
enters the default logon in the browser:
http://server/wfc/logon
To log on to a French version, the user enters the name that was applied when
the second instance was created, for example:
http://server/french/logon
• You cannot install multiple instances to different locations in the file system.
For example, you cannot install one instance of Workforce Central to c:/
kronos/wfc and another to d:/kronos/wfc. All instances must be
installed under the initial Kronos installation directory—c:/kronos.

Licensing multiple instances

Each instance of Workforce Central requires separate license files and all
instances that connect to the same database must include the same set of license
files. License files are stored in the Kronos\instance_name\licensing
folder, for example Kronos\wfc\licensing.
If you create a new instance that points to a different database, you must obtain a
new license from Kronos.
Important: Licenses are assigned per employee. Each employee that uses the
Workforce Central system must have a valid employee license for each product
that the employee uses.
Database functionality
The following guidelines describe database functionality with the multiple
instance capability:
• Different instances can point to different databases that use the same database
platform. For example, instance 1 may point at SQL Server database “fred”
and instance 2 at SQL Server database “mildred.”
• Different instances can point to databases that use the same database platform,
but are installed on different database servers. For example, instance 1 can
point at SQL Server database “fred” on server 1 and instance 2 at database
“fred” on server 2. The database servers must be at the same version.
• Different instances cannot point to different database platforms. For example,
instance 1 cannot point to a SQL Server database, and instance 2 to an Oracle
database.
Reports
Reports
The reporting functionality of Workforce Timekeeper v6.1 is based on the report
definition language (RDL), which is an XML schema from Microsoft for
representing reports. Workforce Timekeeper no longer supports Crystal reports.
Workforce HR/Payroll uses Crystal reports as its reporting mechanism and does
not use RDL or SSRS functionality.
For more information about the Workforce Timekeeper reporting functionality,
refer to “Reports” on page 70.

Chapter 2
Workforce Timekeeper and other Labor and
Scheduling products

Workforce Timekeeper can be installed with a variety of configurations, operating

systems, and underlying software. Therefore, it is important that you plan your
environment before you start installing any products.
The following sections of this document describe the various installation options
and requirements:
• “System requirements” on page 37
• “Database options” on page 48
• “Workforce Timekeeper installation requirements” on page 55
• “Configuration options” on page 58
• “Typical and custom environment options” on page 59
• “Workforce Timekeeper deployment” on page 65
• “Reports” on page 70
• “Language support” on page 75
• “Service packs” on page 76
• “Load balancing” on page 78
Chapter 2 Workforce Timekeeper and other Labor and Scheduling products
• “Background Processor” on page 79

• “Sample configurations” on page 81
• “Dedicating machines to certain functions” on page 87
System requirements
System requirements
This section describes the client, application, database, and network requirements
for Workforce Timekeeper and other Workforce Central products.
• “Client software requirements” on page 38
• “Application software system requirements” on page 40
• “Database system requirements” on page 41
• “Workforce Central Portal system requirements” on page 43
• “Network requirements” on page 45
• “Active Directory” on page 46
• “Authentication” on page 46
• “Citrix MetaFrame support” on page 46
• “Java 1.6” on page 47
Note: Earlier versions of Workforce Timekeeper used the term application server
to describe the entire Workforce Timekeeper application, which included third-
party application server software and web server software, all installed on one
machine. Although Workforce Timekeeper v6.1 continues to support this
configuration, it also allows you to install the application server and web server
software on separate machines as well as to install multiple instances of the
application on the same machine.
Therefore, in Workforce Timekeeper v6.1, the term application server is only

used in reference to the J2EE application server software—not the Workforce
Timekeeper application.
37
Client software requirements

The client layer of the Time & Labor and Scheduling products contains browsers,
operating systems, a Java Runtime Environment (JRE), and other supporting
technologies.
All Time & Attendance and Scheduling products have a Java user interface. For
less demanding system requirements, Workforce Timekeeper can optionally be
run with an HTML user interface.
Client software requirements
Item Requirement
Operating system • Microsoft Windows Server 2003 (32-bit), service pack 1 — Standard,
Enterprise, Datacenter, Small Business Server Editions1
• Microsoft Windows Server 2003 (32-bit) R2 — Standard, Enterprise,
Datacenter, Small Business Server Editions1
• Microsoft Windows Server 2008
• Microsoft Windows XP with service pack 21
• Microsoft Windows Vista1
Browser support • Microsoft Internet Explorer 6.x, 7.0 (service pack 2 required for Windows
XP and 32-bit Windows Server 2003)
• Mozilla Firefox 2.0+ (service pack 2 required for Windows XP and 32-bit
Windows Server 2003)
JRE support Sun JRE 1.6.0_07 — ships with Workforce Timekeeper
Processor Recommended: 1.0 GHz or better Intel Pentium III
(Intel Pentium)2 Minimum requirements:
• Windows XP: 333 MHz
• Windows Vista: 1 GHz
RAM3 • Windows XP machines: 256 MHz (minimum)
• Windows Vista machines: 512 MHz (minimum)
Hard disk space • Recommended: 10 GB
• Minimum: 1.5 GB
System requirements
Item Requirement
Display resolution Java Client HTML Client
and colors
• 1024 x 768, 16-bit resolution Optimized for:
(recommended) • 800 x 600 or
• 800 x 600 with scroll bars (minimum) 640 x 480 with scroll bars
Note: The browser window must be • 256 colors; 16 colors are
maximized and no more than three rows of supported but the colors may
stacked browser toolbars should be visible in not be ideal
order to make all functions in the applets
usable.
Adobe Acrobat Adobe Acrobat Reader v6.0 Adobe Acrobat Reader v6.0.
Reader For Mac OS, may need to be set
up as default application.
Network bandwidth • 56K dial-up or Frame relay 56K 56K dial-up or Frame relay
(minimum)
• Fractional T1 or T1–T3 (recommended)
Other Java Client HTML Client
requirements • CD-ROM reader (or access to one on the
network)
• Network card
• Non-persistent (session) cookies enabled
• JavaScript enabled
• Pop-up-blocking software configured to
enable the Workforce Timekeeper server
to show pop-up windows
1. Workforce Central automatically supports security and bug service packs specific to these operating systems.
No new Workforce Central release is necessary to support these updates.
2. When selecting processor speed, consider the processor recommended for the operating system and hardware
that are used.
3. If you need to move or copy and paste an organization map that is on the order of 30,000 nodes or more, Kronos
recommends at least 512 MB of real memory and 256 MB of virtual memory.
39
Application software system requirements

Workforce Timekeeper consists of application server, web server, and database
components. These components can be installed on the same machine or different
components can be installed on separate machines.
For example, you might install Workforce Timekeeper and application server on
two machines inside a firewall: one primary and one backup. You might also have
another machine with Workforce Timekeeper and application server software
within the firewall for generating reports and one web server machine outside the
firewall.
Actual hardware requirements for the Workforce Timekeeper applications are
based on many variables, including the number of employees and users at a
company. For Kronos recommendations specific to your environment, refer to
your Hardware Recommendation Report and your Kronos Representative.
System requirements for the Workforce Timekeeper application server and web
server are outlined in the following table.
Note: Server names must not include nonstandard characters, such as an

underscore. If a server name contains a nonstandard character, Process Manager
may fail.
Workforce Timekeeper system requirements
Item Requirement
Operating system1 • Microsoft Windows Server 2003 (32-bit), service pack 1 —
(for both application Standard, Enterprise, Datacenter, Small Business Server
and web server Editions
machines) • Microsoft Windows Server 2003 (32-bit) R2 — Standard,
Enterprise, Datacenter, Small Business Server Editions
• Microsoft Windows Server 2008
• Sun Solaris (SPARC) (32-bit and 64-bit) v10
• IBM AIX (pSeries) (32-bit and 64-bit) v5.3, v6.1‘
Application server • Red Hat JBoss AS 4.3
Network protocol • TCP/IP
Web server • Microsoft IIS 6.0 (Windows Server 2003), Microsoft IIS 7.0
software (HTTP (Windows Server 2008)2
daemon) • Apache 2.2.2
System requirements
Item Requirement
Server-side JRE • Microsoft Windows: Sun JRE 6.0 (1.6.0_07 provided)3
support (bundled • Sun Solaris: Sun JRE 6.0 (1.6.0_07 provided)3
with JBoss • IBM AIX: J2RE 1.6.0 IBM J9 SR2
installations)
1. Workforce Central automatically supports security and bug service packs specific to these
operating systems. No new Workforce Central release is necessary to support these updates.the
2. When using Internet Information Server (IIS) as the web server, the Workforce Central installer
automatically detects the Windows operating system version and applies the correct
configuration scripts for IIS. IIS versions are explicitly paired to the Windows operating system
versions. For example, IIS 7 can only be used in conjunction with Windows Server 2008.
3. Later versions in the 1.6.0 family can be used
Note: If you are using the Advanced Reporting capabilities of Workforce

Timekeeper, refer to “Reports” on page 70 for specific prerequisites and other
considerations.
Database system requirements

The Workforce Timekeeper software requires an Oracle or Microsoft SQL Server
database. General requirements and considerations include the following:
• Installation machine — Oracle databases cannot be on the same machine as
other Workforce Timekeeper components. Although you can install
Workforce Timekeeper on the same machine as a SQL Server database, you
should consider installing it on a separate machine, especially if the database
is large.
• Code pages — Because Workforce Timekeeper v6.1 supports Unicode
character encoding, multiple instances of most languages can coexist on a
single database without regard to code page (such as Latin 1, Latin 2, or Latin
9).
• Bidirectional character sets — Workforce Timekeeper does not support
bidirectional character sets, such as Hebrew and Arabic.
• Multibyte character support — All databases support multibyte characters
for any character set outside of Latin 1, Latin 2, and Latin 9, including
multibyte characters (such as Chinese, Japanese, and Korean).
41
Database system requirements
Item Requirement
1
Operating system • Microsoft Windows Server 2003 (32-bit), service pack 1 —
Standard, Enterprise, Datacenter, Small Business Server
Editions
• Microsoft Windows Server 2003 (64-bit)2
• Microsoft Windows Server 2003 (32-bit) R2 — Standard,
• Microsoft Windows Server 2008 (32-bit and 64-bit)
• Sun Solaris (32-bit and 64-bit)
• IBM AIX 64-bit
• HP-UX 64-bit
• All other operating systems supported by Oracle.
RDBMS • SQL Server 2005, service pack 23 or SQL Server 2008
• Oracle 10g Rel 2 (10.2.0.1) or Oracle 11g (11.1.0) Enterprise or
Standard Editions
Character set output • Multibyte characters
Network protocol • TCP/IP
1. Workforce Central automatically supports security and bug service packs specific to these
operating systems. No new Workforce Central release is necessary to support these updates.
2. Database only, Workforce Central must be installed on a separate Windows server running a 32-
bit version of Windows.
3. Workforce Analytics supports SQL Server 2005 only.
Note: All RDBMS and middleware versions identified in this chapter represent
the minimum versions supported, including minor revisions. Supported
middleware is subject to change by the vendor.
Disk space requirements

Many variables determine disk space requirements for the Workforce Timekeeper
database server. Refer to your Hardware Recommendation Report and your
Kronos Service Representative about ongoing space usage guidelines for your
specific environment.
System requirements
Machine time
Workforce Timekeeper has the option of using the machine time on the database
server to compute Time Stamp and other time-related values on the Workforce
Timekeeper application server. When this option is enabled, you should make
every effort to keep the time on the database server as accurate as possible.
After you install Workforce Timekeeper, you can access this option in the Clock
Synchronization section of the Workforce Timekeeper System Settings as follows:
1. From the upper-right corner of the Workforce Timekeeper workspace, click
Setup, and then select System Settings from the System Configuration box.
2. From the System Settings workspace, click the Clock Synchronize tab.
Note that making major changes to the time on the database server may cause
unpredictable behavior in various parts of Workforce Timekeeper, especially if
those changes are made just before, during, or after periods of heavy activity. For
this reason, Kronos recommends that you make frequent, small adjustments to the
date/time on your database server and not allow it to stray drastically from the true
time.
When drastic changes are required and the Clock Synchronize option is enabled,
Kronos recommends that you restart the clock synchronize daemon by selecting
the Threads tab in the System Settings. This immediately resynchronizes the
Workforce Timekeeper application server time-relative values to the time of the
database server.
Workforce Central Portal system requirements

The Workforce Central Portal for Microsoft® SharePoint 2007 organizes data
from a Workforce Central system and displays it in a way that is easy for
managers to read. To accomplish this, the Portal uses a set of preconfigured web
43
parts, which are modular components used within the SharePoint site to display
information.
Workforce Central Portal requires the following:
• Kronos products (depending on the web parts you are deploying)
– Workforce Central v6.0 or higher
– For Healthcare Web Parts: Workforce Scheduler
– For Retail Web Parts: Workforce Forecast Manager
– For Manufacturing Web Parts: Workforce Activities
• Microsoft software components:
– Microsoft Windows 2003 Server, Microsoft Windows 2008 Server
– Microsoft Internet Information Server (IIS) 6.0, 7.0
– .NET Framework 3.0
– Microsoft Windows SharePoint Services 3.0 or
Microsoft SharePoint Portal Server 2007
– Microsoft Office Web Components (OWC), owc11.exe
For more information, refer to the Workforce Central Portal Installation Guide.
Workforce Worksheet system requirements

If you use the advanced reporting (SSRS) option, you can take advantage of
Workforce Worksheet, which enables you to dynamically retrieve a number of
Workforce Central reports and Genies using Microsoft Excel 2008.
Setting up an environment for Workforce Worksheet requires both client and
server activities: You must install Workforce Worksheet on applicable client
machines and you must prepare the server so that Workforce Worksheet can
connect to Workforce Central.
System requirements for Workforce Worksheet, which is installed on a client
machine include the following:
• Microsoft .NET Framework version 2.0 (or higher)
• Microsoft Office Excel 2007
System requirements
• Microsoft Visual Studio 2005 Tools for Office Second Edition runtime
(VSTOR 2005 SE), build 8.0.50272.891 (x86) (vstor.exe)
This package can be downloaded from the Microsoft web site.
• 2007 Microsoft Office System Update: Redistributable Primary Interop
Assemblies (PrimaryInteropAssembly.exe) (requires Microsoft
Office product to be installed)
This package can be downloaded from the Microsoft web site.
Note: You do not need to install this package if you installed the .NET
framework before you installed Microsoft Office 2007. The Microsoft Office
2007 installer delivers the interop assemblies by default if the computer has
the .NET Framework installed.
For more information about Workforce Worksheet, refer to Installing and

Configuring the Workforce Worksheet.
Network requirements
Workforce Timekeeper components, such as the application server and the
Background Processor, communicate with the database server over a local area
network (LAN).
Your choice of network and connecting hardware can affect the performance of
your Workforce Timekeeper system. The number of nodes on your network and
the transfer throughput are some of the external factors that can affect
performance. Each client must support Transmission Control Protocol/Internet
Protocol (TCP/IP) as a transport protocol.
Before you install your Workforce Timekeeper system, do the following:
1. Check each application server and client workstation’s physical connection to
the network.
2. Verify that each application server and client workstation supports TCP/IP. Do
this by creating a remote login session to your host server with Telnet, or by
using the ping command in Run window (Start > Run on Windows
machines) to locate the host server by its IP address.
45
3. Connect to your database server using your RDBMS SQL Query tools to
verify that each application server and client workstation can connect to the
host server, using the RDBMS client software if required.
Active Directory
Active Directory is a Microsoft service that has long been used in Windows
networks. It runs on a separate server, sometimes described as a domain
controller. It supports the NT authentication protocol (also known as NTLM) used
by Workforce Timekeeper. Active Directory also supports LDAP.
The Workforce Timekeeper application server communicates with Active
Directory using the Windows NTLM challenge/response protocol.
Authentication
Workforce Timekeeper supports the following authentication methods:
• NT authentication
• LDAP authentication — For more information, refer to Installing Workforce
Timekeeper.
• Single Sign On (SSO) — Siteminder v6, service pack 3
Citrix MetaFrame support

Workforce Timekeeper v6.1 supports Citrix MetaFrame to improve client
performance for customers who use non-Pentium or low-end Pentium client
machines. Citrix MetaFrame support also enables diskless clients to access
Workforce Timekeeper.
Support for Citrix browser-based UI
MetaFrame Version Operating System

XP Presentation Server Microsoft Windows XP
(Standard Edition, Advanced Microsoft Windows Server 2003
Edition, and Enterprise Edition) Microsoft Windows Server 2008
System requirements
Java 1.6
The Sun Java 1.6 plug-in and the Sun Java 1.6 JDK are supported for Workforce
Timekeeper 6.1. The Java plug-in is for use on the client side in conjunction with
applets deployed by Workforce Timekeeper. Earlier versions of the plug-in are not
supported for Workforce Timekeeper 6.1.
The Java 1.6 plug-in is provided with Workforce Timekeeper 6.1 as an executable
file that is downloaded to the client when a Workforce Timekeeper applet is
invoked. The use of the plug-in download is strictly associated with the Microsoft
Internet Explorer browser. The Firefox browser does not download the plug-in.
The Firefox plug-in must be downloaded and installed separately.
The Sun Java 1.6 JDK is deployed on the Workforce Timekeeper server as part of
the standard installation. All Workforce Timekeeper Java components are
compiled and built using the Sun Java 1.6 JDK. Earlier versions are not supported.
47
Database options
Workforce Timekeeper, which requires a SQL Server or Oracle database, uses a
utility called Database Manager to create or upgrade the database objects (tables,
keys, stored procedures, triggers, and so on). The following sections describe:
• “Database Manager” on page 48
• “Oracle considerations” on page 51
• “SQL Server considerations” on page 54
Database Manager
Database Manager is the Workforce Central database deployment tool. It provides
an automated means to install and upgrade the Workforce Central database
schema. Database Manager, which is accessed from an HTML web page, is used
to create, upgrade, or reconcile the Workforce Timekeeper database tables and
keys. It works with both SQL Server and Oracle databases.
Running Database Manager

Database Manager is used for new Workforce Timekeeper installations and for
upgrades. It is also used for Workforce HR/Payroll upgrades.
Database Manager does not support service packs. (A separate utility called the
Patchelizer is used for service packs.)
New installations of Workforce Timekeeper

To create a new Workforce Timekeeper database, you must do the following:
1. Create an empty database with designated Workforce Timekeeper users
(TKCSOWNER, SUPRKRON, and KRONREAD). You must also connect these
user IDs to roles within the database that are assumed to be available for the
grant scripts run by Database Manager.
2. Install Workforce Timekeeper on a Windows machine (even if you are using
Workforce Timekeeper on UNIX), an application server, and a web server and
then start Workforce Timekeeper in offline mode.
Database options
3. When Workforce Timekeeper is running in offline mode, run the Database

Manager utility on a Windows machine.:
a. Access Database Manager in a browser by entering the following URL:
http://WebServer/instance_name/DBMgrLogonServlet
where WebServer is the name of the machine where the application
server is installed and instance_name is the name of the Workforce
Timekeeper instance (such as wfc).
b. Select the components and versions to be installed and start the process.
The application server validates your selection before it starts.
Database Manager then installs the supporting scripts and control files in the
directories for that instance of the application server. They are stored by
component (Workforce Timekeeper, Workforce Scheduler,and so forth), version,
and object type (table, index, and so forth).
While Database Manager is running, it displays its current status and a progress
description in the browser. As it completes each step, it provides a completion
timestamp. All detail results are displayed in the wfc.log on the application
server machine. If necessary, it also provides SEQUENCE count repair.
Upgrading an existing Workforce Timekeeper database

To update an existing Workforce Timekeeper database, you must do the
following:
1. Upgrade Workforce Timekeeper on a Windows machine (even if you are
using Workforce Timekeeper on UNIX).
2. Start the upgraded Workforce Timekeeper in offline mode.
3. Run the Database Manager utility on a Windows machine to upgrade the
database:
a. Access Database Manager in a browser by entering the following URL:
http://WebServer/instance_name/DBMgrLogonServlet
where WebServer is the name of the machine where the application
server is installed and instance_name is the name of the Workforce
Timekeeper instance (such as wfc).
49
b. Select the components and versions to be installed and start the process.
The application server validates your selection before it starts.
SEQUENCE count repair

Database Manager reconciles the SEQUENCE counter column for each table
maintained in the SEQUENCE table against the actual maximum primary key of
those tables. In cases where the counter column is less then the maximum primary
key value for the table, it displays the anomaly along with repair SQL in the log.
In addition to reporting this, Database Manager provides an option to fix the
SEQUENCE table automatically. This executes the SQL reported in the log against
the out of SEQUENCE table rows.
Reconciliation component
Database Manager supports reconciliation of the current database configuration to
metadata supplied by each version/release of Workforce Timekeeper components.
This process starts when the installation or upgrade is finished, to validate that the
database contains what it should. You can also run this process on an ad hoc basis
by logging on to Database Manager and clicking the Reconcile option.
The results of the reconcile are written to the following log file, which is located
on the application server machine in c:\Kronos\wfc\licensing:
DBManager_timestamp.log
where timestamp is the current date and time.
Note: The same information is also collected in the wfc.log.
The log file contains all of the information generated by Database Manager as
well as each SQL statement (with timestamp) that is executed by Database
Manager. This allows you to:
• Monitor the progress of the upgrade
• Review the timestamp information of the SQL statements to identify
statements that are taking a long time to run.
Database options
Segment mapping
Previous releases of Workforce Timekeeper required a specific group of segments
to be defined in the tablespace. In Workforce Timekeeper v6.1, this is no longer
required.
With Workforce Timekeeper v6.1, you can specify the actual database segments
(tablespaces in Oracle or file groups in SQL Server). A Database Manager
mapping workspace displays the virtual segment in the installation next to a
mapping drop-down box that allows you to select where those objects should be
installed.
This means that segments defined to the application as TKCS1 could be installed
in SYSTEM (Oracle) or PRIMARY (SQL Server) if you do not want to maintain
separate segments. Generally this varies depending on whether or not you use
RAID (Redundant Array of Independent Disks).
Oracle considerations
In addition to Oracle 10g R2 databases, Workforce Timekeeper v6.1 supports
Oracle 11g databases. The JDBC driver for Oracle supports both Oracle 10gR2
and 11g. Oracle 10g R1 or earlier databases are not supported for Workforce
Timekeeper 6.1.
You should be proficient with creating and managing an Oracle instance, creating
and updating tablespaces, and managing database accounts. Consult an Oracle
database administrator’s guide if you are unfamiliar with these functions.
Oracle initialization parameters
A key to assuring optimal application performance with an Oracle platform is to

minimize the amount of physical I/O required to process a query. With this in
mind, Kronos has tested a number of parameter settings for optimal performance
of an Oracle database with Workforce Timekeeper.
The recommended Oracle initialization parameters are included in the Installing
Workforce Timekeeper and Upgrading Workforce Timekeeper books. The values
identified should be set to assure optimal performance of Workforce Timekeeper.
51
Other documented or undocumented Oracle initialization parameter settings that

are not listed in the table should be left at the default setting.
Although Workforce Timekeeper will function without setting these values, there
is no guarantee that performance will be optimal. These recommendations were
based on testing and resolution of customer escalation issues, and on internal
customer and synthetic database testing.
Using multiple schemas
A schema is an Oracle database user that has the ability to create its own objects
within a database. The Oracle RDBMS is designed for multiple schemas to exist
within a single database. Each schema can own or maintain its own objects
without knowledge of other schemas.
• In Workforce Timekeeper’s single schema model, a schema called
TKCSOWNER owns all Workforce Timekeeper tables, but the application
connects to the database as different user, SUPRKRON.
• In Workforce Timekeeper’s multi-schema model, a schema called
TKCSOWNER owns all of the tables, and the application connects to the
database as TKCSOWNER as well.
Most implementations of Workforce Timekeeper use the single schema model.
However, if you need to host data for multiple customers or maintain multiple
variations of your application data, multiple schemas can be created within one
instance.
With multiple schemas, an Oracle database instance can contain multiple users,
with each user having a distinct collection of tables, views, and other database
objects. Tables with the same name can reside in the same database instance if
different users own them. These distinct user IDs have default access to their own
objects.
The data set of a given application installation resides completely within a given
schema (set of objects owned by one user). Thus, application data sets can share
the database instance, each in separate schemas. Because of this, the maintenance
tasks of the Oracle database instance, such as table space allocation and backup/
restore, can be done once and applied uniformly for all schemas. This reduces
some of the costs associated with data management.
Database options
The use of multiple schemas is transparent to the main runtime components of the
Workforce Timekeeper application code. The application components will
connect to the correct schema indicated by the access rights of the database user
ID used.
If you are using multiple schemas, you should consider the following:
• Plan for the number of schemas required in each database instance ahead of
time and define a dedicated database owner for each schema.
• Manually create the database user IDs on the database before creating the
Workforce Timekeeper schema.
• Each schema is independent of any other schemas defined in the same
database instance and can be at different versions of Workforce Timekeeper if
required.
• Install a separate Workforce Timekeeper instance for each schema. When you
install Workforce Timekeeper, you must enter the user ID and password to
access the applicable schema. This information is maintained in encrypted
form in the configuration files of the Workforce Timekeeper instance. A
Workforce Timekeeper instance cannot access the data in any schema other
than the one defined in the instance’s configuration.
• After you create a Workforce Timekeeper instance for a specific schema, run
Database Manager once for each schema to establish the tables and other
database objects needed for the application instance.
Note: Database Manager does not recognize any schemas other than the one
owned by the user ID used to log on to the database.
• Combining currently independent databases as schemas within a new single

database instance is a manual process. You must create database user IDs as
schema owners in the new target instance, export the contents of each current
database, and import them into the schemas of the new database.
53
SQL Server considerations

SQL Server databases do not require the same level of performance tuning as
Oracle systems. Generally, SQL Server for Workforce Timekeeper is installed
with default settings.
You should, however, be proficient with creating a database, creating files, adding
file groups, and managing logins. If you are unfamiliar with these functions,
consult the SQL Server Books Online.
Before you set up the database, obtain a copy of the Hardware Recommendation
Report from your Kronos Representative. This document provides important
space usage guidelines for your specific environment.
Workforce Timekeeper installation requirements

Workforce Timekeeper can be installed in several different configurations:
• Operating system — Windows or UNIX
• Application server — JBoss (bundled or unbundled)
• Web server — Apache or Microsoft IIS
Operating system options

Workforce Timekeeper can be installed on Windows or UNIX (Solaris or AIX)
systems. If you use Workforce Timekeeper in a UNIX environment, you must also
install one Windows companion server, which is required for Reports and
Database Manager. For more information refer to:
• Windows systems — Installing Workforce Timekeeper or Upgrading
Workforce Timekeeper
• AIX or Solaris systems — Installing and Upgrading Workforce Timekeeper
on UNIX.
Application server options

An application server is a software platform for developing and deploying multi-
tier distributed enterprise applications. It centralizes application services such as
web server functionality, business components, and access to back-end enterprise
systems. It uses technologies such as caching and connection pooling to improve
resource use and application performance.
Workforce Timekeeper v6.1 uses a Red Hat JBoss application server. JBoss is an
open source application server that implements the complete Java 2 Enterprise
Edition (J2EE) stack, including Java Server Pages (JSP), servlets, and Enterprise
JavaBeans (EJB).
Note: Workforce Timekeeper v6.1 is supported on Red Hat JBoss v4.3 CP01 only.
It is not supported on JBoss v4.3 Community Edition.
55
The Workforce Timekeeper installation program will install JBoss or you can
configure Workforce Timekeeper to work with a preinstalled version of JBoss.
JBoss can be used on Windows or UNIX (Solaris or AIX) systems.
Note: Workforce Timekeeper can also be installed and configured for other
application servers. See your Kronos Representative for more information.
Web server options

Workforce Timekeeper requires web server software, in regular or secure (SSL)
mode. The web server handles static pages so the application server does not have
to waste cycles on them. All JavaScript files, style sheets, help HTML files, and
applet JAR files are served by the web server.
The web server can also stream data back to clients more efficiently than the
application server. This is because Java normally uses a blocking I/O model where
each connection is serviced by a separate thread. If the client’s network
connection is slow and/or if the page being downloaded is large, an application
server thread will be occupied for a relatively long time. By sizing the buffers on
the web server correctly, the application server can return the whole page to the
web server as fast as possible, and the web server can then stream the data down
to the slow client more efficiently.
The Workforce Timekeeper installation program allows you to select any of the
following web servers:
• Apache with or without SSL
• Microsoft IIS with or without SSL (Windows only)
Apache web server
The Workforce Timekeeper installation program installs the Apache web server if
it is selected during the installation procedure. If you have already have Apache
installed on your system, you can install Workforce Timekeeper and manually
configure the product to use the preinstalled version of Apache.
Although Workforce Timekeeper will also properly configure Apache to run

under SSL, you must have the key and certificate files before installing Workforce
Timekeeper. Each machine must have its own key and certificate files and you
must copy the files into a directory on the server. The installation procedure
requires that you enter the location of these files. See “SSL security
considerations” on page 129 for more information.
Microsoft IIS web server (Windows Only)
Microsoft Internet Information Server (IIS) is a Windows application that consists

of FTP, e-mail, web server, and news groups components. Workforce Timekeeper
only uses the web server component.
Note: Microsoft IIS is not supported on UNIX.
If you choose to use IIS, you must install it before you install Workforce
Timekeeper. Depending on the operating system of your web server machine, you
should install IIS v6 (Windows Server 2003) or IIS v7 (Windows Server 2008),
using the default settings. When you run the Workforce Timekeeper installation
program, the installation program automatically sets the IIS settings required by
Workforce Timekeeper:
• Read permission
• Scripts enabled
• Scripts folder present
• Anonymous access
• Mappings for .asp and .asa files
If you are using IIS with SSL, you must obtain the key and certificate files. Each
machine must have its own key and certificate files and you must copy the files
into a directory on the server. See “SSL security considerations” on page 129 for
more information.
57
Configuration options
Workforce Timekeeper, along with application server and web server software,
can be installed in any of three basic configurations:
• Combined installation — Workforce Timekeeper, application server, and
web server all on the same physical machine.
• Separated installation — The application server with Workforce Timekeeper
dynamic information on one machine and the web server with the Workforce
Timekeeper static information on another machine.
• Multiple instance installation — Multiple instances of Workforce
Timekeeper on the same machine. This can be multiple instances of a
combined or separated installation.
For information about installing these configurations, refer to the Workforce
Timekeeper installation documentation.
Typical and custom environment options

The Workforce Timekeeper installation program allows you to select from a
typical or custom installation:
• A typical installation installs and configures Workforce Timekeeper and all
the required components: JBoss application server software and Apache web
server software. (It also configures Microsoft IIS web server software, if it is
already installed on your machine.) The typical option is the simplest and
most automated way to install Workforce Timekeeper.
• A custom installation does not install JBoss or web server software. It allows
you to use a preinstalled JBoss application server and a preinstalled Apache or
Microsoft IIS web server. Essentially, this installation option provides an EAR
file and a ZIP file, which you must configure manually:
– The EAR file contains server-side code (Workforce Central run-time
code)
– The ZIP file contains static content (such as images and static HTML) and
is used when you have separate web and application server machines. If
you are installing all Workforce Timekeeper components on the same
machine, the ZIP file is not used.
Typical server environment option

The most automated and simplest way to install Workforce Timekeeper is to use
the Typical server environment option and install Workforce Timekeeper, JBoss,
and Apache on one machine, which is everything you need to get the Workforce
Timekeeper system up and running. However, you can also use the Typical option
for a separated application and web server installation.
The Typical option is implemented differently depending on your operating
system.
59
Windows machines
The Typical server environment option enables you to select from the following:
• Application server only — Installs Workforce Timekeeper dynamic data and
JBoss application server
• Web server only — Installs Workforce Timekeeper static data and Apache,
but can also use Microsoft IIS if it is already installed on the machine.
• Combined web and application server — Installs Workforce Timekeeper,
JBoss, and Apache, but can also use IIS if it is already installed on the
machine
For example, you could use the Workforce Timekeeper Typical server
environment option to accommodate various installation configurations:
• Combined web and application server
– Workforce Timekeeper application
– JBoss application server
– Microsoft IIS instead of Apache; but you must install it before you install
• Separated web/application servers
– Machine 1: Workforce Timekeeper and JBoss application server
– Machine 2: Microsoft IIS, which must be installed before you install
• Multiple combined or separated instances
– Two instances of a combined Workforce Timekeeper, JBoss, and Apache
installation on the same machine
– Two instances of Workforce Timekeeper and JBoss on one machine and
one instance of Apache or IIS on another machine
UNIX machines
The Typical - Kronos managed option on a UNIX machine installs a JBoss
application server and an Apache web server. It also allows you to select from the
following:
• Application server only, which installs Workforce Timekeeper dynamic data
and JBoss application server
• Web server only, which installs Apache and Workforce Timekeeper static data
• Combined web and application server, which installs Workforce Timekeeper,
JBoss, and Apache
Custom server environment option

The Custom server environment option enables you to use a preinstalled JBoss
application server, but requires that you manually deploy and configure the
application server and web server to work with Workforce Timekeeper.
Configuring a custom installation is a three-step process:
1. Run the Workforce Timekeeper installation program, selecting the Custom
option.
2. Deploy the Workforce Timekeeper EAR file to work with the preinstalled
version of JBoss.
3. Configure the application server connectors to work with an Apache
(Windows or UNIX) or IIS web server (Windows only).
Detailed instructions for configuring Workforce Timekeeper with a preinstalled
JBoss application server are included in the Installing Workforce Timekeeper and
Upgrading Workforce Timekeeper documents.
61
Installing Workforce Central products

The Workforce Central installation kit is used to install the following:
• Workforce Central Suite applications — The Kronos® Workforce
Central®suite installation kit enables you to install the following products at
the same time, as described in the Installing Workforce Timekeeper and
Upgrading Workforce Timekeeper books:
– Workforce Timekeeper — Workforce Timekeeper manages labor
resources in real time by collecting, processing, and storing time and
attendance data. Specific capabilities enable users to define pay policies,
maintain employee demographics, query for employee information,
manage employee time, create and maintain schedules, and generate
reports.
Workforce Timekeeper is a prerequisite for all of the following Workforce
Central products.
– Workforce Scheduler — An enhanced scheduling product used when
staffing requirements vary depending on business demands.
– Workforce Forecast Manager — A product typically used in retail
environments when staffing requirements vary depending on business
demand; for example, the number of staff needed to meet the level of
service required in a grocery store on a given day. Workforce Forecast
Manager requires that Workforce Scheduler is installed on the same
machine.
– Workforce Operations Planner — A retail scheduling product that
enables budget stakeholders to collaboratively develop and review the
budget. It also generates a labor forecast in hours as well as dollars for a
future fiscal period. Workforce Operations Planner requires that
Workforce Scheduler is installed on the same machine.
– Workforce Leave — A time-off monitoring product that tracks the time
that employees have taken off under a company’s leave policies.
– Workforce Attendance — An attendance-monitoring product that
extracts Workforce Timekeeper attendance information for rules
processing and generates the appropriate warnings and ill-treats for
managers.
Installing Workforce Central products
– Workforce Activities — A product, typically used in manufacturing

environments, to collect data at all stages of the production process and
provide real-time information to help shop floor supervisors manage
people and resources, track progress, and resolve production issues as
they occur.
– Workforce Device Manager — A product that enables the flow of data
between Workforce Central applications and data collection devices.
Workforce Device Manager replaces Data Collection Manager.
– Workforce Integration Manager — Replacing Workforce Connect,
Workforce Integration Manager is a next-generation data integration tool
that interfaces Workforce Central products with other business-critical
applications. Unlike Workforce Connect, which is an entirely Windows
client-side utility, Workforce Integration Manager Integration Manager
allows users to run and maintain interfaces from their Workforce Central
web interface. Interface programmers will use the client-side Interface
Designer—which continues to use the Workforce Connect look-and-
feel—to create and update data integration interfaces.
You can install one or more of these products at the same time that you install
Workforce Timekeeper, or you can install them at a later date. You cannot
install any of these products without Workforce Timekeeper.
Important: All of these products except Workforce Device Manager require a

separate license. The installation program will let you install these products
without a license, but you will not be able to access them until you apply the
license file.
• Although not part of the suite installation, the following additional products
can be installed from the Workforce Central installation kit:
– Process Designer — Process Designer is the visual process design tool
used to modify preconfigured process templates that are included with
Process Manager (which is part of Workforce Timekeeper).
Although most Process Manager components are installed on the
application server when you install Workforce Timekeeper, Process
Designer is a client application and can be installed on client machines.
63
Process Designer does not require a separate license. For more

information, refer to Installing Workforce Timekeeper or Upgrading
– Interface Designer — Interface Designer is a client application used to
create custom interfaces for Workforce Integration Manager. When
upgrading from Workforce Connect, you must install Interface Designer
in order to upgrade the Connect links to Workforce Integration Manager.
Instructions for installing Interface Designer are included in the
Workforce Timekeeper installation documentation.
Interface Designer does not require a separate license. For more
information, refer to Installing Workforce Timekeeper or Upgrading
– Workforce Worksheet — Workforce Worksheet enables users to
dynamically retrieve a number of Workforce Central reports and Genies
from a client machine using Microsoft Excel 2007. Any Excel worksheet
created from this data can be refreshed on demand or dynamically with
live data from Workforce Central. Workforce Worksheet requires
Advanced Reporting (SSRS).
Workforce Worksheet does not require a separate license. For more
information, refer to Installing and Configuring Workforce Worksheet.
– Workforce Central Portal — Workforce Central Portal organizes data
from your Workforce Central system and uses Microsoft SharePoint web
parts to display the data in a way that is easy for managers to read.
Workforce Central Portal does not require a separate license. For more
information, refer to the Workforce Central Portal Installation Guide.
– Workforce Record Manager — Workforce Record Manager - Setup
Data Manager is a separately installed component that allows you to
archive and manage data. Workforce Record Manager requires a license
and typically involves the installation of a test database and server.
Refer to the Workforce Record Manager Installation Guide for more
information about installing Workforce Record Manager.
Workforce Timekeeper deployment

The deployment process for Workforce Timekeeper uses the information that you
provide when you run the InstallShield Wizard to install and configure the
applicable products. The installation phase of the deployment process installs the
applicable files on the host machine and the configuration phase makes the
system ready to use.
Installation phase
Using the information collected by the InstallShield Wizard, the installer loads the
required software from the installation CD to the deployment area on the host
machine. The deployment area uses the following directory structure for each
Workforce Central product installed:
kronos
deployments
release The release folder is organized by product. Each
wfp_staging product folder contains
app_server • Bill of materials (BOM) — Lists the files and
directories for the staging areas of the application
boms
server and web server.
web_server
• Application server staging area — Contains all
wtk_staging Java files used to configure the application server.
app_server • Web server staging area — Contains all Java files
boms used to configure the web server.
web_server
wfc The wfc folder is organized by product, and each

wfp_staging product folder contains the non-Java properties files
used by the product.
app_server
applications
WEB_INF
wtk_staging
65
In addition to installing files and directories, the following files are created during
the installation phase:
• install.dict — A text file that is populated by information entered by
the user in the InstallShield Wizard and that contains a list of installed
property names and values.
• install.txt —This file is created if there is a problem during the
installation.
Configuration phase
The configuration phase of the deployment process configures the system based
on the features that were selected, database information that was provided,
settings that were specified, and files that were installed during the installation
phase. It uses the install.dict file created during the installation phase and
the BOM files to create the supporting infrastructure, including the following:
• Creates a JBoss instance
• Creates an external instance directory for custom property files
• Configures JBoss connectors
• Configures JBoss for the instance
• Configures the products
The configuration phase also creates and deploys the enterprise application
archive (EAR) file for the selected products.The EAR file is a read-only file that is
used exclusively by the application server (such as JBoss). It consists of a
deployment descriptor (.xml file) and a web application archive (WAR) file. The
WAR file consists of the.jsp files, .html files, and .class files that make up
the application’s business logic.
Non-Java components, such as licensing, are deployed outside the WAR file in the
runtime directory.
The configuration phase uses the directory structure created by the installation
phase to determine the files needed to build the EAR file. With the exception of
properties files, the it uses files from each of the application directories using the
following rules:
• Files located in the release directory are the first choice.
• Files in the service pack area override files in the release directory.
• Files in the patch directory override files in the service pack and release
directories.
• The instance name directory overrides the patch, service pack, and release
directories.
Property files are handled differently than other files because they require
modification prior to installation. If property files are in the patch or service pack
areas, the files are copied to the subdirectory that corresponds to the instance
name (such as wfc or wfc1) and are modified before the EAR file is created;
otherwise the property files in release area are used.
The configuration phase also creates two logs, both of which are located in the
Kronos\configuration folder:
• configuration_date.log — Is updated by every process that is
running and includes the bill of materials (BOM) actions.
• instance_creation.log — Logs DeployGen events. DeployGen
builds the EAR, WAR, and ZIP files.
67
When the configuration phase is complete, the directory structure of a Workforce

Central environment with a combined application/web server looks similar to the
following:
kronos
ant
apache Folder for Apache web server (if installed)
configuration Configuration folder that contains BOMs and

DeployGen, as well as configuration.log and
boms instance_create.log files
deployGen
deployments Used by installation phase of deployment
flexlm License manager files
help Online Help files
jboss JBoss application server (if selected)
jboss_connectors Files to connect JBoss to the web server
jdk
reporting
uninstall Files used to remove Workforce Central files
wfc
applications
abk The wfc folder contains all external files for the
default wfc instance, including help, licensing,
calendar and log files.
dbmanager The wfc folder is considered the “external”
... directory because its contents are external to
wtk the Workforce Central J2EE application. Files
(jars, properties, etc) required within the J2EE
application are included in the EAR file. The
bin external folder only contains files and folders
that are truly needed to exist in the external
licensing
folder.
lm
All other files are in the EAR file. Files that are
logs created at system startup or by modifying
plugins System Settings will still be located in the
external directory.
properties
reporting
reports
Note: With the implementation of J2EE compliance and EAR file packaging in
v6.1, the Workforce Central properties files are no longer directly accessible. You
do not have direct access to the deployed EAR file, which means that you cannot
change the properties files that have been packaged in the EAR file. All
modifications to properties files must be made through the System Settings of the
user interface.
69
Reports
The reporting functionality of Workforce Timekeeper v6.1 is based on the report
definition language (RDL), which is an XML schema from Microsoft for
representing reports. Workforce Timekeeper supports two types of RDL reports:
• Standard reporting — Uses RDL report templates and the Reports
Definition Language Client (RDLC) engine. The standard reporting
functionality is delivered when you install Workforce Timekeeper. No
additional setup is required.
• Advanced reporting — Uses RDL-compliant report templates and the
Microsoft SQL Server Reporting Services (SSRS) engine. Advanced
reporting requires that you purchase and install Microsoft SQL Server 2005
Reporting Services. Additional setup is required to use Workforce
Timekeeper with SSRS. For more information, refer to Installing Workforce
Timekeeper.
Notes:
Workforce Timekeeper v6.1 does not support Crystal Reports.
Workforce Timekeeper supports SSRS on SQL Server 2005. If you use SQL
Server 2008 for your Workforce Central database, you must install SQL Server
2005 for SSRS.
Basic reporting
The basic reporting functionality that is delivered when you install Workforce
Timekeeper is based on the Reports Definition Language Client and does not
require any special setup. It is appropriate for customers who do not use Microsoft
SQL Server Reporting Services.
Advanced reporting
The advanced reporting functionality, which is based on the SSRS (SQL Server
Reporting Services) solution, is the full, robust Workforce Central reporting
Reports
solution. Because SSRS uses a reporting database that is separate from the
Workforce Central database, the SSRS solution requires a SQL Server 2005
installation with Reporting Services enabled. It also requires an IIS web server.
(The Workforce Central database can be either SQL Server or Oracle and the
Workforce Timekeeper web server can be either IIS or Apache.)
Prerequisites
Before you set up the SSRS server, you should be aware of the following:
Note: Workforce Timekeeper v6.1 Advanced Reporting requires SQL Server

2005. It is not supported on SQL Server 2008.
• You must use Microsoft Internet Information Services (IIS) on the SSRS
server.
– IIS must be installed before SQL Server 2005 and SSRS.
– The IIS and WWW Publishing Windows services must be running.
– No other web server can be conflicting with IIS, for example, the Apache
web server.
• Microsoft SQL Server installations require Microsoft SQL Server 2005
service pack 2 or higher.
• If you plan to install SSRS and SharePoint on the same server, you must
install SharePoint before installing SQL Server 2005, but after installing IIS.
• The .NET 2.0 framework must be installed on the Workforce Central
application server and the SSRS server. If it is not present, the Workforce
Central installer or the SSRS installer (Microsoft SQL Server) will install it.
• Make sure each server and client that will access Advanced Reports is
registered in the corporate Domain Name Server (DNS) with its fully
qualified domain name.
For example, to check that a machine is registered in the corporate DNS, open
the command prompt and enter the following command:
nslookup server_name.kronos.com
71
where server_name is the name of the server that you are checking. If the
server cannot be found, you must add it to the domain.
• For best results, install Microsoft SQL Server 2005 on a newly installed
Windows 2003 operating system with the latest service pack installed.
• Installers should have experience configuring Microsoft SQL Server, Internet
Information Services, and Workforce Central. SSRS Reporting is intended to
be installed and configured by an administrator with knowledge of Microsoft
SQL Server, Reporting Services, IIS, and Workforce Central.
Custom security extension
The reporting change with the greatest impact on the installation, configuration,
and use of Workforce Central with advanced reports is the addition of the custom
security extension. The custom security extension is an extension to the SSRS
server that allows authentication and authorization of reporting users to occur on
the Workforce Central application server. The security between the Workforce
Central application server and the SSRS server uses domain cookies.
This change requires all URLs to use fully qualified domain names. For example,
in the past, you could access Workforce Timekeeper on the server named dynamo
by using the following URL:
http://dynamo/wfc/logon
With the custom security extension, you must access the same server using this
URL:
http://dynamo.kronos.com/wfc/logon
The custom security extension only affects the Workforce Central logon when you
are using Workforce Central and SSRS together. This means that you must use the
fully qualified domain name when you log on to Workforce Central if you plan to
use advanced reports. If you do not plan to use advanced reports, you can log on
Workforce Central using the server name.
Using advanced reporting
If you are using advanced reporting with SSRS, additional points to consider
include the following:
Reports
• All application servers and SSRS servers must exist on the same Windows
domain.
• If you suspect that authorization is failing because cookies are not being
passed due to firewall or Internet Explorer security configurations, add the
SSRS server to your browser’s “trusted” zone.
• To access the SSRS server, you must be logged on to Workforce Central as a
valid user. If you try to log on to SSRS directly, you will be redirected to the
Workforce Central logon page. After you are logged on, you only have access
to reports that are in your report profile.
To access the reports server directly (without logging on to Workforce
Central), you must log on to the SSRS server as an administrator and enter the
following in a browser window:
http://localhost/Reports
Custom reports
If you are upgrading from a previous version of Workforce Timekeeper and you
use custom reports that were created in Crystal Reports, you must do one of the
following:
• Convert your custom reports to RDL.
• Install Business Objects, the Crystal Reports Server 2008, and add the Kronos
Business Objects Adapter as described in the Installing Workforce Timekeeper
manual.
Using Business Objects
Workforce Central no longer supports custom Crystal reports out-of-the-box as

they were in prior versions. Therefore, a new capability to run legacy custom
Crystal reports is being introduced. Running Crystal reports requires using a third-
party product from Business Objects Corporation ™. Two Business Objects
products are supported for this release: BusinessObjects XI 3.0 (BOE) and Crystal
Reports Server 2008 (CRS), which is a subset of Business Objects Enterprise.
73
Successfully running your custom Crystal reports requires you to configure and
use products from Business Objects Corporation. For more information, refer to
their web site and documentation.
Supported Platforms and Versions

The Crystal reports servers support the following operating system
configurations:
Platform and version BOE XI 3.0 CRS 2008

Windows Server 2003 Yes Yes
Windows Server 2008
Prerequisites
Before installing the Crystal reports server, you need the following items:
• A Crystal report designer tool that enables you to edit your Crystal RPT
source code.
• The Crystal Reports DataDirect drivers downloaded from the Business
Objects website.
• Administrator privileges to set up and configure the Crystal reports server.
• A proper installation of Crystal reports server with no port conflicts with
preexisting software, such as Workforce Central.
• Microsoft Visual C++ 2005 SP1, which you can download from Microsoft.
Refer to Upgrading Workforce Timekeeper for more information.
Language support
Language support
Workforce Timekeeper and other Time & Attendance and Scheduling products
support a number of different languages. With v6.1, however, you must install
Workforce Timekeeper in English first and then apply the applicable language
files. Kronos provides a language pack that includes language files for several
languages, such as Chinese, Spanish, and French. Other languages can also be
accommodated, as described in the Guide to Translating and Customizing
Workforce Central.
Some points to remember when using Workforce Timekeeper for non-English
systems include the following:
• Code pages — Because Workforce Timekeeper v6.1 supports Unicode
character encoding, multiple instances of most languages can coexist on a
single database without regard to code page (such as Latin 1, Latin 2, or
Latin 9).
• Bidirectional character sets — Workforce Timekeeper does not support
bidirectional character sets, such as Hebrew and Arabic.
• Multibyte character support — If you want to support any character set
outside of Latin 1, Latin 2, and Latin 9, including multibyte characters (such
as Chinese, Japanese, and Korean), you must use Oracle 10g Release 2.
Multibyte character encoding is not supported with SQL Server or Oracle 10g
Release 1.
• Asian fonts — Asian fonts must be installed on all client machines that
connect to a Workforce Central server that uses Asian locale or currency. If
Asian fonts are not installed, the Asian characters will be garbled. They may
appear as rectangles, question marks, or otherwise unrecognizable characters.
Refer to Installing Workforce Timekeeper or Upgrading Workforce Timekeeper for
instructions on configuring a Workforce Timekeeper system for non-English
languages.
75
Service packs
Kronos periodically provides service packs to update, fix, and enhance Kronos
products between releases. Some key points about service packs include the
following:
• Service packs are cumulative. Each service pack includes all the fixes from
every previous service pack release.
• If you are using multiple instances of Workforce Central, the service pack
installation program will automatically invoke Configuration Manager so you
can select the instance to which to apply the service pack.
– All instances that use the same database must use the same service pack.
You must stop all instances before you install a service pack, regardless of
whether the instances are on different machines or the same machine.
– Instances that do not use the same database can use different service
packs. For example, instance wfc1 can be running service pack 3 and
instance wfc2 can be running service pack 1.
Exception: If there is only one instance (by definition, the wfc instance), the
service pack will be applied to that instance automatically without user
interaction.
• Service packs typically include fixes and updates for all products in the
Workforce Central suite. However, only the products that you currently have
installed are upgraded when you apply a service pack.
Exception: Help files, which are available to all products and all instances,
may be updated for products that are not installed. For example, if a service
pack includes help file updates for Workforce Activities, then those help files
would be installed, even if you do not have Workforce Activities installed.
Service packs
• If you add a product to an existing installation that contains a service pack, the
installation program for the new product will apply the service pack
automatically. For example, consider the following: You install Workforce
Timekeeper and Workforce Scheduler and then apply service pack 6.1.0. A
month later, you purchase Workforce Leave. When you install Workforce
Leave, you can apply service pack 6.1.0 at the same time.
The same is true if you add a second instance. When you create the second
instance, Configuration Manager lets you apply any service packs that are
installed on the system. You do not need to apply them separately.
• If you install a service pack and then decide not to use it, you can roll it back
or uninstall it. In either case, the product returns to the base v6.1 state. There
are, however, differences between a rollback and an uninstall:
– A rollback leaves the installed service pack in the
Kronos\deployments directory and an uninstall removes the
service pack installation from the deployments directory.
– With a rollback, you can remove a service pack from one instance and
leave it on other instances. An uninstall removes the service pack from all
instances. For example, if wfc5 and wfc7 have service pack 5 installed,
the uninstall removes service pack 5 completely from those instances and
reverts them to v6.1.0. It also removes service pack 5 from the system.
If you do not want to remove a service pack from all instances, use
Configuration Manager.
• The service pack directory structure exists at the same level as the release,
custom, patch, etc., directories. However, it has an additional sublevel, the
SPx level, where each SPx directory contains a specific service pack. The
structure under the SPx level is identical to that under the release, custom,
etc. directories. It consists of *_staging areas, each of which contains an
app_server and web_server subdirectory.
77
Load balancing
To accommodate large enterprise environments, Workforce Central can be scaled,
or expanded, to handle increased usage or to provide fault tolerance. Generally,
scaling can be categorized as:
• Horizontal scaling — Adding web server or application server machines
• Vertical scaling — Adding multiple instances of Workforce Central on the
same machine
Horizontal and vertical scaling can also be combined to achieve the benefits of
both.
When a Workforce Central environment consist of some combination of multiple
instances, web servers, and application servers, communication between users and
the system must be distributed across all servers. Various load balancing solutions
are available that distribute user requests evenly across these array of servers.
For more information about load balancing, refer to the load balancing appendix
in Installing Workforce Timekeeper or Upgrading Workforce Timekeeper.
Background Processor
The Background Processor (BGP) is a service that runs as part of the Workforce
Timekeeper application server. It runs constantly, continually checking the
database to keep employee totals up to date. This enables processes that require
up-to-date totals, such as the reports process, to have accurate data whenever you
want to run them.
Because the Background Processor is a service of the Workforce Timekeeper
application, it is not installed separately. The Background Processor requires a
fully functional application server and cannot be run independently of the
Workforce Timekeeper application.
The Workforce Timekeeper installation program enables you to select from the
following:
• Workforce Timekeeper application server only — Select this option if you
are installing a machine that will function only as an application server (and
web server if you are using a combined installation).
The Background Processor threads are disabled on this server. With this
configuration, users can edit timecards or schedules, configure rules, run
Genies, run reports, and so forth. However, no BGP will be running on this
machine. You can, however, turn the BGP on at a later date if needed. Refer to
Workforce Central System Administrator’s Guide—Timekeeping for more
information.
• Workforce Timekeeper BGP Server Only — Select this option if you are
installing a dedicated Background Processor machine. The Workforce Central
platform will be installed with only the Background Processor threads
running.
With this installation, users cannot log on to the web server to edit timecards
or schedules, configure rules, run reports, and so forth. If a user attempts to
log on, a message appears, stating that the user does not have permission to
access this resource.
The only functionality available with a BGP-only server is configuring the
server itself—changing the BGP configuration parameters. To do this, you
79
must use the Offline logon URL to log on to a BGP-only machine, which is
typically:
http://serverName/instance_name/offlineLogon
where serverName and instance_name are the names of the Workforce
Timekeeper server and instance, respectively.
Important: In most cases, the same Workforce Central products must be

installed on all machines and instances that access the same database.
Because a BGP-only server cannot be used by end users, however, you do not
need to install most Workforce Central products on this machine. The only
exception to this is that if you use Workforce Activities, it must be installed on
the BGP-only machine as well as all other machines that connect to the same
Workforce Central database.
If you later decide to use this server for end users, you must uninstall the
application and reinstall it, selecting one of the other options in this dialog
box.
• Workforce Timekeeper with BGP (Single Server) — Select this option if
you want to install the Workforce Timekeeper application with the
Background Processor threads enabled. The BGP is enabled by default in this
configuration. This provides a complete Workforce Timekeeper server,
including a BGP. Users can log in and edit timecards or schedules, configure
rules, run reports, and perform group edits, and as well as change BGP
configuration parameters.
The Background Processor is managed through the Workforce Timekeeper system
settings. Refer to the Workforce Central System Administrator’s Guide and the
Workforce Central System Administrator’s Guide—Timekeeping for more
information about managing the Background Processor.
Sample configurations
The following sections describe some of the many possible configurations for a
Workforce Timekeeper installation:
• “Workforce Timekeeper with no separation or multiple instances” on page 81
• “No separation, two instances” on page 82
• “Separation, no multiple instances” on page 84
• “Separation, two instances” on page 85
Workforce Timekeeper with no separation or multiple instances

The simplest configuration is to install Workforce Timekeeper on one or more
machines, each running one web server and one application server.
• The web server listens on the default HTTP port 80.
• The application server listens on a vendor-specific port for requests sent via
the connector installed on the web server. When one application server needs
to communicate with another application server, it did so via the web server,
using either HTTP or HTTPS.
81
The WFCSERVER table contains the following:.
Web IPC IPC App Web

Server HTTPS host HTTPS host IPC URL URL
Name option name option name Port Context prefix prefix
Server 1 HTTP or Server 1 HTTP or Server 1 80 WFC /wfc /WFC
HTTPS HTTPS
Server 2 HTTP or Server 2 HTTP or Server 2 80 WFC /wfc /WFC
HTTPS HTTPS
Example URLs:
• http://server1/WFC/applications/wtk/images/foo.gif
• http://server2/wfc/applications/wtk/foo.jsp.
A URL for IPC (server-to-server communication; normally but not necessarily to
the application server directly) will look like the following (IPC HTTPS option):
//(IPC Hostname):(IPC Port)/(App URL prefix)/(path)
For example:
http://server1:80/wfc/XmlService
No separation, two instances

Multiple instances of Workforce Timekeeper on the same machine can be used to
support multiple languages, multiple databases, or multiple versions. Each
instance has a unique context. In the following examples, the two instances are
called Inst1 and Inst2.
Because there are two application server processes, each must listen on a unique
port (8009 and 8010 in the example). There is a single web server listening on the
default port (80 for HTTP, 443 for HTTPS), and handling both application servers
via two different connector configurations. The connector configurations know to
send URLs with the first instance’s prefix (/inst1) to port 8009 on the local
server, and with the second instance’s prefix (/inst2) to port 8010 on the local
server.
In this case, the WFCSERVER table contains:
Web IPC IPC App Web

Server 1 HTTP or Server 1 HTTP or Server 1 80 Inst1 /inst1 /INST1
HTTPS HTTPS
Server 1 HTTP or Server 1 HTTP or Server 1 80 Inst2 /inst2 /INST2
HTTPS HTTPS
Example URLs:
• http://server1/INST1/applications/wtk/images/
foo.gif (static content, instance 1)
• http://server1/inst2/applications/wtk/foo.jsp
(dynamic content, instance 2)
• http://server1:80/inst1/XmlService (IPC, instance 1)
83
Separation, no multiple instances

Workforce Timekeeper v6.1 also supports placing the web server and application
server on separate machines, potentially with a firewall in between. In this case,
outbound connections from the application server to the web server through the
firewall are avoided by having inter-server communication use a port on the
application server directly. (The JBoss default HTTP port is 8080.)
For example, if the application server on server 4 wants to talk to the application
server on server 3, it calls server 3 on port 8080. In this configuration, the
installation process supports only HTTP for inter-server communication on port
8080.
Note that although the following example shows two separate web server
computers, you could also have a single web server with multiple connector
configurations, as in the previous example.
Web IPC IPC App Web

Server 3 HTTP or Server 1 HTTP Server 3 8080 Inst1 /inst1 /INST1
HTTPS only
HTTPS only
Example URLs:
• http://server1/INST1/applications/wtk/images/
foo.gif (static content, instance 1)
• http://server2/inst2/applications/wtk/foo.jsp (dynamic
content, instance 2)
Separation, two instances

Workforce Timekeeper v6.1 can also support the previous configuration, but with
multiple application server instances installed on the same machine. (As before,
there could be two separate web server machines, or only one.) Again, because
there are two application server processes, each must listen on a unique port; in
this example, the ports are 8009 and 8010 for the connector, and 8080 and 8081
for HTTP IPC. As before, you could have two separate web servers as shown
below, or a single web server with multiple connector configurations.
85
Web IPC IPC App Web

HTTPS only
HTTPS only
Example URLs:
• http://server1/INST1/applications/wtk/images/foo.gif (static
• http://server2/inst2/applications/wtk/foo.jsp (dynamic
Dedicating machines to certain functions
Dedicating machines to certain functions

Workforce Timekeeper supports several special-purpose server configurations.
For UNIX systems, you must have a Windows “companion server” to run non-
Java technology such as reports. You can also run dedicated report servers,
dedicated Background Processor servers, or dedicated batch processing servers.
For example, you might choose to disable reports, the Background Processor, and
batch processing on your main application servers (to make them as responsive as
possible to real-time HTTP requests), and run these services instead on one or
more separate servers that do not receive HTTP requests.
Most of these services require the Workforce Central platform, so the platform is
installed on companion, report, or batch servers. With the exception of a dedicated
Background Processor machine, all other applications also need to be installed on
these servers—otherwise the necessary report templates, batch processing classes,
etc. would not be available.
Reports
If you use the advanced reporting functionality of Workforce Central v6.1, you
can set up a dedicated SSRS server that provides the reporting engine for all
application servers in your environment. For more information about configuring
an SSRS server, refer to Installing Workforce Timekeeper.
Reports are queued for execution. The queue is stored in the database where the
reports service retrieves the requests and allocates them to a server that runs
reports. The distribution is done “round robin,” where each server receives a
request in turn. There is no weighting of report complexity or preferred servers
supported. The report executes, producing a physical file that is stored on the
server that executed the report request. When the interactive user asks to view the
report, the file is delivered from the server where the file is resident and is not
passed between servers.
87
Chapter 3
Workforce HR/Payroll
This chapter provides information about Workforce HR/Payroll and contains the
following sections:
• “Overview” on page 90
• “Reporting” on page 95
• “Workforce HR/Payroll Solution Manager” on page 96
• “Multiple instances in a Workforce HR/Payroll environment” on page 99
Chapter 3 Workforce HR/Payroll
Overview
Workforce HR and Workforce Payroll (referred to in this document as Workforce
HR/Payroll) consists of three main components:
• Web server — Provides the web browser user interface for the Workforce
HR/Payroll administrative application and the Workforce Employee™ and
Workforce Manager™ self-service application.
• Database server — Manages the Workforce HR/Payroll database
• Payroll engine — Processes all payroll-related functions
You can choose a single-server or dual-server configuration:
• Single server—Web, payroll engine, and database servers installed on one
computer.
• Dual servers—Web server installed on one computer and the payroll engine
and database server installed on the another computer.
The configuration that is appropriate for your organization depends on many
variables, including the number of employees and users, and whether or not your
organization plans to include Workforce Payroll.
System requirements
System requirements
Item Requirement
Hardware See your Kronos representative.
Network connection 100BASE-T connection for dual-server configurations recommended
Web browser Microsoft Internet Explorer 6.0, 7.0
Portal Microsoft SharePoint 2007
Virtualization ESX Server 3.5
Application server requirements1
Datacenter, Small Business Server Editions
• Microsoft Windows Server 2008 (32-bit)
Application server JBoss 4.3
Server JRE JRE 1.6.0_07 (1.6)
Web server requirements1
Web server software Microsoft IIS v6.0 (Windows Server 2003) or v7.0 (Windows Server
2008):
• World Wide Web Server enabled
• SMTP Service enabled
• ASP.NET must be installed for Windows Server 2003
Other software • Adobe Acrobat Reader 4.0 or later
• Microsoft .NET Framework 2.02

Item Requirement
Payroll engine and database server requirements1

Database server software • Microsoft SQL Server 2005 with service pack 2 (32-bit) —
compatibility level 80 only
• Microsoft SQL Server 2008 with service pack 2 (32-bit) —
compatibility level 80 or 100 only
• Microsoft.NET Framework 2.02
• WinZip 7.0 or later
1 Workforce Central automatically supports security and bug service packs specific to these operating systems.
2 Workforce HR/Payroll automatically installs Microsoft .NET framework if it is not present on the machine.
However, the Workforce HR/Payroll uninstall procedure does not remove. NET; if you want to remove it, you
must do so manually.
System requirements
Administrative client workstation requirements
Hardware
CPU Pentium II 400 Processor (minimum recommendation)
RAM 128 MB (minimum recommendation)
Hard drive capacity 20 MB free disk space (minimum recommendation)
Monitor • SVGA high color (800 x 600) (minimum recommendation)
• Normal font size display (if you use large fonts, some buttons are hidden)
Software
Operating system1 • Microsoft Windows Server 2003 (32-bit), service pack 1 — Standard,
• Windows XP Professional
• Microsoft Vista
Web browser Microsoft Internet Explorer 6.0, 7.0, 8.0
Client JRE JRE 1.6.0_07 (1.6)
Other software Adobe Acrobat Reader 4.0 or later
Important: Administrative users must have local administrator rights on their

workstations.

Workforce Employee and Workforce Manager workstation requirements
Hardware
CPU Pentium (minimum recommendation)
RAM • Windows XP: 128 MB
• Windows Vista: 512 MB
Hard drive capacity 20 MB free disk space (minimum recommendation)
Monitor • SVGA high color (800 x 600) (minimum recommendation)
• Normal font size display (if you use large fonts, some buttons are hidden)
Software
Operating system1 • Microsoft Windows Server 2003 (32-bit), service pack 1 — Standard,
• Windows XP Professional
• Windows Vista
Web browser Microsoft Internet Explorer 6.0, 7.0
Other software Adobe Acrobat Reader 4.0 or later
Optional component Microsoft Terminal Services supported on Windows 2000 Server with service
pack 2
JRE JRE 1.6.0_07 (1.6) (Workforce Manager only)
Reporting
Reporting
Workforce HR/Payroll uses Crystal reports as its reporting mechanism and does
not use RDL or SSRS functionality.

Workforce HR/Payroll Solution Manager

Solution Manager is the main interface for Workforce HR/Payroll configuration.
It has two components:
• A graphical management console based on the Microsoft Management
Console (MMC) framework
• A TCP/IP-based listener service (daemon), called the Workforce HR/Payroll
IP Management Service (IPMS), that runs on all Workforce HR/Payroll
servers to service remote configuration requests
All actual changes are made by the IP Management Service (IPMS). For tasks
involving creating, deleting, and getting information about databases, the IPMS
Workforce HR/Payroll Solution Manager
uses the SQLDMO API to communicate with SQL Server. For upgrades and other
changes to the content of a Workforce HR/Payroll database, the IPMS invokes
BiDBWiz. Other changes involve changes to files or registry entries on the local
machine.
To edit the Workforce HR/Payroll configuration on a remote server, you must
register the remote server with the Solution Manager GUI. Then, depending on
the functions for which the server is responsible, the following actions are
available:
• Web servers
– Create and delete webs (virtual directories on a web server) — For
Workforce HR/Payroll Administration, Self Service, and jobs sites.
• Database servers
– Create new database — Creates a blank database
– Backup/restore database — Similar to functions in SQL Server 2005
Management Studio, except that Solution Manager also fixes restored
databases (see below).
– Change install code — Updates the Workforce HR/Payroll license.
– Build new database — Initializes a database from the Workforce HR/
Payroll .BAK file
– Copy database — Creates a blank database.
– Upgrade — Upgrades a Workforce HR/Payroll database to the latest
version available on the database server.
– Fix restored database — Resets security permissions that may have been
destroyed in a backup/restore cycle. Also drops users from the database
who are not SQL Server users on the machine and creates or resets
internally set user accounts. Resets the permissions of MSDB and
MASTER database objects.
– Delete database
• Application servers (payroll processing; usually on the same machine as the
database server)
– View legislative update logs.

Solution Manager uses the command-line Visual Basic application (.exe)

BiDBWiz to perform database operations on the local machine. BiDBWiz uses the
Microsoft ADO API or the ISQL client program in order to send SQL to the
RDBMS. It is installed on Workforce HR/Payroll database server machines only.
BiDBWiz is driven by .ini files, which specify lists of SQL scripts to run.
Different sections of the file can be run depending on the current Workforce HR/
Payroll database version number to accommodate patches. Script execution can
be ordered so that dependencies are satisfied.
The main functions of BiDBWiz are as follows:
• Create a database backup file — A database backup file is created at build
time and shipped with the application so that you do not need to process
thousands of scripts at install time.
• Create an initialized database — A backup image is made and restored into
an existing database. Then, BiDBWiz runs an upgrade on the database so that
patches made since the backup was created are applied to the new database.
• Upgrade a database — Incremental changes are applied to bring a database
up to the latest version on the machine. Any version of the Workforce HR/
Payroll database is upgradeable to the latest version, because BiDBWiz is
driven by the .ini file that contains database changes for each major/minor
release. BiDBWiz upgrades the database by comparing the database version
that is stored internally in the database and the version that is stored in the
Windows registry.
• Change install code (license) — Your installation code is updated if you
purchased Workforce Payroll after you purchased and licensed Workforce
HR.
Multiple instances in a Workforce HR/Payroll environment
Multiple instances in a Workforce HR/Payroll environment

Workforce Central v6.1 allows you to install multiple instances of the application
on the same machine, as explained in “Configuration Manager” on page 29. The
Configuration Manager utility lets you create, modify, or delete an instance of
Workforce Central.
The most common use of multiple instances in a Workforce HR/Payroll
environment is to have several instances of Workforce Central running on the
same physical server, but each instance is connected to a separate database. A
typical use of this configuration is separate instances and databases for training,
testing, and production.


Chapter 4
Combined Workforce Timekeeper and
Workforce HR/Payroll installation
With Workforce Central v6.1, Workforce Timekeeper and Workforce HR/Payroll

can be installed on a single machine connected to a single database.
When Workforce HR/Payroll is running in an integrated environment with
Workforce Timekeeper, the Workforce HR/Payroll system is considered the
master. When events occur that might require Workforce Timekeeper data to
change, Workforce HR/Payroll sends these data changes to Workforce
Timekeeper APIs.
For example, when a new employee is hired, Workforce HR/Payroll sends the
employee’s demographic and other information to Workforce Timekeeper APIs
that cause the same person to also appear in the Workforce Timekeeper database.
Topics discussed in this chapter are:
• “Workforce Central platform in an integrated environment” on page 102
• “Requirements for a combined environment” on page 103
• “Integrating Workforce HR/Payroll and Workforce Timekeeper” on page 105
• “Data synchronization” on page 107
• “Synchronizing data” on page 115

Chapter 4 Combined Workforce Timekeeper and Workforce HR/Payroll installation
Workforce Central platform in an integrated environment

When you install Workforce HR/Payroll and Workforce Timekeeper in an
integrated environment, the database can reside on a separate machine or on the
same machine as the Workforce Central applications.
If your database resides on a separate machine, when you install Workforce HR/
Payroll, you must install the Payroll Engine and Database Server on the same
machine as the database and the Web Server on the same machine as the
Workforce Timekeeper application server and web server.
Other important points about an integrated Workforce HR/Payroll and Workforce
Timekeeper environment are:
• Workforce Timekeeper must be installed in a combined web and application
server environment. You cannot configure Workforce Timekeeper to run with
a separated web and application server.
• If you install the Workforce HR/Payroll Web Server on multiple machines,
you must also use network load balancing.
• The Workforce Central platform is only installed on a database server when
the database server and the application server are the same physical machine.
• Workforce Timekeeper requires the Workforce Central platform for most of
its functions. Workforce HR/Payroll v6.1 also relies on the platform,
primarily because it uses Process Manager as an integral component of its
performance management and compensation management applications.
• With an integrated Workforce HR/Payroll - Workforce Timekeeper
environment, users can navigate between the Workforce HR/Payroll and
Workforce Timekeeper applications without logging on a second time.

Requirements for a combined environment
Requirements for a combined environment

Requirements for a combined Workforce HR/Payroll - Workforce Timekeeper
installation include the following:
• Homogeneous servers — Each server in the your environment must be
identical and run all of your Workforce Central applications. You cannot
install Workforce HR/Payroll on one machine and Workforce Timekeeper on
another, if both machines use the same database.
• System requirements — Combined Workforce Timekeeper and Workforce
HR/Payroll installations require the following on each machine in your
environment:
– The operating system must be Windows Server 2003 or Windows Server
2008.
– The web server must be Microsoft IIS.
– The application server must be JBoss.
– The Microsoft .NET framework must installed on each server.
– The database must be SQL Server 2005 or SQL Server 2008.
• No separation — In an integrated Workforce Timekeeper - Workforce HR/
Payroll environment, you cannot install the Workforce Timekeeper web
server and application server on separate machines. Because Workforce HR/
Payroll database queries are made directly from the web server (via .asp and
COM/.NET components), separation of the web and application servers on
machines that include Workforce HR/Payroll do not provide security benefits.
• Maintenance — Maintenance affects all Kronos applications. When a service
pack arrives from Kronos, it is applied to all Kronos servers.

System requirements
If you are using both Workforce Timekeeper and Workforce HR/Payroll, the
application server must be JBoss, the web server must be IIS, and they must both
be installed—along with the Workforce Central platform—on every machine in
the environment (they cannot be separated). The database must be SQL Server.
Specific requirements are:
Item Requirement
Operating system1 • Microsoft Windows Server 2003 (32-bit), service pack 1 —
Standard, Enterprise, Datacenter, Small Business Server
Editions
• Microsoft Windows Server 2003 (32-bit) R2 — Standard,
Application server JBoss 4.3
Server JRE JRE 1.6.0_07 (1.6)
Network protocol TCP/IP
Web server software Microsoft IIS v6.0 (Windows Server 2003) or v7.0 (Windows
Server 2008):
• World Wide Web Server enabled
• SMTP Service enabled
• ASP.NET must be installed for Windows Server 2003
Client browser Microsoft Internet Explorer 6.x, 7.0
Database SQL Server 2005, service pack 2+, SQL Server 2008
• Microsoft .NET Framework 2.02 installed on every machine
1 Workforce Central automatically supports security and bug service packs specific to
these operating systems. No new Workforce Central release is necessary to support
these updates.
2 Workforce HR/Payroll automatically installs Microsoft .NET framework if it is not present on
the machine. However, the Workforce HR/Payroll uninstall procedure does not remove. NET; if
you want to remove it, you must do so manually.

Integrating Workforce HR/Payroll and Workforce Timekeeper
Integrating Workforce HR/Payroll and Workforce

Timekeeper
Integrating Workforce HR/Payroll v6.1 with the time and labor components of
Workforce Central v6.1 (timekeeping, scheduling, activities) enables you to use
Workforce HR/Payroll to maintain a subset of data that is common across
applications. This common data includes:
• Employee badge numbers
• Employee personal information
• Labor management information
• Job and organization information (if organization mapping is enabled)
• Skills and certification information (if Workforce Scheduler is installed)
Note: Workforce HR/Payroll v6.1 can be integrated only with other Workforce
Central v6.1 products.
The integration of Workforce HR/Payroll and the time and labor components of
Workforce Central consists of a combination of real-time application
programming interfaces (APIs) and dedicated database views:
• A single database makes data easily accessible across applications.
• Real-time APIs handle the transfer of employee information from time and
labor-specific pages in Workforce HR/Payroll to Workforce Central common
database tables.
Various Workforce HR/Payroll application pages provide a data entry interface to
Workforce Timekeeper. When you enter information on such pages, Workforce

Central APIs automatically update the appropriate Workforce Timekeeper

database tables. The information is then accessible to both applications.

Data synchronization
This section contains the following topics:
• “Scope of data synchronization” on page 107
• “Terminology” on page 108
• “Employee personal data” on page 108
• “Licenses, profiles, roles, and primary accounts” on page 109
• “Jobs and organizations” on page 110
• “Skills and certifications” on page 112
• “Synchronization processor” on page 112
• “Queue assistants” on page 113
Scope of data synchronization

When Workforce HR/Payroll is integrated with the time and labor components of
Workforce Central, the following data can be managed using Workforce HR/
Payroll:
• Employee badge numbers
• A subset of employee personal information (see “Employee personal data” on
page 108)
• License, profile, role, and primary account information (see “Licenses,
profiles, roles, and primary accounts” on page 109)
• Job and organization information, if organization mapping is enabled (see
“Jobs and organizations” on page 110)
• Skills and certification information, if Workforce Scheduler is installed (see
“Skills and certifications” on page 112)
Workforce HR/Payroll automatically updates the appropriate time and labor

database tables using Workforce Central APIs.

Terminology
Even though the same or similar concepts exist across Workforce Central
products, some of the terminology varies between the products. The following
table correlates the key integration-related terminology.
Workforce HR/Payroll Term Time and Labor Term

employee position job assignment
position job in an organizational map
organization type location type
organization code node in an organizational map
employee skill person skill
skill code skill
skill start date skill effective date
employee event of type certification certification
certification event date certification grant date
compensation code pay code
attendance plan code accrual code
Employee personal data

In an integrated system, Workforce HR/Payroll stores the following basic
employee personal information in Workforce Central platform database tables:
Employee ID Telephone Number

First Name Address Type
Middle Initial Street
Last Name City
Nickname State
Hire Date Postal Code
Base Hourly Wage Country

Birth Date Email Type

Employee Standard Hours Email Address
Full Time Standard Hours Employment Status
Supervisor Full Name Employment Status Effective Date
Telephone Contact Type
Note: In Workforce HR/Payroll, the Hours Per Week value on the Employee >
Employment > Pay Status page maps to the Employee Hours value on the Leave
Management time and labor page.
In Workforce HR/Payroll, the Hours Per Year value divided by 52 on the Position
Management > Position page maps to the Full-Time Hours value on the Leave
Management time and labor page.
Licenses, profiles, roles, and primary accounts

In an integrated system, Workforce HR/Payroll stores the following license,
profile, role, and primary account data in time and labor database tables:
License Types Pay Codes Profile (Manager Role)

Pay Rule Work Rule Profile (Manager Role)
Wage Profile Reports Profile (Manager Role)
Worker Type Organizational Group (Manager Role, if job
and organization mapping is enabled)
Device Group Job Transfer Set (Manager Role, if job and
organization mapping is enabled)
Accrual Profile Schedule Group Profile
Schedule Group Shift Template Profile
Schedule Rule Set Pattern Template Profile
(if Workforce Scheduler is installed)

Activity Profile Availability Profile

(if Workforce Activities is installed) (if Workforce Scheduler is installed)
Default Activity Time Entry Method (Employee Role)
(if Workforce Activities is installed)
Idle Time Labor Level Transfer Set (Employee Role)
Meal (if Workforce Activities is Pay Codes Profile (Employee Role)
installed)
Default Team Work Rule Profile (Employee Role)
Login Profile Job Transfer Set (Employee Role, if job and
organization mapping is enabled)
Function Access Profile Primary Account
Display Profile Schedule Job List Seniority Dates
(if job and organization mapping is enabled
and Workforce Scheduler is installed)
Employee Group (Manager Role) Pay Codes Profile (Manager Role)
Labor Level Transfer Set
(Manager Role)
Jobs and organizations

When Workforce HR/Payroll is integrated with the time and labor components of
Workforce Central, you can construct an organization tree in Workforce HR/
Payroll and share it with Workforce Central. This enables you to maintain job and
organization information in one place.
You can also specify that Workforce Central use its own organizational maps. In
this case, organizational data is not shared between Workforce HR/Payroll and
Workforce Central.

The following Workforce HR/Payroll system settings govern job/organization

mapping:
• Workforce Timekeeper Organization Tree
• Workforce Timekeeper Job Labor Level
Sharing an organization tree with Workforce Central is optional; you can set up an
integrated system without enabling this feature.
Note: Because all employees must be assigned to Workforce HR/Payroll

positions, if you enable job and organization mapping, the system assigns all
employees to jobs in the time and labor organizational map. Conversely, if you do
not enable job and organization mapping, the system does not assign any
employees to jobs in the time and labor organizational map. Currently, there is no
way to assign some employees but not others to jobs in the time and labor
organizational map.
If job and organization mapping is enabled, Workforce HR/Payroll stores the

following job and organization data in time and labor database tables:
Job Information
Job Name Labor Level Entry Name
Job Description Labor Level Entry Description
Job Code Job Status
Job Title Sort Order
Organization Information
Change Date Start Effective Date
Location Number End Effective Date
Parent Location Number Description
Location Type Labor Level Entry
Location Name

Skills and certifications

If Workforce Scheduler is installed and integrated with Workforce HR/Payroll and
Workforce Central, you can maintain skill codes, event codes of type
Certification, and employee skill and certification assignments using Workforce
HR/Payroll. This information is stored in time and labor database tables.
Maintaining skill and certification information involves two separate tasks: you
must first populate the skill code table with skill codes and the event code table
with events of type Certification. You must then assign skills and certifications to
the appropriate employees. When this is complete, both the codes and employee
attributes are stored in time and labor database tables.
If Workforce Scheduler is installed, Workforce HR/Payroll stores the following
skill and certification information in time and labor database tables:
Skill Name Certification Name

Skill Effective Date Certification Effective Date
Skill Expiration Date Certification Expiration Date
Skill Status Certification Number
Synchronization processor
A synchronization processor handles the transfer of information from Workforce
HR/Payroll to time and labor database tables or Workforce Central platform
database tables. When time and labor information is entered in Workforce HR/
Payroll, the following occurs:
• If the information is current-dated, the update is immediately sent to the time
and labor database tables. (Note that if the information is back-dated, the
update is immediately sent to the time and labor tables with an effective date
of the current day.)
• If the information is future-dated, and the time and labor tables can store the
effective date, the update is immediately sent to the time and labor tables. The
change becomes effective on the designated date.

• If the information is future-dated, but the time and labor tables cannot store
the effective date, the update is placed in a queue and sent to the time and
labor tables on its effective date.
Even though the synchronization processor runs when an item is added to the
synchronization processor queue, it is recommended that the HRIS manager set
up a scheduled job in SQL Enterprise Manager to start the processor early each
morning to process requests that are to become effective that day. The SQL
Enterprise Manager job must be set up to run the stored procedure
sp_WTK_StartSyncProcess.
The HRIS manager can use the event log on the database server to investigate
synchronization processor errors.
Synchronization processor system settings
The following system settings determine how long entries stay in the
synchronization processor queue.
• Number of days to Purge Successful Transaction
• Number of days to Purge Error Transaction
These settings enable items that require attention to remain in the queue longer
than items that do not require attention. The synchronization processor
periodically triggers a stored procedure to clean up the queue based on the current
system parameter settings.
Queue assistants
Two queue assistants enable the HRIS manager to monitor the synchronization
processor for errors:
• “System Queue Assistant” on page 114
• “Employee Queue Assistant” on page 114

System Queue Assistant
The System Queue Assistant provides a view of all items currently on the
synchronization processor queue. The following information is shown for each
item on the queue: item status, employee name and ID, the type of data to be
updated, date and time queued, effective date, transaction date and time for items
successfully sent, and an error description for items that could not be sent.
You can view details of individual items in the form of XML files and delete
individual items from the queue.
In addition, you can place employee information for all employees in the queue to
fully synchronize this information between Workforce HR/Workforce Payroll and
Workforce Central.
To access the System Queue Assistant, select System > Queue Assistant in the
Workforce HR/Payroll Administration navigation tree.
Employee Queue Assistant
The Employee Queue Assistant shows items currently on the synchronization

processor queue for a selected employee. The following information is shown for
each item on the queue: item status, the type of data to be updated, date and time
queued, effective date, transaction date and time for items successfully sent, and
an error description for items that could not be sent.
You can view details of individual items in the form of XML files and delete
individual items from the queue.
To access the Employee Queue Assistant, select Employee > Workforce
Timekeeper > Queue Assistant in the Workforce HR/Payroll Administration
navigation tree.

Synchronizing data
Synchronizing data
In an integrated Workforce Timekeeper - Workforce HR/Payroll environment, you
must synchronize the data between the two systems when you install Workforce
HR/Payroll v6.1 and Workforce Timekeeper v6.1 for the first time.
Although the process to synchronize data is described in detail in the Installing
Workforce HR/Payroll and Workforce Timekeeper guide on the documentation
CD, you should be aware of the following implementation considerations:
• The Workforce HR/Payroll user name (HRMSUSER) and password are
automatically created when Workforce HR/Payroll is installed. The APIs use
this user name to move information between Workforce HR/Payroll and
Workforce Timekeeper. If you change this user name, you must specify the
new user name in the Labor Management API Login User Name system
setting.
• Make comparable compensation/pay codes the same in both Workforce HR/
Payroll and Workforce Timekeeper. For example, use the code “REG” (for
regular pay) in both systems. Do not use “REG” in one system and
“REGULAR” in the other system.
• Workforce HR/Payroll attendance plan codes must match Workforce
Timekeeper accrual codes in order to successfully transfer accruals from
Workforce HR/Payroll to Workforce Timekeeper.
• Assess the payroll GL account requirements of your accounting/payroll
department. Set up labor levels so that they represent GL accounts.
• Determine how your payroll department captures and reports hours on pay
stubs. For example, if an employee works 40 hours on Shift 2, the shift
differential might be captured and reported as either “40 Regular and 40
Shift2” or “40 Regular 2.” If the payroll department expects “40 Regular and
40 Shift2,” set up the Workforce Timekeeper pay code distribution to
accommodate this.
• Set up default labor management profiles initially, then modify the
information for individual employees as necessary. This ensures that the
employee position information is accessible in Workforce Timekeeper.

• Workforce HR/Payroll accepts full-time equivalency (FTE) data based on

ratios but not percentages. Therefore, when entering FTE data in Workforce
Timekeeper, use only the Ratio FTE option; do not use the Percentage FTE
option.
• In Workforce Timekeeper, if you change the way unspecified labor level
entries are represented in labor account strings from a dash to some other
character, Workforce HR/Payroll does not display the labor account strings
properly. Therefore, in Workforce Timekeeper, do not change the way
unspecified labor level entries are represented; leave them as dashes.
• The default Workforce Manager start page does not contain an icon for Labor
Management. For general instructions on creating an icon, see “Adding,
Editing and Deleting Menu and Menu Items” in Workforce HR/Payroll
Administration Help. You can copy the relevant values from the Labor
Management menu item (System > Self Service Settings> Self Service
Editor > Role Editor tab > Employment Information > Labor
Management).
• When you set up an organization tree to send to Workforce Timekeeper, make
all organization types and codes unique. Workforce Timekeeper does not
allow duplicate location types or codes in the same tree.

Chapter 5
Licensing Workforce Central products
You must license each Workforce Central product to enable it to support the
functionality and capacities that you purchased with your system. The type of
license(s) assigned to each user defines the products available to the user and the
scope of responsibility that the user can perform.
In addition, the product license supports capacities or maximum number allowed
for employees and managers.
This chapter contains the following sections:
• “Required licenses” on page 118
• “Types of licenses” on page 120
• “Licensing process” on page 122
• “Licensing Workforce Timekeeper” on page 124
• “Licensing Workforce HR/Payroll” on page 126
• “Suite license interaction” on page 127
Chapter 5 Licensing Workforce Central products
Required licenses
If you are installing Workforce Central products for the first tim, you must acquire
the applicable licenses from Kronos before you start the installation process.
If you are upgrading from v5.2 or v6.0, the licensing requirements vary depending
on the version you are upgrading from.
Upgrading from v5.2

If you are upgrading from v5.2, you must acquire the applicable v6.1 licenses
before you start the installation procedure. A v6.1 license is required for each
product that you purchase. Product licenses also support capacities for the
maximum number of employee, administrative, or manager users that are
allowed.
• Workforce Forecast Manager
• Workforce Operations Planner
• Workforce Leave
• Workforce Attendance
• Workforce Record Manager
• Workforce Employee
• Workforce Manager
• Workforce Tips & Tokes
Note: Workforce Device Manager does not require a separate license.

Required licenses
Upgrading from v6.0

If you are upgrading from v6.0:
• New licenses are not required to upgrade your current products.
• New licenses are required if you are adding a new product (such as Workforce
Scheduler or Workforce HR/Payroll) or changing the employee or user
capacities that the system allows.
• Workforce Connect licenses are not valid in v6.1. If you are installing
Workforce Integration Manager, you must acquire a Workforce Integration
Manager license.
Workforce HR/Payroll requires that you enter the license serial number and
installation code during the installation procedure. The applications in the
Workforce Timekeeper installation kit do not require you to enter the license
number during the installation procedure.

Types of licenses
The Workforce Central suite has several implementations to ensure that each
product within the suite is properly licensed.
Workforce Central supports two main categories of licenses,
• Product — Allows you to purchase the rights for either a site or a number of
people to access the overall functionality of one or more Workforce Central
products, such as Workforce Timekeeper, Workforce Scheduler, Workforce
HR/Payroll, or Workforce Activities.
• Interactive — Allows you to purchase the rights for individual users to
access the Workforce Central suite and to use the features of the products.
There are two types of interactive licenses:
– Manager or Supervisor access license
– Employee access license
Suite product licenses

Depending on the Workforce Central products that you purchase, you are granted
one or more of the following employee-based product licenses:
• Workforce Device Manager

Types of licenses
Suite interaction licenses

Suite interaction licenses control the ability of users to interact within the
Workforce Central suite. There are two types of interaction licenses:
• Workforce Employee — The Workforce Employee license controls a user’s
ability to use all employee self-service functions available. The employee
self-service functions that are present depend on the products that have been
purchased and for which employees they are licensed.
For example, if you install both Workforce HR and Workforce Timekeeper,
self-service functions include all employee roles functions in Workforce HR
and all employee time entry and reporting functions in Workforce
Timekeeper. Workforce Employee licenses can access Workforce Timekeeper
with either a Java or HTML user interface.
An employee who has a Workforce Employee license must also be assigned a
suite product license.
• Workforce Manager — The Workforce Manager license controls a user’s
ability to access the Workforce Central suite and use the available manager
functions. The functions that are available depend on the product licenses that
have been installed.
– For Workforce Timekeeper, Workforce Scheduler, Workforce Accruals,
and Workforce Record Manager, an employee who has a Workforce
Manager license is not required to have additional product licenses.
– For Workforce HR/Payroll, employees must split their role license into
two distinct licenses, one for Workforce Employee and the other for
Workforce Managers.
Any user of the Workforce Central suite must have at least one of the above
interaction licenses, but may have both. A person cannot log on to the Workforce
Central suite without at least one of these licenses.

Licensing process
A license authorization number is required to generate a license file for your
software. You should receive a license authorization number in an e-mail from
Kronos when your licensed software is processed and completed.
After you install Workforce Central v6.1 products, you must copy your product
licenses to the following folder on all Workforce Central machines in your
environment:
\Kronos\wfc\licensing
If you later add a product, you must also copy the new license to this folder.
Note: If you are installing Workforce Timekeeper on a UNIX machine, you

should generate the applicable licenses on the Windows companion server first
and then copy the licenses from the Windows machine to the UNIX machine.
Upgrading license levels

Workforce Central licenses are incremental. This means that if you add to your
license level to increase the number of employees licensed for a product, you only
need to add the new license to the \Kronos\wfc\licensing folder.
An incremental license increments in the following circumstances:
• Any incremental license for the same product as long as the version within the
license files are the same.
• An existing feature license for the same product as long as the version within
the license files are the same.
Verifying license information

After you generate license files and install a Workforce Central application, you
can verify the license information in the following way:
1. Log on to the Workforce Central system by entering the following in a
browser:
http://ServerName/wfc/logon
where ServerName is the name of your web server.

Licensing process
2. Log on to Workforce Central.

3. From upper-left side of the Workforce Central workspace, click Setup, and
then select System Information from the System Configuration box.
4. Click the Licenses tab. The following is an example listing of products and
licensing information you might see:
The Limit values represent the employee and manager capacities for each product
and are controlled by the product’s license file that you generated. These values
should match the maximum number of employee licenses that you purchased.
Contact information for licensing problems

If you have problems with the licensing instructions, contact Kronos by e-mail at
support@kronos.com, or call your local Kronos office or Kronos authorized
dealer. Specify that you are having trouble generating your licenses from the
Kronos Licensing web page.

Licensing Workforce Timekeeper

The Workforce Timekeeper v6.1 installation programs do not deliver a product
license. Although you can complete the installation process and start configuring
your system without a license, you cannot enter people records into your system.
Therefore, you should obtain your license files early in the installation process.
The Workforce Timekeeper licensing functionality uses plug-ins, the database,
properties and FlexLM software to implement the validation and assignment of
licenses.
Each product or product area may also choose to provide additional enforcement
criteria for its license type.
The basic license handling is performed by the Workforce Central platform. The
platform interacts with the FlexLM manager to obtain the maximum allowed
licenses by type and with the database to link the FlexLM entry to a type and
model. The database is also used to count the number of licenses assigned for a
seat-based model.
The following are special considerations for common Workforce Timekeeper
configurations:
• Multiple servers — Every server in your environment must include all
license files in the Kronos\wfc\licensing directory. If you install
Workforce Timekeeper on more than one server, you must manually copy all
of the license files to each application and web server.
• Upgrading — When you upgrade to v6.1 by uninstalling the earlier version
of Workforce Timekeeper, all licensing directories are removed. Therefore,
you must copy all licensing files to a temporary folder before you upgrade.
When the upgrade is complete, copy all licensing files to the
\Kronos\wfc\licensing folder.
Earlier versions of Time & Labor and Scheduling products may have placed
licenses in the following folder:
\Kronos\wfc\applications\xxx\licensing
where xxx is the 3-character abbreviation of the application—wtk or wfs, for
example).

Licensing Workforce Timekeeper
With Workforce Central v6.1, these individual application licensing folders

have been eliminated and you must manually move all licensing files to
\Kronos\wfc\licensing.
• UNIX installations — If you are installing Workforce Timekeeper on a
UNIX machine, log on to the UNIX server and copy the license file or files
that you created for the Windows companion server to the UNIX server using
FTP:
cd /usr/kronos/wfc/licensing
put filename.lic
Repeat this for each license file.

Licensing Workforce HR/Payroll

You will receive the license authorization information in an e-mail after Kronos
ships your order. The e-mail includes a serial number and an installation code. The
Workforce HR/Payroll installation program requires you to enter this information
before you can install the product.
Unlike Workforce Timekeeper, Workforce HR/Payroll does not use the FlexLM
software to implement the validation and assignment of licenses.
When you install Workforce HR/Payroll, however, a license called
hrdefault.lic is delivered to the Kronos\wfc\licensing folder. This
platform license is not an interactive license and is not be sent to Workforce
Timekeeper or the platform as part of an employee request, but it must be present
in the Kronos\wfc\licensing folder in the platform in order for an
employee to be added to the platform.

Suite license interaction
Suite license interaction

Manager and employee licenses are shared across the suite. This means that if a
person is a manager in Workforce HR/Payroll, this person must have a Workforce
Timekeeper manager license as well. An employee in Workforce Timekeeper
must also have an employee interactive Workforce Timekeeper license.
Licenses can be accessed either explicitly or implicitly:
• Explicit selection of a license is when a user navigates to the Profile control
and selects the License check box.
• Implicit selection of a license means that an action in Workforce HR/Payroll
causes a suite-wide license to be turned on or off for a particular employee. As
the following table shows, Workforce HR/Payroll does not implicitly set
licenses if Workforce HR/Payroll employee self-service is not installed.
Employee and manager licenses are interactive licenses. If Workforce HR/
Payroll does not have an interactive user component (employee self-service),
it should not set license information implicitly.
Manager License Employee License
Scenario Implicit Explicit Implicit Explicit
Workforce HR/Payroll only

Employee self-service not installed No No No No
Employee self-service installed Yes No Yes No
Workforce HR/Payroll and Workforce Timekeeper
Employee self service not installed No Yes No Yes
Employee self service installed Yes Yes Yes No

Additional points to consider include the following:

• Actions that implicitly turn on or off an employee license include the
following:
– When you hire an employee, an employee license is assigned to the
employee.
– When you terminate an employee, the employee license assignment is
removed.
• Actions that implicitly turn on or off a manager license include the following:
– Assigning employee A to report to employee B causes employee B’s
manager license to be activated (if it is not already activated).
– Removing all employees who report to an employee with a manager
license removes the employee’s manager license (unless the license has
been explicitly turned on). This can happen when a single employee’s
supervisor is changed or during a Mass Supervisor Change function. This
can also happen when a supervisor’s last employee is terminated or when
the last employee now works for someone else (transfer, promotion, etc.).
– When the “Change Supervisor” control is used to update a group of
employees’ supervisor, the license information for each employee who
should have the manager license turned on or off is updated.
• When Workforce HR/Payroll and Workforce Timekeeper are both installed,
employee and manager license information is sent as a part of every employee
synchronization request.
• If Workforce HR/Payroll self-service is installed and a person is a manager in
Workforce HR/Payroll self-service, this person must also have a manager
license in Workforce Timekeeper. This is to maintain the manager license
enforcement across the suite. However, if HR self-service is not installed, a
person can have a manager license in Workforce Timekeeper and not be a
supervisor in Workforce HR/Payroll.

Chapter 6
SSL security considerations
The default communication method that Workforce Central uses is HyperText

Transport Protocol (HTTP). With HTTP, much of the data between users and the
system is text-based and, therefore, easily readable. If you require greater security,
you can configure your server to use HyperText Transport Protocol Secure
(HTTPS), which uses Secure Sockets Layer (SSL) to encrypt the data.
Specific characteristics of each protocol include the following:
• HTTP communication — HTTP is the primary communication protocol of
the Web. It transmits data unencrypted. Security-sensitive data such as user
name and password are transmitted “in the clear” when using HTTP without
SSL.
• HTTPS communication — HTTPS is simply the HTTP protocol secured
with SSL. SSL provides server authentication (and optional client
authentication), privacy, and data integrity. Public key cryptography and
digital certificates are the basis for the security features of SSL. Typically, a
different port (port 443 instead of port 80 for HTTP) is used by the web server
to listen for HTTPS communication.
This chapter contains the following sections:
• “Implementing SSL with Workforce Central” on page 130
• “General considerations” on page 131
• “SSL secured data paths” on page 132
• “Certificates, keys, and credential stores” on page 133
• “SSL and Workforce HR/Payroll” on page 136
• “SSL and Workforce Timekeeper” on page 137
• “Configuring Workforce Central to use an SSL terminator” on page 138
Chapter 6 SSL security considerations
Implementing SSL with Workforce Central

In general, using SSL with Workforce Central is a three-step process:
1. Acquire SSL key and certificate files.
2. Install your Workforce Central application.
3. Configure your Workforce Central application for SSL.
The complexity of these steps depends on your specific Workforce Central
configuration and requirements. For example, if you install Workforce
Timekeeper in a typical environment, you only need to provide the key and
certificate files; the Workforce Timekeeper installation program configures SSL
automatically. If you install Workforce Timekeeper in a custom environment, the
process is more manual.
This chapter provides background information and describes how to prepare for
SSL before you install Workforce Central applications. The actual configuration
instructions are included with specific application installation documentation.

General considerations
General considerations
Regardless of the Workforce Central application that you are installing, you
should consider the following before you implement an SSL environment:
• Network performance — SSL imposes a significant processing overhead on
network communication. Depending on your particular security and
scalability needs, you should evaluate the appropriate options, including the
possible use of SSL hardware devices to offload Workforce Central servers.
• Greater configuration complexity — SSL configuration involves additional
steps, including the generation and installation of certificates. These
procedures are potentially error prone and, depending on certificate choices,
may require installation of certificates on all web browsers used with
Workforce Central. Evaluate all impacts carefully before undertaking the
implementation of SSL security.
• Multiple servers — If you use multiple servers and choose to use SSL, you
must use SSL for all the servers in your environment. Kronos does not
support mixing SSL and non-SSL servers in your Workforce Central
environment, for the following reasons:
– Mixing secure and non-secure systems lowers the security of the
combined systems to non-secured status.
– A primary benefit of using SSL with Workforce Central is to protect
passwords when logging on to the system. If two servers are configured to
use the same database (and thus have the same set of users), any password
compromise resulting from the use of the non-secure system would allow
access when using the SSL-protected system.
– Attempting to configure SSL and non-SSL servers in a multi-server
environment is complex and may be difficult to manage.

SSL secured data paths

The following data communication paths within Workforce Central can be
secured with SSL:
• Web browser to web server — This is the most commonly used
communication path. SSL is supported by all web browsers supported with
Workforce Central 6.1. Web browsers need to have or obtain trusted
certificates to properly authenticate the web server. Web browsers are
preconfigured with root certificates, which can be used check the identity of
any web server that is secured with SSL certificates issued by those same
roots. Well known Certificate Authorities (CA) include Verisign, Equifax,
Thawte, and others.
• Workforce Central clients to web server or application server —
Workforce Central components can use SSL to protect communications with
the server.
Application servers can also contact other application servers using SSL for
tasks such as executing events or running reports. Currently, these SSL clients
do not authenticate the server’s identity with trusted certificates.
• Workforce Central application server to LDAP directory server —
SSL-secured Lightweight Directory Access Protocol (LDAP) communication
is also supported with Workforce Central v6.1. With LDAP, a directory server
runs on a host computer and various client programs that understand the
protocol can log on to the server and look up entries, services, and devices
User logons that are configured to use an LDAP directory for authentication
require password transmission between the Workforce Central server and the
LDAP server. This communication can also be protected with SSL. The
LDAP over SSL combination is known as the LDAPS protocol, much as
HTTP over SSL is HTTPS.

Certificates, keys, and credential stores

Certificates can be obtained in a variety of ways. For testing, it is common to
generate self-signed certificates. These certificates are easy to create and do not
require an external certificate authority (CA), but in general, they are less secure
than certificates signed by a CA.
When configuring a web server for SSL, an additional consideration is the option
to use certificates that are signed by root certificates that are “pretrusted” by
popular browsers. The root certificates are maintained by well known public CAs,
and by virtue of being preinstalled in browsers, they eliminate the need for
browser users to import new roots, or to be confronted by warnings about un-
trusted certificates.
Public CAs are typically accessible online. You generate certificate requests
locally, then use a web site or e-mail to transmit the request to the CA for signing.
You then copy the signed certificate to your target server and configure it for use.
Because the Workforce Timekeeper installation program requires that you identify
the location of the SSL key and certificate files, you should obtain the required
files before installing Workforce Timekeeper.
Methods to obtain these files before the installation include:
• OpenSSL toolkit — OpenSSL is an open source toolkit for SSL that includes
tools for managing keys and certificates. You can download the OpenSSL
toolkit from:
http://www.openssl.org/related/binaries.html
The CA.sh or CA.pl certificate authority scripts are an easier-to-use
interface for using OpenSSL as a certificate authority.
• Java Keytool — The Java Keytool utility enables you to administer your own
public/private key pairs and associated certificates for use with SSL. It also
allows you to store the certificates of your communicating peers.
Keytool stores the keys and certificates in a keystore or truststore:
– Keystores — Used to store keys and certificates for Java-based SSL
servers, like the JBoss application server. Keytool can generate keys and
certificate requests and then import the signed certificate into the
keystore.

– Truststores — Used by Java-based SSL clients such as application

servers that initiate communication with other servers or LDAP
directories. With basic forms of SSL, the client only needs to verify the
certificate presented by the server. The truststore holds certificates used to
perform this verification. Keytool is used to import the root certificates or
server certificates of those servers that should be trusted.
• IBM Keyman — Keyman is an IBM tool for managing credential stores. It is
not needed to configure Workforce Central for SSL. It can be useful if you
already have certificates in a file format that Keytool or OpenSSL do not
support. For more information:
http://www.alphaworks.ibm.com/tech/keyman/download
If you cannot obtain the key and certificate files before you install Workforce
Timekeeper, you can install blank (empty) files and replace them with the correct
files after you install Workforce Timekeeper by using the OpenSSL toolkit or
Keytool that are delivered by the Workforce Timekeeper installation program:
• OpenSSL toolkit is located in \Kronos\wfc\bin\openssl.exe. The
CA.sh or CA.pl certificate authority scripts, however, are not provided; you
must get them from an OpenSSL distribution.
• Keytool is located \Kronos\jre\bin\keytool.exe.
Certificates
The following types of certificates can be used with Workforce Central:
• Self-signed certificate — Self-signed certificates are generally used in
testing, because they are easier to generate, and security requirements are low.
Both Java keytool and openssl can be used to generate self-signed certificates.
• Certificate Authority signed certificate — A Certificate Authority (CA) is
generally used in production environments, for several reasons:
– Stronger security — Unlike self-signed certificates, signing is controlled
by a central authority that can require minimum standards of
identification before issuing certificates.
– Hierarchical trust — Hierarchical Trust provides scalability. When a
large number of servers use certificates issued by the same Certificate

Authority, only the single CA root certificate needs to be trusted by

clients. This avoids the N*N certificates that would be configured (for N
servers) with direct trust—not using a CA.
– Public roots — Certificates can be purchased from well known public
Certificate Authorities. These certificates are trusted by browsers by
default, so no trust configuration is necessary at the client.
• Certificate chains — A server that uses a certificate signed by a Certificate
Authority is using a certificate chain of two certificates:
1. The CA’s self-signed root certificate
2. The server SSL certificate
An arbitrary chain of trust can be created by CAs that issue other CA
certificates, and so on. Trust is verified in any given certificate by verifying
that it was signed by the CA certificate that issued it. An SSL server
certificate is validated by verifying each link in the chain, starting at the server
certificate and working up the chain to the root certificate (which must be
trusted implicitly).
Note: Do not use SSL certificate key lengths larger than 4096 bits. This is the
maximum supported by Java Cryptography Extension 1.5, which is used by
Workforce Central v6.1.
Credential stores and keys

Credential stores are repositories for user credentials to be used during the user
authentication transaction. The keys found in SSL credential stores are usually
RSA public or private keys, although it is possible to use other public key systems
such as DSA.
When generating a certificate request, a matching public and private keypair must
be generated. The private key is stored in the credential store and the public key is
included in the certificate request. When the request is signed and then imported
into the credential store, the public key in the signed request must match the
private key already in the credential store. With Keytool, they must match or the
import will fail, but even with Apache/OpenSSL key and certificate must match
for SSL to function.

SSL and Workforce HR/Payroll

The Workforce HR/Payroll installation program does not require you to identify
the SSL key and certificate files, which means that you can install Workforce HR/
Payroll, acquire the key and certificate files, and then configure Workforce HR/
Payroll for SSL.
Refer to one of the Workforce HR/Payroll scenarios (such as Install HR-Payroll or
Upgrade HR-Payroll) within the Workforce Central installation documentation
for instructions on configuring Microsoft IIS for SSL for use with Workforce HR/
Payroll.

SSL and Workforce Timekeeper
SSL and Workforce Timekeeper

Because Workforce Timekeeper v6.1 supports the ability to separate the web
server and application server, the following data paths can be secured with SSL:
• Between the browser and web server — Workforce Timekeeper v6.1
supports web server SSL implementations for typical and custom
installations:
– Typical installation — Although you must supply the appropriate
certificate and key files, the Workforce Timekeeper installation program
automatically configures Apache or Microsoft IIS with JBoss.
– Custom installation — Apache, Microsoft IIS, and IBM HTTP Web
Server require manual configuration for SSL when used with preinstalled
JBoss application servers.
• Between application servers — Workforce Timekeeper v6.1 supports SSL
implementations for JBoss applications servers.
Refer to the Workforce Timekeeper installation documentation for
instructions on configuring SSL interprocess communication for JBoss.
• Between application server and LDAP directory server — User logons
that are configured to use an LDAP directory for authentication require
password transmission between the Workforce Central server and the LDAP
server. This communication can also be protected with SSL. The LDAP over
SSL combination is known as the LDAPS protocol, much as HTTP over SSL
is HTTPS.
Refer to Installing Workforce Timekeeper for instructions on configuring an
LDAP directory server for use with JBoss.

Configuring Workforce Central to use an SSL terminator

When an SSL connection is established, an SSL handshake occurs and SSL
generates bulk encryption and decryption for each read-write. Because the
performance cost of this SSL handshake can be significant, some companies
install an SSL terminator device. An SSL terminator decrypts the SSL-encrypted
data and then sends it to the web server in an unencrypted state, so that the web
server does not have to perform decryption and the burden on its processor is
relieved.
If you use an SSL terminator in your Workforce Central environment, you must
configure Workforce Central to recognize the device properly:
1. Install Workforce Timekeeper in non-SSL mode as described in Installing
2. When Workforce Timekeeper is up and running:
a. Log on to Workforce Timekeeper.
b. From the upper-right corner of the workspace, click Setup, and then
select System Settings from the System Configuration box.
c. From the System Settings workspace, click the Security tab, and edit the
following settings:
site.security.ssl.termination.on — Set to true.
site.security.ssl.termination.host — Enter the name of the external SSL
terminator device.
site.security.ssl.termination.port — Enter the port number used by the
SSL terminator device. If using the default SSL port 443, you can leave
this setting blank.
d. Click Save.
e. From the System Settings workspace, select the Web & App Server tab.
Because you installed Workforce Timekeeper in non-SSL mode, you must
change the following settings from http to https:
site.webserver.applet.communication.protocol — Change this setting
to https.
site.webserver.communication.protocol — Change this setting to https.

Configuring Workforce Central to use an SSL terminator
f. Click Save.
3. Stop and restart Workforce Timekeeper.
4. After you make these changes and Workforce Timekeeper restarts, you will
access Workforce Timekeeper from the SSL terminator device instead of from
the web server. The logon URL is:
https://SSL_terminator/instance_name/logon
For example, if the SSL terminator name is XYZ11, you would enter:
https://XYZ11/wfc/logon


Chapter 7
Preinstallation requirements and checklists
Before you start installing Workforce Central products, you should collect all the
information that is required by the installation program. This chapter describes
prerequisites and provides a number of preinstallation worksheets that can
streamline the installation process. Specific topics include:
• “Preinstallation requirements” on page 142
• “Preinstallation worksheets” on page 145
Chapter 7 Preinstallation requirements and checklists
Preinstallation requirements
The the preinstallation requirements vary depending on whether you are installing
or upgrading Workforce HR/Payroll only, Workforce Timekeeper only, or
combined Workforce HR/Payroll and Workforce Timekeeper.
Workforce HR/Payroll
If you are installing Workforce HR/Payroll without Workforce Timekeeper, you
must do the following before you start the Workforce HR/Payroll installation
program:
• Ensure that the system requirements as outlined in Chapter 3, “Workforce
HR/Payroll,” on page 89 are met. Basically, you need at least one computer
running Windows Server 2003 or Windows Server 2008 with Microsoft IIS
and Microsoft .NET installed. The database must be SQL Server 2005 or SQL
Server 2008.
• Understand the configuration that you will be setting up, which is usually one
of the following:
– One machine with the application and database installed
– One machine with the application and another with the database
1. Back up your servers.
2. Make sure all users are logged off the servers that you plan to use.
3. Close any Windows or DOS applications.
4. Disable virus scan software to reduce installation time.
5. Verify that the SQL Server authentication is set up for mixed mode—SQL and
Windows authentication—on all servers:
a. Select Start > Programs > Microsoft SQL Server > SQL Server
Management Studio.
b. In the Connect to Server dialog box, enter the appropriate information for
your environment and click Connect.
c. From Management Studio, right-click the server name, select Properties.

Preinstallation requirements
d. Select Security from the left side of the Server Properties workspace, and
then click SQL Server and Windows Authentication mode. Windows
authentication is the default setting:.
Workforce Timekeeper
If you are installing Workforce Timekeeper, you must do the following before you
start the Workforce Timekeeper installation program:
1. Ensure that the system requirements as outlined in Chapter 2, “Workforce
Timekeeper and other Labor and Scheduling products,” on page 35 are met.
2. Understand the configuration that you will be setting up:
– Operating system: Windows or UNIX (Solaris, AIX)
– JBoss application server: installed with the Workforce Timekeeper
installation program or preinstalled
– Web server: Apache or Microsoft IIS
– Secure Socket Layer (SSL)
– Combined or separated installation
– Multiple instances
3. Back up your servers.
4. Make sure all users are logged off the servers that you plan to use.
5. Close any Windows or DOS applications.
6. Disable virus scan software to reduce installation time.
7. Verify that the SQL Server authentication is set up for mixed mode—SQL and
Windows authentication—on all servers. Workforce Timekeeper logons—

TKCSOWNER, SUPRKRON, and KRONREAD—all require SQL Server

authentication:
a. Select Start > Programs > Microsoft SQL Server > SQL Server
Management Studio.
b. In the Connect to Server dialog box, enter the appropriate information for
your environment and click Connect.
c. From Management Studio, right-click the server name, select Properties.
d. Select Security from the left side of the Server Properties workspace, and
then click SQL Server and Windows Authentication mode. Windows
authentication is the default setting:.

Preinstallation worksheets
Because the Workforce Central installation programs require you to enter specific
information about the database and the application server, you should complete
the following worksheets and refer to them during the installation procedure.
See your system administrator if you need help locating this information.
Caution: These worksheets include entries for system passwords. Keep these
documents in a secure location.

Workforce HR/Payroll preinstallation worksheet
Dialog box Description Information to enter
General Workforce HR/Payroll information
Type of You can install either of the following: Select one of the following:
installation • Single server (web server, Payroll Single server
engine, and database on same Machine name:
machine)
__________________________
• Dual server (web server on one
machine and Payroll engine and Dual server
database on another machines) Web server name:
__________________________
Database server name:
__________________________
Licensing The product serial number and product Enter the following information:
information installation code was sent to you in an Serial number: _________________
e-mail message when your product was
Installation code: _______________
shipped.
Communication Workforce HR/Payroll can run with Select one of the following:
protocol either HTTP or HTTPS communication HTTP
protocol. If you use HTTPS, you must
HTTPS
also enter the fully qualified domain or IP
address. If HTTPS, enter the domain:
__________________________
Required accounts and logon information
HRPayrollService A Windows domain user account called Enter the following information:
account HRPayrollService is used when User name: ___________________
installing Workforce HR/Payroll.
Password:____________________
Instructions for setting up this account are
included in the installation instructions.

HRMSSelfService You must enter a password for these two Enter the following information:
HRMSLogging database accounts during the installation Password:____________________
accounts procedure.
You must use the same password for both
accounts whenever you install any
Workforce HR/Payroll application
including the Payroll engine and
database, web, and (if applicable)
standalone Solution Manager.
Database information
Database name The installation program will create a Enter the database name:
database if one does not exist or you can _____________________________
use an existing Workforce HR/Payroll
database.
Port number The default port number for SQL Server
is 1433, although you can use a different Enter the port number:___________
one.
SQL Server system You must enter the SQL Server system Enter the following information:
administrator logon administrator logon (such as sa) during User name:____________________
information the installation procedure.
Password: ____________________

Workforce Timekeeper installation worksheet
General information
Destination By default, Workforce Timekeeper is installed Enter the directory name where
in the C directory, but you can change this. Workforce Timekeeper will be
installed:
____________________________
Products to The Workforce Timekeeper installation Workforce Timekeeper
install program allows to install additional Workforce Workforce Scheduler
Central products. Note, however, that you must
Workforce Forecast Manager
have applicable license files to use these
products. Workforce Operations Planner
Select the licensed products you are installing Workforce Leave
from the list in the next column. Workforce Attendance
Workforce Activities
Workforce Device Manager
Workforce Integration Manager
Process Designer
Interface Designer
Type of During the installation, you must select one of Select one of the following:
installation the following types of installation Typical
environment environments:
Custom
• Typical — An installation that includes any
combination of JBoss application server,
Apache web server, and IIS web server,
regardless of separation or multiple
instances.
• Custom — An installation that uses a
preinstalled JBoss application server. A
custom installation requires a significant
amount of manual configuration.

Setup type During the installation, you must select whether Select one of the following:
you are installing: Combined web/application
• The web server and application server servers
combined on a single machine Separated web server and
• A separate web or application server application server
Web server The type of web server software. The Select one of the following:
information Workforce Timekeeper installation program Apache (HTTP)
will install:
Apache (HTTPS)
• Apache – regular mode (HTTP) If Apache-HTTPS, identify the
• Apache – secure mode (HTTPS), which location of the certificates and
requires secure-mode certificate and key key files:
files
__________________________
You can also use the following web server, but
they are not installed by the Workforce IIS (HTTP)
Timekeeper installation program: IIS (HTTPS)
• Microsoft IIS – regular mode (HTTP) If IIS-HTTPS, enter the fully
• Microsoft IIS – secure mode (HTTPS) qualified name or IP address of
You must install these applications (and SSL the application server:
certificates if applicable) before you install _________________________
Application If you are installing a separate web server, you Enter the application server machine
server name must enter the name of the application server name:
and AJP machine and the AJP connector port (which is _____________________________
connector port 8009 by default)
For a UNIX installation, this is the name of the
Enter the AJP connector port:
Windows companion server.
_____________________________
Fully qualified If you are using SSRS advanced reporting Enter the fully qualified domain
domain names functionality, you must use the fully qualified name of the application server:
domain names: _____________________________
Enter the fully qualified domain
name of the web server:
_____________________________

Background The installation program enables you to select Select one of the following:
Processor how you want the Background Processor Workforce Timekeeper
threads enabled on the application server. You application server only
can select from:
Workforce Timekeeper BGP
• Workforce Timekeeper application Server Only
server only — Disables the Background
Workforce Timekeeper with BGP
Processor threads. This machine will
(Single Server)
function only as an application server
• Workforce Timekeeper BGP Server Only
— Installs the Workforce Central platform
with only the Background Processor threads
running. This machine will function as a
dedicated Background Processor machine.
• Workforce Timekeeper with BGP (Single
Server) — Installs Workforce Timekeeper
application server with the Background
Processor threads enabled. This machine
will be used as a single server for all
processes.
Database Workforce Timekeeper supports Oracle and Select one of the following:
platform SQL Server databases. Oracle. If you are using Oracle:
UNIX installations must use an Oracle Are you using multi-schema?
database. Yes
No
Select the version:
Oracle 10G Release 2
Oracle 11G
SQL Server 2005
SQL Server 2008
Database Name of the server on which the database is Enter the database server name:
server name located. ____________________________
Database port The default is 1344 for SQL Server and 1521 Enter the port for JDBC
for JDBC for Oracle. If you are using a different port connections:
Connection number, enter it here. _____________________________

Database You must select the applicable time zone from a Enter the time zone:
server time drop-down list in the installation program. ____________________________
zone
Passwords
SuperUser The first time that you log on to Workforce Enter the new password for
password Timekeeper as SuperUser, you must change the SuperUser:
password. _____________________________
WFAUser Kronos strongly recommends that you change Enter the new password:
all system passwords. _____________________________
ConnectUser Kronos strongly recommends that you change Enter the new password:
4500User Kronos strongly recommends that you change Enter the new password:
Import Kronos strongly recommends that you change Enter the new password:
TELETIME Kronos strongly recommends that you change Enter the new password:
XMLUSER Kronos strongly recommends that you change Enter the new password:
MobileTime Kronos strongly recommends that you change Enter the new password:
DCMSUser Kronos strongly recommends that you change Enter the new password:
TaskRunner Kronos strongly recommends that you change Enter the new password:
Totalizer Kronos strongly recommends that you change Enter the new password:

JBoss JMX and You can change or reset this password. Enter the new password:
web console _____________________________
Oracle information
Oracle SID Enter the Oracle security identifier (SID), which Enter the Oracle SID:
identifies the database instance that is ____________________________
associated with the Oracle executable.
Database User name and password of the owner of the User name:
schema logon database objects; for example, TKCSOWNER. ____________________________
Password:
____________________________
Database logon The user name and password that your User name:
relational database requires; for example, ____________________________
SUPRKRON.
Password:
____________________________
SQL Server information
Database name The name of your database. Enter your database name:
____________________________
Database logon The user name and password for SQL Server; User name:
for example, SUPRKRON. ____________________________
Password:
____________________________
Languages
Languages Identify languages to install. Chinese

French
Spanish

Multiple Instances
If you are going to use multiple instances, identify the following:
Instance Database Service

name name Language Products pack
Instance 1 wfc
Instance 2
Instance 3


Index
A building a database
RDBMS and middleware 42
advanced reporting
business intelligence and analysis products 16
definition 70
business layer
overview 70
of Workforce Central architecture 22
using 72
AIX 55
Apache
C
with SSL 57 certificates and keys
application layer for implementing SSL 133
of Workforce Central architecture 22 Chinese language support 75
application server Citrix configurations
definition 38 system requirements 46
requirements 18 clock synchronize
application server staging area 65 on Workforce Timekeeper database
server 43
B code pages 41
combined web and application server
back up a database
Windows 60
with Workforce HR/Payroll Solution
common logon handshaking 23
Manager 97, 98
communication
HTTP and HTTPS 129
dedicated 28
interapplication 23
selecting options to install 79
companion server
basic reporting
for UNIX environment of Workforce
definition 70
Timekeeper 87
overview 70
Configuration Manager 29
BiDBWiz
general functionality 30
used by Workforce HR/Payroll Solution
overview 28
Manager 97
using 30
bidirectional character sets 41, 75
configuration phase of deployment process 66
bill of materials 65
configuration_date.log 67
Index
cookies 24 disk space

copy a database Workforce Timekeeper 42
with Workforce HR/Payroll Solution documentation
Manager 97, 98 using the Workforce Central installation
credential stores and keys 135 documentation 11
Crystal reports 70
custom installation option 61 E
definition 59 EAR file 59, 61, 66
employee data
D in an integrated environment 108
data collection products Employee Queue Assistant 114
overview 16 error messages
database cannot retrieve data from server 24
access by JDBC or ODBC 23
creating for Workforce Timekeeper 48 F
functionality with multiple instances 32 FlexLM 124
of Workforce Central architecture 23 French language support 75
options 48 fully qualified domain names
reconciling for Workforce Timekeeper 50 when using SSRS 72
requirements for Workforce Central suite 18
system requirement for Workforce H
Timekeeper 41
upgrading for Workforce Timekeeper 49 hardware and software requirements
using database server machine time to compute VMware 19
time 43 help files
Database Manager with service packs 77
overview 48 horizontal scaling 78
reconciliation component 50 HTTP and HTTPS communication 129
segment mapping 51
SEQUENCE count repair 50 I
using for new and upgraded installations 48 IBM Keyman 134
database support install.dict 65
code pages 41, 75 install.txt 65
multibyte characters 41, 75 installation and configuration 65
overview 25, 41 installation code, product 117
deployment installation phase of deployment process 65
configuration phase 66 installation scenarios
directory structure 67 overview 11
installation phase 65 installation worksheet
deployment overview 66 Workforce HR/Payroll 145

Index
instance_creation.log 67 multiple instances 32

integrated environment process 122
components 105 suite interaction licenses 121
licenses, profiles, roles, and primary suite product licenses 120
accounts 109 upgrading for Workforce Timekeeper 124
overview 105 verifying license information 122
requirements 103 Workforce HR/Payroll 126
skills and certificates 112 Workforce Timekeeper 124
synchronizing data 115 Workforce Timekeeper for UNIX 125
integrating Workforce Timekeeper and
Workforce HR/Payroll 101 to 116 M
interactive licenses 120 machine time
IP Management Service Workforce Timekeeper 43
with Solution Manager 96 Microsoft IIS
overview 57
J middleware
J2EE layer requirements 42
of Workforce Central architecture 22 multibyte character support 25, 41, 75
Java Keytool utility 133 multiple instances
Java RMI 23 Configuration Manager 29
jobs and organizations database functionality 32
in an integrated environment 110 general functionality 30
implementing SSL 131
K licensing 32
Kernel layer overview 28
of Workforce Central architecture 22 requirements 28
service packs 76
L with Workforce HR/Payroll 99
multi-schema
languages considerations 53
using multiple languages 29 Oracle 52
Latin 1, Latin 2, Latin 9 character sets 41, 75
LDAP N
authentication 46
implementing with SSL 132 network
license authorization information 117 performance considerations when
licensing 117 to 127 implementing SSL 131
categories of licenses 120 requirements 45
if you have problems 123 non-Java components 66
in an integrated environment 109 NT authentication 46

Index
O security considerations 129 to 139

supported methods 46
OpenSSL toolkit 133
segment mapping
operating system options
for Workforce Timekeeper 51
Workforce Timekeeper 55
self-service products
operating system, requirements 42
overview 16
operating systems supported
separated web and application server
Citrix 46
Windows 60
Oracle database
SEQUENCE count repair
using multi-schema databases 52
with Database Manager 50
with Workforce Timekeeper 51
serial code, product 117
service packs
P multiple instances 76
preinstallation worksheet overview 76
Workforce HR/Payroll 145 rolling back 77
Process Designer Single Sign On (SSO) 46
installing 63 skills and certifications
Process Manager 23 in an integrated environment 112
product licenses 120 Solaris 55
product licensing 117 Solution Manager
Public CAs 133 BiDBWiz 97
overview 96
Q Spanish language support 75
Queue assistants 113 SQL Server
initial parameters 54
R SQL Server 2005
and advanced reporting 70
reconcile option
SQL Server Reporting Services
with Database Manager 50
see advanced reporting 70
report definition language
SSL
definition 70
certificates, keys, and credential stores 133
reporting functionality
customer’s responsibilities 56
custom security extension 72
implementing 130
overview 70
installing Workforce Timekeeper without
certificate 134
S overview 56
scaling with Apache 56
horizontally and vertically 78 with multiple instances 131
scheduling products with Workforce HR/Payroll 136
overview 16 with Workforce Timekeeper 137

Index
SSRS upgrade a database

overview 70 with Workforce HR/Payroll Solution
see advanced reporting 70 Manager 97, 98
using fully qualified domain names 72 URL
sticky cache 21 to connect to multiple instances 31
suite interaction licenses 121
suite product licenses 120 V
synchronization processor 112 vertical scaling 78
synchronizing data VMware
in an integrated environment 107, 115 hardware and software requirements 19
System Queue Assistant 114
system requirements W
Citrix 46
client software for Time & Labor and WAR file 66
Scheduling products 38 web server
for integrated Workforce Timekeeper - options 56
Workforce HR/Payroll 104 requirements 18
Workforce Timekeeper 40 security 129
Workforce Timekeeper database 41 SSL data path 132
Workforce Timekeeper network 45 web server staging area 65
wfc.ear file
T using in custom installation 59
using in custom installation option 61
Time & Labor and Scheduling products wfc.zip file
deployment 65 using in custom installation 59
software system requirements 40 using in custom installation option 61
system requirements 38 WFCAuth 46
time and labor products Workforce Activities
overview 16 installing 62
typical installation option Workforce Analytics
definition 59 overview 16
UNIX machines 61 Workforce Attendance
Windows machines 59 installing 62
Workforce Central
U APIs 105
Unicode character set architecture 21
and Oracle database 51 client layer 21
Unicode support 25, 41 deployment process 66
UNIX implementing SSL security 130
typical installation option 61 integrated environment important points 102
interapplication communication 23

Index
jobs and organizations in an integrated Workforce Manager license 121

environment 110 Workforce Record Manager
licenses in an integrated environment 109 overview 16
licensing 117 to 127 Workforce Scheduler
licensing Workforce HR/Payroll 126 installing 62
licensing Workforce Timekeeper 124 skills and certifications in an integrated
overview 9 environment 112
platform and applications 22 Workforce Timekeeper
requirements for integrated environment 103 application server options 55
skills and certifications in an integrated dedicating machines to certain functions 87
environment 112 implementing SSL 137
SSL secured data paths 132 installation options 55
suite license interaction 127 installing 62
suite system requirements 18 installing custom environment 61
synchronizing data in an integrated installing SSL without certificate 134
environment 115 licensing 124
system requirements for integrated multiple instances 29
environment 104 Oracle considerations 51
using the installation documentation 11 reports server 87
Workforce Central utilities sample configuration
overview 16 no multiple instances 84
Workforce Connect no separation or multiple instances 81
overview 16 two instances, no separation 82
Workforce Employee license 121 two instances, separated 85
Workforce HR/Payroll sample configurations 81
common logon handshaking 23 segment mapping the database 51
configuration options 90 system requirements 38, 40
dual server configuration 90 using Database Manager 48
editing a configuration on a remote server 97 web server options 56
implementing SSL 136 Workforce Timekeeper database
licensing 126 network requirements 45
multiple instances 99 operating system and middleware
overview 16 compatibility 42
private web service 23
single server configuration 90 X
Solution Manager 96 XML APIs 23
system configuration options 90
Workforce Leave
installing 62

Installation Planning Guide

Diunggah oleh

Informasi Dokumen

Deskripsi Asli:

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Installation Planning Guide

Diunggah oleh

Hak Cipta:

Format Tersedia

Guide to Planning a

A guide to the requirements and features of the installation

Kronos Workforce Central Suite

Document Part Number: 4704223-001

Published by Kronos Incorporated

For links to information about international subsidiaries of Kronos Incorporated, go to

Document Revision History

Document Revision Product Version Release Date

A Workforce Central 6.1 January 2009

About This Guide

Chapter 1: About Workforce Central

Chapter 2: Workforce Timekeeper and other Labor and Scheduling

Chapter 3: Workforce HR/Payroll

Chapter 4: Combined Workforce Timekeeper and Workforce HR/Payroll

Guide to Planning a Workforce Central Installation 5

Data synchronization ..................................................................................107

Chapter 5: Licensing Workforce Central products

Chapter 6: SSL security considerations

Chapter 7: Preinstallation requirements and checklists

Guide to Planning a Workforce Central Installation 7

The Kronos® Workforce Central® suite is a comprehensive solution for managing

Organization of this guide

Using the Workforce Central installation documentation

Caution: Each scenario consists of step-by-step instructions. Although it may be

• Installing Workforce HR/Payroll describes how to install Workforce HR v6.1

• Upgrading Workforce Timekeeper describes how to upgrade Workforce

Leave, Workforce Attendance, Workforce Activities, Workforce Device

This chapter provides an overview of Workforce Central and contains the

Note: Because Workforce Timekeeper is a prerequisite for a number of Workforce

• Business intelligence and analysis products — Workforce Analytics is the

Guide to Planning a Workforce Central Installation 17

Suite system requirements

Hardware and software requirements

Guide to Planning a Workforce Central Installation 19

• All AMD quad-core processor systems

Workforce Central products supported

Note: Workforce Analytics products are not supported on VMware.

Workforce Central architecture

Guide to Planning a Workforce Central Installation 21

Workforce Central platform and applications

Workforce Central applications

The application layer of a Workforce Central installation includes:

Guide to Planning a Workforce Central Installation 23

Unicode Data Types Non-Unicode Data Types

Guide to Planning a Workforce Central Installation 25

Refer to Installing Workforce Timekeeper for more information.

RAID (Redundant Array of Independent Disks) technology combines two or more

• Large installations (more than 20,000 employees)

Guide to Planning a Workforce Central Installation 27

Multiple instances of Workforce Central products

Note: Dedicated Background Processor machines that are created by the

If you have multiple instances of Workforce Central products that connect to

Guide to Planning a Workforce Central Installation 29

Using Configuration Manager

Gray text indicates that these

Guide to Planning a Workforce Central Installation 31

Licensing multiple instances

Guide to Planning a Workforce Central Installation 33

Note: Because Workforce Timekeeper is a prerequisite for a number of Workforce

Workforce Timekeeper can be installed with a variety of configurations, operating

• “Background Processor” on page 79

Therefore, in Workforce Timekeeper v6.1, the term application server is only

Client software requirements