ServiceNow✓ Verified

ServiceNow is a cloud-based platform offering IT service management, enabling organizations to streamline workflows, automate tasks, and enhance service delivery. It encompasses various modules for IT, HR, customer service, and more, promoting efficiency and collaboration within enterprises. Identities ❌ | Accounts ✔️ | Groups ✔️ | App Roles ✔️ | Entitlements ❌

Application

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

---

Account Collector

This section explains the process for configuring an account collector for the ServiceNow application. We will use the RSA G&L Generic REST collector ¹ for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on ServiceNow.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details.
   
   
   
   
   
   
6. If authentication type ² is Basic, enter the credentials as shown below.
   
   
   
7. Click Next. Select the data types that the collector will be collecting from ServiceNow
   
   
   
8. Click Next. On the Account Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/api/now/table/sys_user
Query Parameters
sysparm_fields	sys_id,name,employee_number,user_name,email,first_name,last_name,last_login_time,active
Request Headers
Accept	application/json
Response Mappings
AccountId	$.result[*].user_name
EmployeeNumber	$.result[*].employee_number
IsActive	$.result[*].active
Email	$.result[*].email
LastLoginTime	$.result[*].last_login_time
SysID	$.result[*].sys_id

9. Click Next. On the Group Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/api/now/table/sys_user_group
Query Parameters
sysparm_fields	sys_id,name,description,active,sys_updated_by
sysparm_query	active=true
Request Headers
Accept	application/json
Response Mappings
GroupId	$.result[*].name
SysID	$.result[*].sys_id
Description	$.result[*].description
Owner	$.result[*].sys_updated_by

10. Click Next. On the Account Group Membership page, enter the following configurations.
    
    
    
    
    
    
    
    

Request
Method	GET
URL	/api/now/table/sys_user_grmember
Query Parameters
sysparm_fields	user,group
Request Headers
Accept	application/json
Response Mappings
Account Identifier	$.result[*].user.value
Group Identifier	$.result[*].group.value

11. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.
    
    
    
12. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.
    
    
    
13. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.
    
    
    
14. Click Next. In the User Resolution Rules, map the user to account.
    
    
    
15. Click Next. In the Member Account Resolution Rules, map the account.
    
    
    

💡 Info: This value MUST always be mapped to the Account Name for any generic REST collector.

16. Click Next. In the Group Owner Resolution Rules, map the owner to user attribute.
    
    
    
17. Click Finish. Use the Test function to make sure the configurations are accurate.

---

Entitlement Collector

This section explains the process for configuring an entitlement collector to collect admin roles from ServiceNow application. We will use the RSA G&L Generic REST collector ¹ for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on ServiceNow.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from ServiceNow.
   
   
   
7. Click Next. On the App Role Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/api/now/table/sys_user_role
Query Parameters
sysparm_fields	sys_id,sys_updated_by,name,description
sysparm_exclude_reference_link	true
sysparm_query	ORDERBYsys_id
Request Headers
Accept	application/json
Response Mappings
ApplicationRoleId	$.result[*].name
RoleSysID	$.result[*].sys_id
Description	$.result[*].description
Owner	$.result[*].sys_updated_by

8. Click Next. On the App-Role Account Membership collection page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/api/now/table/sys_user_has_role
Query Parameters
sysparm_fields	role,user
sysparm_exclude_reference_link	true
sysparm_query	roleISNOTEMPTY^userISNOTEMPTY^ORDERBYsys_id
Request Headers
Accept	application/json
Response Mappings
Application Role Id	$.result[*].role
Account Identifier	$.result[*].user

9. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.
   
   
   
10. Click Next. In the Account Evaluation, map the account collector to account value.
    
    
    
11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

---

References

• ServiceNow Table API: used for sys_user, sys_user_group, sys_user_grmember, sys_user_role, and sys_user_has_role.
• ServiceNow Basic Authentication
• ServiceNow Roles

COL029

Footnotes

1. Table API ↩ ↩²
2. ServiceNow basic authentication ↩