{"id":516,"date":"2024-01-31T12:08:49","date_gmt":"2024-01-31T11:08:49","guid":{"rendered":"https:\/\/sii.ua\/blog\/?p=516"},"modified":"2024-02-16T09:43:07","modified_gmt":"2024-02-16T08:43:07","slug":"servicenow-integration-with-active-directory-using-ldap","status":"publish","type":"post","link":"https:\/\/sii.ua\/blog\/en\/servicenow-integration-with-active-directory-using-ldap\/","title":{"rendered":"ServiceNow Integration with Active Directory using LDAP"},"content":{"rendered":"\n

In recent years ServiceNow has been established as the best tool to manage processes, services, or infrastructure and is designed on ITIL guidelines. Named as the most innovative company by Forbes in 2018. ServiceNow operates in SaaS (software as a service) model constantly improving the platform. In this article you can find more information about integration with Active Directory using LDAP.<\/p>\n\n\n\n

Users and Groups<\/strong><\/h2>\n\n\n\n

Following ServiceNow documentation: \u201cA group is a set of users who share a common purpose. Members of groups perform tasks such as approving change requests, resolving incidents, receiving email notifications, or performing change request tasks. Assign every user to at least one group.<\/p>\n\n\n\n

A good practice is to assign roles to groups rather than to users. Administrators can assign roles quickly to multiple users by adding the users to the group. If a user moves to another group, the role assigned to the new group is applied automatically. \u201c<\/p>\n\n\n\n

The user is simply an individual who can access the ServiceNow instance.<\/p>\n\n\n\n

LDAP<\/strong><\/h2>\n\n\n\n

There are many ways to manage users and groups in ServiceNow and one of them is integration with Active Directory through LDAP.<\/p>\n\n\n\n

LDAP (Lightweight directory access protocol) is an open, vendor-neutral application protocol for accessing and maintaining data that are stored in directories. Using this protocol, we can query the company Active Directory to get necessary user and group information for our instance. In this article, we will be using one of the publicly available LDAP testing servers<\/a>.<\/p>\n\n\n\n

SETUP<\/h2>\n\n\n\n

First, we need to add a new LDAP server. We can do it by filtering System LDAP in the navigator and opening Create New Server module.<\/p>\n\n\n\n

\"Defining<\/a>
Fig. 1 Defining new LDAP server<\/figcaption><\/figure>\n\n\n\n

By default, ServiceNow will create some out-of-the-box OU (Organizational Unit as per Active Directory) definitions:<\/p>\n\n\n\n

\"LDAP<\/a>
Fig. 2 LDAP Server configuration and OU definitions<\/figcaption><\/figure>\n\n\n\n

However, we will need to adjust those definitions on filter since we are using a test server configured slightly differently than the corporate Active Directory. For Groups, we will be using \u201ccn\u201d as the query field and we need to filter \u201cobjectClass\u201d for \u201cgroupOfUniqueNames\u201d.<\/p>\n\n\n\n

\"Groups<\/a>
Fig. 3 Groups OU filtering<\/figcaption><\/figure>\n\n\n\n

You can click Browse in related links to check what will be retrieved with your query:<\/p>\n\n\n\n

\"LDAP<\/a>
Fig. 4 LDAP Browse function<\/figcaption><\/figure>\n\n\n\n

The same changes need to be applied to User OU Definition similar to groups the query field we will be using \u201ccn\u201d but we need to filter objectClass for \u201cperson\u201d.<\/p>\n\n\n\n

\"Users<\/a>
Fig. 5 Users LDAP filtering<\/figcaption><\/figure>\n\n\n\n

Once we are sure that we will receive all necessary data from LDAP for users and groups we can start adjusting the transform map that was created by ServiceNow. We can comment on script actions as there is no manager set in this setup. However, in corporate use cases ldapUtils script include is helpful \u2013 you can read more about it in product documentation Product Documentation (Common LDAP Scripts)<\/a>.<\/p>\n\n\n\n

\"Groups<\/a>
Fig. 6 Groups Transform Map<\/figcaption><\/figure>\n\n\n\n

Once we are done with the field mapping, we need to take a look at the transform scripts \u2013 especially the onAfter script which is responsible for adding members to ServiceNow groups. As you can see commented line allows to set up a different field than \u201cmember\u201d which is the default field holding information about group members. In our case, we need to uncomment this line and add \u201cu uniquemember\u201d as our group members\u2019 field because that\u2019s how our source LDAP server is configured to store this data.<\/p>\n\n\n\n

\"Groups<\/a>
Fig. 7 Groups onAfter transform script<\/figcaption><\/figure>\n\n\n\n

Analogically we need to adjust field mapping for user transform.<\/p>\n\n\n\n

\"Users<\/a>
Fig. 8 Users Transform Map<\/figcaption><\/figure>\n\n\n\n

Finally, we can test it out by loading all records and running transform on the import set. Please bear in mind that loading all records might cause some troubles in case you receive too many records, I recommend \u201cTest Load 20 records\u201d at first to make sure that the received data is what you need.<\/p>\n\n\n\n

Now we are sure that both data sources are correct, and we receive only necessary data – we want to run user transform first:<\/p>\n\n\n\n

\"Users<\/a>
Fig. 9 Users import<\/figcaption><\/figure>\n\n\n\n

Then we can run group import to load all necessary groups and map their members:<\/p>\n\n\n\n

\"Groups<\/a>
Fig. 10 Groups import<\/figcaption><\/figure>\n\n\n\n

If you open one of the referenced target records, you can see that we successfully added all members that should belong to this group.<\/p>\n\n\n\n

\"Group<\/a>
Fig. 11 Group members<\/figcaption><\/figure>\n\n\n\n

Summary<\/h2>\n\n\n\n

As you can see ServiceNow helps with many topics throughout the integration process by creating necessary artifacts such as data sources, OU definitions, transform maps, or import set tables however configuring queries and filters might be tricky sometimes. I suggest to firstly build a filter using powershell or in AD Users & Computers (you can also ask for help your AD admin). You can read more about filters here<\/a>. Understanding the organizational units is also a crucial part of LDAP integration and I strongly recommend going through the documentation<\/a> as well.<\/p>\n\n\n\n

Additional resources<\/h2>\n\n\n\n

For more information on integration, see the resources below:<\/p>\n\n\n\n