{"id":388,"date":"2024-12-19T19:28:43","date_gmt":"2024-12-19T17:28:43","guid":{"rendered":"https:\/\/amsd.go.ro\/wordpress\/?p=388"},"modified":"2024-12-28T16:45:28","modified_gmt":"2024-12-28T14:45:28","slug":"ldap-integration","status":"publish","type":"post","link":"https:\/\/amsd.go.ro\/wordpress\/?p=388","title":{"rendered":"LDAP Integration for ServiceNow"},"content":{"rendered":"\n

An LDAP integration allows your instance to use your existing LDAP server as the master source of user data.<\/p>\n\n\n\n

This article is a supplement to the ServiceNow documentation. For full documentation please see the ServiceNow Documentation<\/a><\/p>\n\n\n\n

Please note that it is important to try this integration in a development instance first and test the integration before going live in production.<\/p>\n\n\n\n

\"LDAP-diagram-cropped.png\"\/<\/figure>\n\n\n\n

Step 1: Define LDAP SERVER<\/h2>\n\n\n\n

You\u2019ll need to expose the LDAP Server to ServiceNow. Here are few different ways to do this:<\/p>\n\n\n\n

Option 1 – LDAP Server with Mid Server<\/strong><\/h3>\n\n\n\n

This is the most common method as it is the easiest to configure and doesn\u2019t require much effort from a company AD admin.<\/p>\n\n\n\n

You\u2019ll need to setup a midserver<\/a> to use this method. Please note that you can\u2019t authenticate (login) using this method and you can\u2019t use a SSL connection.<\/p>\n\n\n\n

For authentication, an SSO connection<\/a> is often configured. So you use the LDAP Integration to pull in users\/groups and SSO to authenticate (login).<\/p>\n\n\n\n

Option 2 – LDAP Server with VPN<\/strong><\/h3>\n\n\n\n

For this method, you need to ask ServiceNow for a VPN Request though HI Support. This method isn\u2019t that preferred is that you are relying on the ServiceNow VPN to work and other maintenance concerns.<\/p>\n\n\n\n

Details from HI Support:<\/p>\n\n\n\n

ServiceNow provides secure communications with customer networks over the public Internet using IPSEC VPN technology. A clustered pair of Cisco ASA devices are used as the termination point for encrypted IPSec tunnels. Please note, a site-to-site VPN connection between ServiceNow and your network is only used for traffic that is initiated by ServiceNow. Traffic destined for ServiceNow will always be HTTPS, and will always use the internet as a transport. As your ServiceNow instance is deployed into two ServiceNow datacenters for our Advanced High Availability, we will be building two VPN tunnels to your network.<\/em><\/p>\n\n\n\n

Option 3 – External IP Address<\/strong><\/h3>\n\n\n\n

For this method, you expose an external IP Address to ServiceNow.<\/p>\n\n\n\n

Be sure a network administrator configures the local firewall to allow the application server to access the LDAP server. If the LDAP server is located within an internal network, the firewall forwards (or NATs) the application server’s IP address through the firewall on the correct port.<\/p>\n\n\n\n

Option 4 – LDAPS with PKI certificate<\/strong><\/h3>\n\n\n\n

Most companies don\u2019t have LDAPS (note the \u201cS\u201d). However for the companies that do, this is the superior method to connect in my opinion.<\/p>\n\n\n\n

Step 2: CREATE LDAP Server<\/h2>\n\n\n\n

Create LDAP Server Record<\/h3>\n\n\n\n
    \n
  1. Left Navigator Bar > Create New Server<\/li>\n\n\n\n
  2. Fill in form fields. Field descriptions from the ServiceNow Documentation<\/a><\/li>\n<\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Example LDAP Server<\/p>\n\n\n\n

    Make sure to specify which LDAP Attributes to import. Without specifying the LDAP attributes, the import set creates many fields, which can exceed the row size limit during the import process.

    Common Attributes<\/strong><\/p>\n\n\n\n

    description,employeeNumber,managedby,department,division,description,dn,employeeID,givenname,mail,manager,member,memberof,mobile,objectguid,physicaldeliveryofficename,samaccountname,sn,source,telephonenumber,thumbnailPhoto,title,useraccountcontrol,userPrincipalName<\/p>\n\n\n\n

    3. Click Submit
    4. When set to Active, the connection is tested. Red is bad. Green is good!<\/p>\n\n\n\n

    Additional Notes<\/h3>\n\n\n\n