Scribd
Upload
13 views3 pages

JWT Authentication in ServiceNow Integrations

This guide details the transition from Basic Authentication to more secure methods for inbound integrations in ServiceNow, highlighting various supported authentication methods ranked by security. It introduces the Web Service Access Only (WSAO) flag to prevent UI logins for integration accounts, thereby enhancing security. Implementation steps include identifying integration users, examining login history, applying WSAO to API-only accounts, and migrating UI-active accounts to dedicated integration users.

Uploaded by

rashmi_1994
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
13 views3 pages

JWT Authentication in ServiceNow Integrations

This guide details the transition from Basic Authentication to more secure methods for inbound integrations in ServiceNow, highlighting various supported authentication methods ranked by security. It introduces the Web Service Access Only (WSAO) flag to prevent UI logins for integration accounts, thereby enhancing security. Implementation steps include identifying integration users, examining login history, applying WSAO to API-only accounts, and migrating UI-active accounts to dedicated integration users.

Uploaded by

rashmi_1994
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Securing Inbound Integrations in

ServiceNow
This guide outlines how to transition integration authentication from Basic Authentication
to more secure methods and how to implement the Web Service Access Only flag for
improved protection.

1. Supported Authentication Methods (Ranked by Security)


• OAuth 2.0
o Authorization Code, Client Credentials, JWT Bearer, Password Grant
o Token-based, does not expose user credentials
• OIDC ID Tokens
o Leverage external identity providers
• Certificate-Based Authentication
o Mutual TLS; strong client-side certificate validation
• API Key
o Secure when appropriately managed
• HMAC Token
o Ensures request integrity
• Basic Authentication
o Least secure, only recommended if used with Web Service Access Only
2. Web Service Access Only (WSAO)
Definition: A flag that prevents UI login for a user account—restricted to API usage only.
Benefit: Eliminates the risk of interactive logins using integration credentials.
Key Action: Apply to all users that are only used by integration flows.

3. Implementation Steps

3.1 Identify Integration Users


Navigate to the Integration Users list to identify accounts not marked as Web Service Access
Only (WSAO). Export this list for further review.

3.2 Examine UI Login History


Check the sys_user_login_history table for each user to detect any interactive logins. If a user
has logged into the UI, they should not be marked as WSAO.
3.3 Apply WSAO to API-Only Accounts
For users with no UI login activity, use the 'Enable Web Service' option to flag them as
WSAO. This limits access to only web service/API usage.

3.4 Migrate UI-Active Accounts


For accounts actively used in the UI:
- Create a new dedicated integration user.
- Mark the new user as WSAO.
- Assign appropriate roles.
- Update integration configurations to use the new account.
- Deactivate or limit the original user account.

You might also like