Configuring SCIM Provisioning from Microsoft Entra ID to ServiceNow

[rickspix]

Running into an issue when generating and retrieving the bearer token for the secret token in Azure for provisioning. 

I'm following the article below and I'm running into an issue on step 9. I'm receiving {"error_description":"access_denied","error":"server_error"} when attempting to curl for the bearer token. 

 

Link to article:

https://www.servicenow.com/community/developer-blog/scim-provisioning-from-microsoft-entra-id/ba-p/2...

I tried to refresh the token and set the limits high for expiration, but still get the same error.

Step 9.

Generate the Bearer Token

• The "oauth_token.do" page allows us to generate the access / bearer token as long as we have the access code, redirect uri, grant type, client id and client secret.
• The simplest way to retrieve this is using Curl.
• From the Command Prompt, issue the following command - curl -d "grant_type=authorization_code&code=<access code>&client_id=<clientid>&client_secret=<clientsecret>&redirect_uri=https://<instance-name>.service-now.com/login.do" https://<instance-name>.service-now.com/oauth_token.do
• This should produce a response similar to the following which includes the access token
  • {"access_token":"_OmjfKUv1pevKZRZCwtrDzqTSxPgah_DP7ulz8ZZY0Bt_7w-nPwvIhBuFFmJ23wcV9mnm1_37v9FEUqgFA9mkQ","refresh_token":"kCMQS101TU8o6xKB6mUu5Z7V25sFDpOSxcwnhhzhckkfDMihe1uBA255YC9v8jol83kut28zH0MiFLegbkj3Lg","scope":"useraccount","token_type":"Bearer","expires_in":1799}
• Use the "access_token" component as the Secret Token when configuring the Entra ID Enterprise Application provisioning.

[Kiwi1]

The process can be quite finnicky. These are the steps I've documented.

1. Disable SSO
2. Clear multi-factor setup for user (if exists)
3. Clear browser cache
4. Verify admin permissions for account
5. Follow steps from article
6. Add -k to curl command. Example: curl -k -d "grant_type=authorization_code&code=[]&client_id=[]&client_secret=[]&redirect_uri=[]/login.do" []/oauth_token.do
7. Remove admin permissions from account. Set web service access.
8. Enable SSO