ServiceNow-AD integration: MID Server On-prem vs Cloud

[Sonali Dhal1]

The requirement is to automatically add a user who already exists in ServiceNow to the appropriate Active Directory (AD) group based on the application selected in the catalog request.

The expected flow is:

Catalog Item Submission → Identify Requested For → Determine AD Group based on Application → Add User to AD Group

Once the catalog item is submitted, the Requested For user should be automatically added to the corresponding AD group associated with the application selected in the request.

As part of the solution design, we are evaluating which MID Server deployment model would be most appropriate for this integration:

• AWS-hosted MID Server
• On-premises MID Server

We would like to understand the key advantages, disadvantages, security considerations, network requirements, and operational implications of both approaches.

Additionally, we would like to clarify the following:

1. MID Server hosting: Are there any architectural or security considerations that would favor hosting the MID Server in AWS versus on-premises for an on-prem AD integration?
2. Network connectivity: What network connectivity is required between the MID Server and the AD domain controllers?
3. Domain membership: Does the MID Server host need to be part of the same AD domain as the domain controllers, or can it belong to a different domain/workgroup as long as the required network connectivity and authentication are configured?
4. Authentication: What is the recommended authentication/service-account model for the MID Server to perform the AD group membership operation?
5. Security: Are there any additional firewall, port, credential, or least-privilege considerations that should be addressed as part of the architecture?
6. High availability: Should we plan for multiple MID Servers or a MID Server cluster for production to avoid a single point of failure?

The objective is to determine the most secure, reliable, and supportable architecture for automating ServiceNow → MID Server → Active Directory group membership.

[palanikumar]

Hi @Sonali Dhal1 ,

Normally these are not handled by ServiceNow team. You need to reach to the AD, Network and Security team of your environment as every Organization has their own policy.

1) ServiceNow is hosted outside your network, from ServiceNow perspective it doesn't matter where the MID Server is located. I saw many organization uses MID Server on cloud now a days.

2) Network connectivity is internal to your oganization. Team responsible for cloud should handle this

3) Normally the Cloud team or the team responsible to build MID Server will connect it to AD as part of the build. Check with the team responsible for build. Your MID Server should be a Windows server.

4) It is recommended to use OAuth

5) Normally the MID server is kept in the same domain as domain controller, but it can be in different domain as well. You can need to create connection with URL of the host machine where AD is installed

6) Clustering can be enabled based on the critcality of the requirement

[Sonali Dhal1]

Thanks @palanikumar  for your suggestion.

[palanikumar]

If my response solves your query then please mark it as accepter solution and close this question

[Sonali Dhal1]

Hi @palanikumar ,

Regarding pt.4 ,Can we setup OAuth authentication for connecting to AD? Can you please explain in detail ?