Unable to run horizontal discovery through beyondtrust password safe

ritajit
Tera Contributor

Hello members,

 

We have Password safe External Credential Storage for Discovery installed and have been trying to run horizontal discovery but keep getting issue while trying to retrieve credentials using the local account.

Since this is a scoped application by beyondtrust and not supported by ServiceNow, I need help to get this resolved.

Store app installed

ritajit_0-1765888001973.png

 

External Account with credentials

ritajit_0-1765878577133.png

Vault configuration is fine

ritajit_1-1765878876410.png

JAR file is present from the Mid server with the host and API key

ritajit_2-1765878934431.png

ritajit_3-1765879055778.png

The local account with credentials Default Workgroup|SV600050|ServiceNow-Discovery is part of the local admin account of the target servers.

While running discovery, the discovery log shows that it is not able to fetch the credentials to authenticate the target device during the classification phase

ritajit_4-1765879486477.png

Logs from the mid server which shows the password request failing

ritajit_5-1765879561718.png

Logs from the servicenow instance in debug mode shows fetching empty credentials

ritajit_6-1765879826055.png

Ran a powershell command with the API key and the target system and was able to retrieve the credentials.

Our information security officer also checked the servicenow discovery account in beyondtrust and confirmed he does not see any logs while trying to hit the server.

Not sure what other checks can we do from our end. We have also raised a case with Beyondtrust but they haven't been responsive.

Any guidance from anyone who has used this application and discovery is working would be greatly appreciated

1 REPLY 1

Fabian Kunzke
Mega Sage

Hey,


This seems to be an issue on the MID-Server side. It could be because of several reasons, but mainly 2 come up with these credential topics:

1) Connectivity

2) Authentification

 

The easiest to kind of verify both is through a powershell command. Now, you've said, that you've already run a command with the API key. Did you execute that powershell command on the MID-Server VM? If not, could you please try? If this does not work, it is likely a connectivity issue.

 

Secondly, make sure the key in the config is correct (and not encrypted/correctly encrypted). If this also isn't the issue, then I highly recommend reaching out to the application support from beyondtrust (you will find that in the application store page from the ServiceNow store). Because then you may need support in setting this up correctly, which is probably best done with support from their side.

 

Lastly, please make sure to post screenshots with anonymized data. Now if the data you've screenshotted from the config file is already anonym, feel free to ignore this comment. However, if the data is indeed correct (api-key & endpoint information) make sure to remove the screenshot and change the credentials!

 

Regards

Fabian