After way too many days of research and trial and error, here is my prescriptive step-by-step how-to on connecting ADP Workforce Now to ServiceNow:
First steps when connecting to ADP involve following their provided configuration documentation in their developers guides. You will need the token information under the ADP Project you create, as well as the certificate information from the certificate registration step. Other than the generation of the Keystore, the rest of the steps are how to configure the connection in ServiceNow.
Import the ADP Certificate
- Combine the Certificate file and the Private Key file created as part of generating a certificate in ADP
- Using a linux command line, run the following command:
- openssl pkcs12 -export -in <certificate_file> -inkey <private_key_file> -out <output_file.p12>
- Save the output file and the password used to create the output file (there may be other option, but this proved expedient for us)
- In ServiceNow, navigate to Certificates
- Create a New certificate
- Name it something sensible
- Notify on Expiration is the person or persons who will mange the certificate's renewal in ADP and update the cert in ServiceNow when needed
- Set Type to PKCS12 Key Store
- Enter the password used to create the .p12 file as the Keystore password
- Attach the .p12 file to the created using openssl
- Save the keystore
- Validate the cert using the related link "Validate Stores/Certificates"
Create Mutual Authentication Protocol
- In ServiceNow, navigate to Protocol Profiles
- Create a new Protocol
- Name it something simple, but unique. In this case 'adphttp' will serve
- Leave Default port at 443
- Reference the Keystore previously created
Create Application Registry
- In ServiceNow, navigate to System Oauth > Application Registry
- Create a new Oauth entity
- Name it something descriptive of the connection
- Copy the Client ID and Client Secret provided by the ADP Project you are connecting to
- Default Grant type is "Client Credentials"
- Use mutual authentication is True
- Mutual authentication profile is the protocol created in the previous step
- Send Credentials is In Request Body (Form UTL-Encoded)
- Token URL replaces https:// with the protocol you created followed by the ADP authentication connection URL (see the screen shot below for the authentication URL)
- Save the token. The system will generate a default profile, which will be used in the next step
Create Credentials
- In ServiceNow, navigate to Connections and Credentials > Credentials
- When prompted with "What type of Credentials would you like to create?" Choose Oauth 2.0 Credentials
- Name your credential
- Choose the default profile created when registering the application
- Save the credential
- Validate by using the related link "Get OAuth Token"
Create the Connection and Alias
- In ServiceNow, Navigate to Connection & Credential Aliases
- Create a new connection alias
- Name it something applicable
- Type should be Connection and Credential
- Connection Type is HTTP
- Save the Alias
- In the related list Connections, create a new connection
- Name the connection
- Set the credential to the one created previously
- Check URL builder to access the Host field
- Set host to the API URL from ADP. In our case this is api.adp.com
- Check Mutual authentication
- Set Protocol profile to the one created previously and used in the application registration
