How to configure outbound API to use Grant Type of Resource owner password credentials

[DineshS]

While setting up Oauth registry to use a grant type of Resource owner password credentials, I am unable to set a user name and a password on the UI.

I can see there is a OAuth API Script named OAuthPasswordGrantType, which seems to use user name and password but still can't figure where it needs to be configured, so there is no need of manual intervention while fetching the OAuth token. Am I missing something ?

Note : I am aware the grant type I am after, is deprecated, but until the other system upgrades, we need to use it.

[Abhay Kumar1]

@DineshS what I am aware of to configure the Resource Owner Password Credentials (ROPC) grant type in ServiceNow's OAuth setup and ensure username/password are provided programmatically without manual intervention, you need to understand how ServiceNow handles this flow.

So you will add to provide information explicitly like below:

Navigate to System OAuth > Application Registry.

Create a new OAuth entity (or edit an existing one).

Ensure the Grant type is set to Resource Owner Password Credenti

als.

ServiceNow requires a script to send the username/password along with the token request. This is not configured directly in the registry UI.

You can use the GlideOAuthClient API to programmatically request a token with the username/password.

Example Script for Token Retrieval:

var client = new GlideOAuthClient();

var request = client.createTokenRequest('YOUR_OAUTH_REGISTRY_NAME');

request.setGrantType('password'); // Set the grant type

request.setUsername('your_username'); // Replace with the actual username

request.setPassword('your_password'); // Replace with the actual password

var tokenResponse = client.requestToken(request);

if (tokenResponse.getError()) {

    gs.error('Error retrieving token: ' + tokenResponse.getError());

} else {

    var accessToken = tokenResponse.getToken();

    gs.info('Access Token: ' + accessToken);

}

Replace YOUR_OAUTH_REGISTRY_NAME, your_username, and your_password with your actual OAuth registry

name and credentials.

Avoid hardcoding the username and password directly in scripts. Use:

ServiceNow Credential Records to securely store and retrieve credentials.

The GlideEncrypter API or related to KMF as this might have deprecated for encrypting sensitive data.

Hope this will help you.

[DineshS]

Hi @Abhay Kumar1 

I am trying to avoid scripting especially if it involves credentials in clear text. Something I notice is that, in my PDI which is on xanadu-07-02-2024__patch0-07-16-2024, if I change the view to Default, there is an option to update the user credentials. I am unable to do that on an instance with xanadu-07-02-2024__patch3-10-23-2024 though. See attached. Not sure if I am missing something