Servicenow and LDAP integration through the MID Server for Auth/Authz

[iammi]

Hello,

We have just purchased Servicenow and are about to set up the architecture.

The first things we are interested in are authentication/authorization.

As we don't have an IDP (Identity Provider), we are unable to produce SAML v2.0 token, so there is no way to implement SSO, do you Agree ?

If there is no way for SSO, then the second option is to use the corporate Active Directory for authentication via LDAPS : http://wiki.servicenow.com/index.php?title=LDAP_Integration

Please tell me if something is wrong in the following statements summarizing my understanding of Servicenow authentication/authorization mechanism.

• LDAP integration for authentication is possible through the MID Server, so no need to think to put the LDAP instance on the DMZ (http://wiki.servicenow.com/index.php?title=LDAP_Integration_via_MID_Server_Setup)
• The LDAP instance reside in the corporate Intranet (LAN) and we must set up a rooting rules form the MID Server (located in the DMZ), to the LDAP (port 636), in order to fulfill read-only operations.
• The users (some of their attributes), must be imported into Servicenow database, via LDAP, it is recommended to do a regular refresh for keeping information up to date.
• The authorization is managed at Servicenow level, and on Serviceow database, no way to manage authorizations based on LDAP groups located on the LDAP instance in the corporate LAN.
• The MID Server is the only spot exposed to the public network in the company, no need to open a VPN connection with Servicenow.

In which case we can be obliged to have a VPN connection with Servicenow ?

If you have any ideas or best practices regarding our need, please do not hesitate to give us details.

1. Regards.

[tony_barratt]

Hi AMMI,

You mention:

LDAP integration for authentication is possible through the MID Server

However refer to this wiki

LDAP Integration Setup - ServiceNow Wiki

..

2 Determine the LDAP Communication Channel

..

LDAP typically uses one of these types of communication channels:

• A MID Server connection communicates over HTTP on port 80 by default. This communication channel does not require a certificate. The connection between the MID Server and the instance is over HTTPS (port 443). You can use the MID Server to import data over LDAP, but you cannot use the MID Server for LDAP authentication.

Best Regards,

Tony

[tdf]

You could use Digest Token Authentication as an alternative to SAML.   While SAML is the ideal solution, Digest Token is an alternative.

-tim

[iammi]

Thank you Tim first, that requires having

• SiteMinder or another single sign-on application to pre-authenticate the user on the local network

Wich is not the available.

We will use LDAP Auth via VPN.

Regards

[tony_barratt]

Hi AMMI,

You mention that you can use corporate Active Directory for authentication via LDAPS : http://wiki.servicenow.com/index.php?title=LDAP_Integration

You can, but as noted in my earlier post you cannot use the MID Server for LDAP authentication.

If you are using LDAPS you could omit the vpn.

The is some relevant info here:

You Don't Need A VPN Part II - LDAP Integrations, User Data Imports, & the Internet solution

Best Regards

Tony