use X-UserToken instead of credentials in REST API Calls

[Hamza Berouil2]

Hi all,

I was thinking that X-UserToken can be used instead of using credentials in REST calls.

Let me elaborate, we need to implement an interface with 3rd party application (a portal where users can have access to their incidents).

Users log into the portal through SSO (the same is used for ServiceNow).

The issue they may not have an existing session in ServiceNow so they don't have existing cookies that could be reused for the REST calls an those users don't have password that can be use as credentials for

So we thought maybe we can retrieve a token trough the API GideSession (gs.getSessionToken()) and then reuse it in the X-UserToken header.

Before that, I wanted to make sure X-UserToken can replace credentials, but I still unable to succeed this test.

I am using SoapUI for my test, first I generate a X-UserToken value (through REST API Explorer).

copy/paste this value in Soap UI as follow and I put nothing in Username/password properties :

As you can see I get a failure status with the error "User Not Authenticated"

What's wrong with my test ? I tought that X-User

Thank's guy

[Hamza Berouil2]

Hi guys,

Thank you for your replies.

Rushit and Andrew, using OAuth suppose using credentials right ? Users in ServiceNow don't have passwords.

Gaurav, I did not understand the reason, can you elaborate more please ?

Thanks

[andrew_venables]

OAuth allows you authorize an application to integrate without sharing username and password credentials.

[Hamza Berouil2]

Thanks again Andrew.

I guess when you set up the first time this you need to set the password once somewhere, right ?

[andrew_venables]

Have you read the article provided by Rushit? Inbound OAuth Auth Code Grant Flow Part 1 - Getting Started with Postman

It really does explain OAuth in SN very well.

[Hamza Berouil2]

Andrew,

In the article, you can see this step :

Click Request Token and a ServiceNow login window will open. Log in using a username/password of your choosing (the user should have access to the incident table for the upcoming tests to work correctly).

Most of the users are End Users and they normally get automatically logged in ServiceNow through SSO, they don't have.

So how can they pass this step ?

Maybe in misunderstood something