External Credential Store - Rome Upgrade issues

[Fabian Kunzke]

ECS plugin - Rome upgrade changes

With the recent Rome upgrade ServiceNow has added support for using multiple credential stores at once. Previously, only one CredentialResolver.jar extension could be shared to a Mid-Server. This meant, that you could either use only one credential resolver - and thus would have to code the logic, which credential store to use, into it - or have different CredentialResolver.jars on different Mid-Servers and assign credentials to those Mid-Servers accordingly.

With Rome however, this changed.

You can now create multiple "Credential Vault" records and assign the corresponding CredentialResolver.jar to each vault individually. Then, when creating a new credential record, use the "Credential storage vault" field to select the respective vault record. This way, the correct resolver .jar will be used related to the credential.

Great, whats the issue?

For some odd reason, ServiceNow has decided to update all existing credential records with "demo" data (in quotes, as i don't actually know where this data originates from). In our case, all credentials were filled with "Credential storage vault" set to "CyberArk". However, we were not using CyberArk, nor is that vault record correctly configured - or even configured at all.

This lead to no credentials being received from the actual external credential store. Therefore, no devices were discovered anymore.

Solution?

To solve this - short term - we had to set all credentials "Credential storage vault" to "-None-". Long term however, the respective .jar file as well as the correct vault record should be created.

For you this could mean, checking your credential records and also adjusting them as we did.

NOTE: this default data change is not stated in the release notes.