The New Way for MID Servers to Authenticate: Private Key JWTs
As ServiceNow, and the industry at large, moves toward a future without Basic Authentication, we're changing how MID Servers connect to your ServiceNow instance. This is rolling out now in Zurich Patch 11 and Australia Patch 4 for Commercial Cloud instances. Testing for Regulated Markets is in progress.
The Problem with Basic Authentication
In practice, maintaining best practices with Basic Auth is difficult. ServiceNow recommends using one ServiceNow user per MID and regular password rotation, but this is a painful process to maintain especially for those of you with 100s of MID Servers. And since this password is just plain text, it is easy for the secret to be left copied in a notepad or email somewhere. This leaves the environment in a situation where one (easily) leaked credential has a large blast radius.
What's Changing: ServiceNow Certificates
We're introducing authentication using JSON Web Tokens (JWT), backed by private keys managed by the Instance PKI (IPKI). Here's generally how it works:
- On first startup, your MID Server authenticates with a one-time registration key.
- The MID Server generates a private key and certificate signing request (CSR), then requests a certificate.
- Your Instance PKI issues a certificate bound to that MID Server.
- From that point on, the MID authenticates using a short lived JWT, not a shared password.
- Certificates rotate every 45 days so there's no manual upkeep once a MID is set up.
Modified Onboarding Experience
This rolls out alongside a simpler command line installer. With these changes, validation happens automatically and there is no need to create a new ServiceNow user for every MID Server or configure config.xml manually. The only thing you need to bring is the service account/user details to run the MID Server process itself. One thing to keep in mind for now: you'll still need to assign applications and capabilities to the MID Server yourself after setup. A patch to streamline this is coming soon.
This new flow is available through the ITOM Infra Services Workspace. If you need the previous onboarding page, it's still there for now at mid_server_download_ui.do.
Impact of Change
- New MIDs using JWTs do not need a unique user or manual validation.
- Every MID Server gets its own verifiable machine identity.
- Credentials expire and rotate automatically.
- Private Key is much less likely to leak in plain text compared to user password.
What You Need to Do
When you're ready, you can migrate existing MID Servers from Basic Auth to JWT using the Auth-Type migration tab in the ITOM Infra Services Workspace. It's a one-click migration through the instance itself. I would recommend testing it in sub-prod on a single MID Server first before rolling it out further.
Longer term, Basic Auth will be disabled by default on ServiceNow instances. That timeline hasn't been determined yet, but we will share it well in advance. I would recommend bringing new MID Servers up with JWT instead of Basic Auth (or migrating them soon after they come up, if that is easier with your MID Server creation processes).
If you have questions, please reach out to me directly at j.christian.wu <at> servicenow.com.
