Using Encrypted credentials for scripted outbound web service calls

evanlw · ‎02-11-2015

Hi,

I have an Integration problem that I was hoping the community could help with.

I need to have:

an outbound SOAP web service call
which uses Basic authentication
and is executed via a MID server
while either:
- making sure the credentials are encrypted within ServiceNow (to prevent casual viewing)
- or ideally not even stored on our ServiceNow instance - but credentials are obtained locally via the MID server

These are scripted web service calls (based currently on a SOAPRequest).

Initially, I thought that the External Credential Store would meet these needs directly:

http://wiki.servicenow.com/index.php?title=External_Credential_Storage

But from what I can tell, this is limited to Discovery Probes and logons to host operating systems.

Another potential solution may be to use Credential tagging ...

http://wiki.servicenow.com/index.php?title=Assigning_Credentials_to_Orchestration_Activities

but, it's also unclear if this would work when attached to a simple SOAP request.

Finally, if none of these options are feasible, my thoughts are that the most straightforward method is to:

define a system property - which is 'Password (2 Way Encrypted)' type field, then to decrypt it:
and then decrypt it via the SOAP invocation script, with something like this:

var unencryptedPassword = (new GlideEncrypter()).decrypt(item.getValue("basic_auth_password"))

Some obvious issues to consider are:

need to make sure that any logging of this does not include the password
ensure the appropriate read/write roles are assigned

I do also see that Fuji may be able to offer some help here as well.

http://wiki.servicenow.com/index.php?title=Outbound_SOAP_Web_Service

This gives an example of creating a SOAP record - and assigning the basic auth credentials, and then being able to invoke that via a script:

http://wiki.servicenow.com/index.php?title=Scripting_Outbound_SOAP

Can anyone offer any experiences of solutions in this area?

thanks,

Evan

john_andersen · ‎02-20-2015

Evan,

There are a few ways to tackle this. One, you could first have a Web Service Call that reaches out to your credential store to get the credential first and then use that credential in your next web service call.

Another option is to write a MID Server Script Include that leverages a Java JAR file and have a Javascript Probe call into the Java libraries on the MID Server to grab the credential from your internal credential store and then you execute the web service call directly from that MID Server script using the credential you got from the store.

Here is a video example of leveraging a JAR file:

http://www.john-james-andersen.com/blog/service-now/video-use-custom-jar-files-on-a-mid-server.html

Also an article on MID Server Script Includes and Javascript Probes:

JavascriptProbe and MID Server Script Includes-John Andersen

It is considerably more javascript coding, but that would work and it would be an alternative if you feel that the password encryption in ServiceNow is insufficient for you.

View solution in original post

Runjay Patel · ‎12-20-2020

Check out this video, it will clear all your doubts and help you to understand Web Service Integration (REST Bi-Directional) queries in details.

Link: https://www.youtube.com/watch?v=RcUxIT4pooY&t=32s&ab_channel=ServiceNowHelpdesk

It help you to understand below points.

Understand Web Service. Like when and how we will use it.
Understand in details about Inbound and Outbound web service.
Understand in details about Inbound Import set and Scripted Rest APIs.
Outbound Rest Message.
Set up Inbound and Outbound in ServiceNow Instance to see live data exchange. We will use Salesforce tool to consume the data.
Troubleshooting
Best way to Learn Web Services integration like (REST, SOAP)
Integration: Rest API
Scripted Web Services to Create/Update INC/CHG/REQ
Automate a rest or soap integration

Please mark reply as Helpful/Correct, if applicable. Thanks!!