Impersonate a user via API?

[nils_drews]

Hello all,

I want to write an integration with ServiceNow for a third party webapp. They want to display the tickets of the actual user (same username here and there, auth via LDAP) in the third party webapp.

The way I imagined this is that I either do a full oauth2 handshake and then pull the information with these credentials OR that I get some admin credentials in some middleware server and then try to impersonate the user in question to get the information.

But I could not find information if ServiceNow supports oAuth2 (as a provider) and/or if the API allows the impersonation of a different user?

Is there really only the possibility to authenticate via the API with Basic Auth, forcing me to gather a password?

Bye, Nils Drews

[Jacob_Andersen]

Basic Auth and/or ws-security are the two OOB ways to authentication into a web service API in ServiceNow.   If you'd like to create an additional way, you can create a new script include called [YourName]Auth and then reference the new name in the http authentication header.   The simplest way would be to look at the BasicAuth (or CustomAuth) script include to see how you'd get started.

[nils_drews]

I'm not (yet) familiar with ws-security, but that does not allow impersonation of another user (given I have admin creds)?

Adding a new auth script ... phew, I was hoping to keep the coding end to my side and use OOTB ways for the ServiceNow parts. If needed we can pursue that for sure.

[Jacob_Andersen]

This may take you deeper than you wish to go (ws-security is not really simple) but here is some documentation: Web Services Security - ServiceNow Wiki   You can specify which user you'd like to authenticate as once the certificate is validated.

[nils_drews]

Sorry, my brain starts hurting. You warned me that the rabbit hole is deep ...

From what I read up to now you need to provide a fixed username to impersonate for when you have authenticated with WS security!? So either I authenticate with MY credentials (x509 or basic auth) and then get impersonated as a fixed user or I authenticate with the certificate and then use the supplied username/password to re-authenticate (somehow this does not make sense as I need a password?)?

Or can I supply a certificate which then gets validated and also pass on a username token without password which then gets used to impersonate that user (if I'm allowed to do that)? Then what does this here mean:

The password value in the incoming Username Token is used to authenticate the request. 

Somehow this feels like a many-to-one mapping in regards to impersonation: Lots of users can use the API and be known to the system as a fixed user ("ITIL user" in the examples) rather than what I need: One credentials and then impersonate many users ...

Please can you set me straight here if I am right or show me a way on how I could get for example tickets of a certain user without forcing him to re-authenticate all times? OAuth2 comes to my mind for this ... but this is not (yet?) supported I think?

Bye, Nils