LDAP Integration Best Practices to Handle Name Changes

MGanon · ‎06-11-2019

Hi,
Our LDAP populates ServiceNow users and groups using the account name as the integration key. What are some best practices to accommodate changes to the account name? We don't to orphan the record with the previous name.

TrevorK · ‎06-11-2019

I think it would depend on your AD Account renaming procedure. How ServiceNow handles it will depend entirely on how you handle it in AD.

We used to do it how you did - with the account name being the link. It became a problem for the exact reason your specified, account renames. For a bit we did those renames manually in ServiceNow and then decided to look for a better way. So we now coalesce on GUID.

For example, say we have John.Doe changing to John.Smith. We would rename John.Doe to John.Smith. We then create a placeholder account titled John.Doe from scratch so that no one can ever claim that user name again (for us this can cause a whole host of problems that we really do not want to deal with).

In this scenario we coalesce on the GUID. The GUID is the unique identifier attached to each AD Account (like a sys_id in ServiceNow). Because we rename the account the GUID stays the same, and therefore ServiceNow is updated with the new account info like any other field.

Renaming the account and keeping the GUID the same is what makes it super simple for AD management. Keeping the GUID the same means no issues with everyday items like folder permissions, group memberships, etc. Again just like the sys_id in ServiceNow allows you to change any element of the record but still retain things like the relationships.

I would suspect many organizations handle it like above because it's just the simpliest way to do it without introducing any potential loss of service (e.g. someone delegated their calendar and because the GUID is the same it just works).

View solution in original post

MGanon · ‎07-16-2019

I run a query for name OR samaccountname OR objectsid and then coalesce against sys_id.