Bi-directional Incident Integration Between Two ServiceNow Instances Using OAuth

[Mahalakshmi Rav]

Hi all,

I have a requirement where I need to showcase bi-directional integration between two ServiceNow instances (let’s call them PDI A and PDI B) for the Incident table.

Whenever an incident is created, updated or deleted in one instance, it should automatically reflect in the other instance PDI A to PDI B, and vice versa so changes in PDI B should also sync back to PDI A.

I want to use OAuth 2.0 for authentication instead of basic auth and that's the main requirement here.

Steps which i executed:
1. So far, I have created an OAuth profile in Instance B (as an OAuth client) and created one integration user with the necessary roles and web service access is enabled.

2. In Instance A, I created an OAuth provider profile using the same client ID and secret, set up a REST message and successfully generated an OAuth token. I then created a POST method, but when I try to test 'Create INC http', it’s throwing an error.

I’m not sure what went wrong, can someone please advise?

Thanks!

[Priyanka64]

Hello @Mahalakshmi Rav 

The error in your last screenshot is the key clue: “OAuth token request failed: Illegal token failed with code 400 – Forbidden username password combo” - This indicates that the OAuth token generation itself is failing before the REST API call is executed. Please validate the integration user credentials and ensure the user is active with the required roles assigned.

To validate the credentials:

Temporarily uncheck the Web service access only option on the integration user.
Open the instance in an incognito window and log in using the integration user credentials.
Once logged in, verify that the user can access the Incident table and create a new record.
After validation, re-enable the Web service access only checkbox for the user and test the integration again.

If this helps, kindly mark the answer as helpful/correct.

Thanks,

Priyanka

[Mahalakshmi Rav]

Hi @Priyanka64 , I tried your steps and the integration user can create the incident record and I'm still getting the same 403 error. But do we have to link the integration user anywhere to the oAuth profile?

[Tanushree Maiti]

Hi @Mahalakshmi Rav 

Check and confirm whether in your instance Explicit Roles plugin is enabled. If the glide.security.use_explicit_roles plugin is active, users may need the snc_internal role to pass basic ACLs.

If yes , follow these KB.

refer KB: KB2217023 Users facing "403: You do not have permission to access this page" when trying to access/n... 

KB2466644 Intermittent 403 Error When Sending API Requests to ServiceNow Instance 

2. An access token with a READ scope will fail with a 403 if it attempts a POST or DELETE operation.

    Refer: Limit the access granted to an OAuth client by using REST API authentication scopes.

3.  If the integration works initially but fails later, the access token may have expired without a proper refresh.

     add scope "offline_access" .  Check the Refresh token status from mange token in the application navigator.

4. Ensure the integration user has roles like rest_service and table-specific roles . Check ACL role on specific table and make sure user having that role.

Refer:KB0720934 Forbidden Username/password Combo error with Outbound Rest Call 

[adilalee200]

i'm also facing same issue