Credential stores for Password Reset

Credential stores hold user information such as user names and passwords that can be used as login credentials. Examples include the User table [sys_user] or an Active Directory server.

Users with the password_reset_admin or password_reset_credential_manager role can create and modify connections to credential stores.

Credential store types installed with the base system

A credential store type is a set of workflows that specify how to connect to a credential store. Navigate to Password Reset > Credential Store Types to view the list of example credential stores that are based on the base-system types. The base system includes the following credential store types:

Name	Description
Local ServiceNow Instance	Represents the current (local) ServiceNow instance.

Credential store types included in Store apps

Name	Description
Microsoft AD Credential Store	Represents a Microsoft Active Directory credential store. See Set up Microsoft Active Directory for Password Reset.
Microsoft Entra ID Credential Store	Represents a Microsoft Entra ID credential store.
Okta credential store	Represents an Okta credential store.
Google credential store	Represents a Google Directory credential store.

Connection subflows for credential store types

A credential store type workflow requires a subflow that defines how to connect to the store, and can include an optional subflow that defines how to test the connection. Use the Pwd reset – AD and Pwd Reset - Local subflows as models for your custom connection workflows.

Figure 1. Pwd Reset Local sub workflow

Figure 2. Pwd connection test local SN sub workflow

Creating a custom credential store type

You can use a credential store type as a model to create a custom type. See Create a credential store type for Password Reset.

• Configure the connection to a credential store for the Password Reset processes
  You create a Password Reset credential store record to configure access to your credential store server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see, restrictions on password reuse, the allowed number of failed reset attempts, and other settings.
• Credentials Store for Password Reset for Active Directory
  A credential store type is a set of workflows that specify how to connect to a credential store. You can connect to Password Reset Credential Stores to view the list of example credential stores that are based on the base-system types.
• Credential Store for Password Reset for Microsoft Entra ID
  A credential store type is the set of flows to manage password and account of Microsoft Entra ID user. Navigate to Password Reset > Credential Stores to view the list of example credential stores that are based on the base-system types.
• Test the connection to a credential store
  You should test the connection to a credential store after you configure a new credential store or when users experience problems that might involve the connection.
• Delete a connection to a credential store for Password Reset
  Important: Before you delete the connection to a credential store, check all Password Reset processes to ensure that the credential store is not in use. If the credential store is being used by a process, update the process before deleting the credential store.

Related concepts

• Password Reset verifications

Related tasks

• Configure password expiration reminder
• Configure your Password Reset process to auto-enroll users
• Enable users to enroll for Password Reset
• Configuring Password Reset properties
• Send email to remind users to enroll for Password Reset
• Configure the required strength for passwords
• Specify lockout for failed login attempts
• Configure Google reCAPTCHA for the password reset process

Related reference

• Calculating the security score for password reset process