2 Deploying the ServiceNow Connector

The procedure to deploy the connector can be divided into the following stages:

Note:

Some of the procedures described in this chapter must be performed on the target system. To perform these procedures, you must use an ServiceNow account with administrator privileges.

2.1 Registering the Client Application

Registering a client application with the target system so that the connector can access ServiceNow REST APIs. It also involves creating a user account, modifying ACL values and adding a specific role to a user.

Registering the client application involves performing the following tasks on the target system:

Note:

The detailed instructions for performing these preinstallation tasks are available in the ServiceNow product documentation at https://docs.servicenow.com.
  1. Create a user account on the target system and assign the user_admin role. The connector uses this account to connect to the target system during reconciliation and provisioning operations.
  2. Modify the access control list values (also referred as ACL values) for user role management. This step elevates the user access privilege for the target system user account earlier created. Edit the ACL values for adding various user specific roles that are required for the target system user account.
  3. Register the ServiceNow connector as a client application with the ServiceNow instance to provide secure sign-in and authorization for your services. To do so:
    1. Activate the OAuth 2.0 plugin in the ServiceNow instance. This step is required for generating the client ID and client secret values.
    2. Create an OAuth application to generate the client ID and client secret. Note down the client ID and client secret values as they are required while configuring IT resource parameters.

2.2 Installation

Installing the connector requires you to run the connector installer and then configure the IT resource.

2.2.1 Understanding Installation of the ServiceNow Connector

You can run the connector code either locally in Oracle Identity Manager or remotely in a Connector Server.

Depending on where you want to run the connector code (bundle), the connector provides the following installation options:

  • Run the connector code locally in Oracle Identity Manager.

    In this scenario, you deploy the connector in Oracle Identity Manager. Deploying the connector in Oracle Identity Manager involves performing the procedures described in Running the Connector Installer and Configuring the IT Resource for the Target System.

  • Run the connector code remotely in a Connector Server. In this scenario, you deploy the connector in Oracle Identity Manager, and then, deploy the connector bundle in a Connector Server. See Using an Identity Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for information about installing, configuring, and running the Connector Server, and then installing the connector in a Connector Server.

2.2.2 Running the Connector Installer

When you run the Connector Installer, it automatically copies the connector files to directories in Oracle Identity Manager, imports connector XML files, and compiles adapters used for provisioning.

Note:

In this guide, the term Connector Installer has been used to refer to the Connector Installer feature of Oracle Identity System Administration.

To run the Connector Installer:

  1. Copy the contents of the connector installation media into the following directory: OIM_HOME/server/ConnectorDefaultDirectory.
  2. Log in to Oracle Identity System Administration by using the user account described in Creating the User Account for Installing Connectors of Oracle Fusion Middleware Administering Oracle Identity Manager.
  3. In the left pane, under Provisioning Configuration, click Manage Connector.
  4. In the Manage Connector page, click Install.
  5. From the Connector List, select ServiceNow Connector -RELEASE_NUMBER .
    This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory mentioned in the Step 1.

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List, click Refresh.

    3. From the Connector List, select ServiceNow Connector -RELEASE_NUMBER.

  6. Click Load.
  7. To start the installation process, click Continue.

    The following tasks are performed in sequence:

    1. Configuration of connector libraries

    2. Import of the connector XML files (Using Deployment Manager)

    3. Compilation of Adapter Definitions

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 1.

    If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed.

  8. Click Exit to close the installation page.
    If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of steps that you must perform after the installation are displayed. These steps are as follows:
    1. Ensuring that the prerequisites for using the connector are addressed.
    2. Configuring the IT resource for the connector.
      The procedure to configure the IT resource is described later in this guide
    3. Configuring the scheduled jobs.
      The procedure to configure the IT resource is described later in this guide.

      When you run the Connector Installer, it copies the connector files to destination directories on the Oracle Identity Manager host computer. Connector files available as part of the connector installation media are listed in Files and Directories of the ServiceNow Connector.

2.2.3 Configuring the IT Resource for the Target System

An IT resource for your target system is created after you install the connector. You configure this IT resource to let the connector connect Oracle Identity Manager with your target system.

This section discusses the following topics:

2.2.3.1 IT Resource Parameters

An IT resource is composed of parameters that store connection and other generic information about a target system. Oracle Identity Manager uses this information to connect to a specific installation or instance of your target system.

Table 2-1 IT Resource Parameters

Parameter Description

Configuration Lookup

Name of the lookup definition that stores configuration information used during reconciliation and provisioning.

Default value: Lookup.ServiceNow.Configuration

Connector Server Name

If you have deployed the ServiceNow connector in the Connector Server, then enter the name of the IT resource for the Connector Server.

authenticationServerUrl

Enter the URL of the authentication server that is used to authenticate the resource owner user name and password.

Sample value: https://ven01622.service-now.com/oauth_token.do

authenticationType

Type of the authentication.

Default value: password

Do not modify the value of the parameter.

Note: The sample value implies OAuth 2.0 resource owner password. ServiceNow target instance supports only the OAuth 2.0 resource owner password type.

clientId

Client identifier issued to the client during the registration process.

Sample value: ab0781d7c00a120039f0dbb350692319

The clientId is obtained while performing the procedure described in Registering the Client Application.

clientSecret

Enter the client secret used to authenticate the identity of the client application.

Sample value:?*AV79Zx}

The clientSecret is obtained while performing the procedure described in Registering the Client Application.

host

Host name or IP address of the computer hosting the target system.

Sample value: ven01623.service-now.com

password

Password used for the OAuth 2.0 resource owner password authentication.

port

Port number at which the target system is listening.

Sample value: 443

sslEnabled

If the target system requires SSL connectivity, then set the value of this parameter to true. Otherwise set the value to false.

username

Enter the user name for the OAuth 2.0 authentication. This user name is used during password authentication of the resource owner.

Sample value:johnsmith

proxyHost

Name of the proxy host used to connect to an external target.

Sample value:

www.example.com.

proxyPort

Proxy port number.

Sample value:

80

proxyUser

Proxy user name of the target system user account that Oracle Identity Manager uses to connect to the target system.

proxyPassword

Password of the proxy user ID of the target system user account that Oracle Identity Manager uses to connect to the target.

2.2.3.2 Specifying Values for the IT Resource Parameters

The IT resource for the target system contains connection information about the target system. Oracle Identity Manager uses this information during provisioning and reconciliation.

The ServiceNow IT resource is automatically created when you run the Connector Installer. You must specify values for the parameters as follows:

  1. Log in to Oracle Identity System Administration.
  2. In the left pane, under Configuration, click IT Resource.
  3. In the IT Resource Name field on the Manage IT Resource page, enter ServiceNow and then click Search.
  4. Click the edit icon for the IT resource.
  5. From the list at the top of the page, select Details and Parameters.
  6. Specify values for the parameters of the IT resource, ServiceNow. See IT Resource Parameters for information about IT resource parameters.
  7. To save the values, click Update.

2.3 Postinstallation

This topic discusses the following postinstallation procedures:

2.3.1 Configuring Oracle Identity Manager

You must create a UI form and an application instance for the resource against which you want to perform reconciliation and provisioning operations. In addition, you must run entitlement and catalog synchronization jobs.

2.3.1.1 Creating and Activating a Sandbox

You must create and activate a sandbox to begin using the customization and form management features. You can then publish the sandbox to make the customizations available to other users.

See Creating a Sandbox and Activating and Deactivating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.1.2 Creating a New UI Form

You can use Form Designer in Oracle Identity System Administration to create and manage application instance forms. See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Manager.

While creating the UI form, ensure that you select the resource object corresponding to the ServiceNow connector that you want to associate the form with. In addition, select the Generate Entitlement Forms check box.

2.3.1.3 Associating the Form with the Application Instance

By default, an application instance named ServiceNow Application Instance is automatically created after you install the connector. You must associate this application instance with the form created in Creating a New UI Form.
After updating the application instance, you must publish it to an organization to make the application instance available for requesting and subsequent provisioning to users. However, as a best practice, perform the following procedure before publishing the application instance:
  1. In Oracle Identity System Administration, deactivate the sandbox.
  2. Log out of Oracle Identity System Administration.
  3. Log in to the Oracle Identity Self Service and activate the sandbox that you deactivated in Step 1.
  4. In the Catalog page, search for and add to cart the application instance updated in and then click Checkout.
  5. Publish the application instance only if everything appears correctly. Otherwise, fix the issues and then publish the application instance. See Publishing an Application Instance to Organizations in Oracle Fusion Middleware Administering Oracle Identity Manager .

2.3.1.4 Publishing a Sandbox

Before you publish a sandbox, perform the following procedure as a best practice to validate all sandbox changes made till this stage as it is hard to revert changes once a sandbox is published:
  1. In the Oracle Identity System Administration, deactivate the sandbox.
  2. Log out of the Oracle Identity System Administration.
  3. Log in to the Oracle Identity Self Service using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.
  4. In the Catalog, ensure that the ServiceNow application instance form appears with correct fields.
  5. Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:
  1. Run the scheduled jobs for lookup field synchronization discussed in Scheduled Job for Lookup Field Synchronization.
  2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table.
  3. Run the Catalog Synchronization Job scheduled job.

    See Also:

    Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager

2.3.1.6 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

  1. Create and activate a sandbox. See Creating a Sandbox and Activating and Deactivating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.
  2. Create a new UI form for the resource. See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Manager.
  3. Open the existing application instance.
  4. In the Form field, select the new UI form that you created.
  5. Save the application instance.
  6. Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.2 Localizing Field Labels in UI Forms

You can localize UI form field labels by using the resource bundle corresponding to the language you want to use. Resource bundles are available in the connector installation media.

To localize field label that is added to the UI forms:
  1. Log in to Oracle Enterprise Manager.
  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.
  3. In the right pane, from the Application Deployment list, select MDS Configuration.
  4. On the MDS Configuration page, click Export and save the archive to the local computer.
  5. Extract the contents of the archive, and open the following file in a text editor:

    SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en.xlf

  6. Edit the BizEditorBundle.xlf file in the following manner:
    1. Search for the following text:

      <file source-language="en"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    3. Search for the application instance code. This procedure shows a sample edit for ServiceNow application instance. The original code is:
      <trans-unit
      id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_SN_USR_USERNAME__c_description']}">
      <source>User Name</source>
      <target/>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.snform.entity.snformEO.UD_SN_USR_USERNAME__c_LABEL">
      <source>First Name</source>
      <target/>
      </trans-unit>
      
    4. Open the properties file from resource folder in the connector package, for example ServiceNow_ja.properties, and get the value of the attribute from the file, for example,

      global.udf.UD_SNA_USR_ USER_NAME =\u30A2\u30AB\u30A6\u30F3\u30C8\u540D
      
    5. Replace the original code shown in Step 7.c with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.use
      rEO.UD_SN_USR_ USER_NAME __c_description']}">
      <source>Account Name</source>
      <target>u30A2\u30AB\u30A6\u30F3\u30C8\u540D</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.Servicenow.entity
      sEO.UD_SN_USR_UserName__c_LABEL">
      <source>Account Name</source>
      <target>\u30A2\u30AB\u30A6\u30F3\u30C8\u540D</target>
      </trans-unit>
      
    6. Repeat Steps 7.a through 7.d for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

    8. Repackage the ZIP file and import it into MDS.

      Note:

      See Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for more information about exporting and importing metadata files
    9. Log out of and log in to Oracle Identity Manager.

2.3.3 Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache you can either restart Oracle Identity Manager or run the PurgeCache utility. The following is the procedure to clear the server cache by running the PurgeCache utility:

  1. In a command window, switch to the OIM_HOME/server/bin directory.
  2. Enter one of the following commands:
    • On Microsoft Windows: PurgeCache.bat All

    • On UNIX: PurgeCache.sh All

    When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

    t3://OIM_HOST_NAME:OIM_PORT_NUMBER

    In this format:

    • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

    • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

    You can use the PurgeCache utility to purge the cache for any content category.

2.3.4 Managing Logging for the ServiceNow Connector

You can set a log level based on Oracle Java Diagnostic Logging and enable logging in the Oracle WebLogic Server. The following topics contain detailed information:

2.3.4.1 Understanding Log Levels

Oracle Identity Manager uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the logs to one of the following available levels:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These log levels are mapped to ODL message type and level combinations as shown in Table 2-2.

Table 2-2 Log Levels and ODL Message Type: Level Combinations

Log Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SERVER are the domain name and server name specified during the installation of Oracle Identity Manager.

2.3.4.2 Enabling Logging

To enable logging in Oracle WebLogic Server:

  1. Edit the logging.xml file as follows:

    1. Add the following blocks in the file:

      <log_handler name='Servicenow-handler' 
      level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
           <property name='path' value='[FILE_NAME]'/>
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
      
      <logger name="ORG.IDENTITYCONNECTORS.SERVICENOW" level="[LOG_LEVEL]" useParentHandlers="false">
           <handler name="servicenow-handler"/>
           <handler name="console-handler"/>
         </logger>
      
    2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. .

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages specific to connector operations to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME] :

      <log_handler name='Servicenow-handler' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
           <property name='path' value='/<%OIM_DOMAIN%>/servers/oim_server1/logs/serviceNowScriptLogs.log>"
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
       
      <logger name="ORG.IDENTITYCONNECTORS.SERVICENOW" level="NOTIFICATION:1" useParentHandlers="false">
           <handler name="Servicenow-handler"/>
           <handler name="console-handler"/>
         </logger>
      

    With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

  2. Save and close the file.

  3. Set the following environment variable to redirect the server logs to a file:

    For Microsoft Windows:

    set WLS_REDIRECT_LOG=FILENAME
    

    For UNIX:

    export WLS_REDIRECT_LOG=FILENAME
    

    Replace FILENAME with the location and name of the file to which you want to redirect the output.

  4. Restart the application server.

2.3.5 Configuring SSL for ServiceNow

Configure SSL to secure data communication between Oracle Identity Manager and ServiceNow.

Note:

If you are using this connector along with a Connector Server, then there is no need to configure SSL. You can skip this section.
To configure SSL:
  1. Obtain the SSL public key certificate of ServiceNow.
  2. Copy the public key certificate of ServiceNow to the computer hosting Oracle Identity Manager.
  3. Run the following keytool command to import the public key certificate into the identity key store in Oracle Identity Manager:
    keytool -import -alias ALIAS -trustcacerts -file CERT_FILE_NAME -keystore KEYSTORE_NAME -storepass PASSWORD
    In this command:
    • ALIAS is the public key certificate alias.

    • CERT_FILE_NAME is the full path and name of the certificate store (the default is cacerts).

    • KEYSTORE_NAME is the name of the keystore.

    • PASSWORD is the password of the keystore.

    The following is a sample value for this command:

    keytool -import -alias serverwl -trustcacerts -file supportcert.pem -keystore client_store.jks -storepass weblogic1

    Note:

    • Change the parameter values passed to the keytool command according to your requirements. Ensure that there is no line break in the keytool arguments.

    • Ensure that the system date for Oracle Identity Manager is in sync with the validity date of the SSL certificate to avoid any errors during SSL communication.