3 Configuring the ServiceNow Connector

While creating an application, you must configure connection-related parameters that the connector uses to connect Oracle Identity Governance with your target system and perform connector operations. In addition, you can view and edit attribute mappings between the process form fields in Oracle Identity Governance and target system columns, predefined correlation rules, situations and responses, and reconciliation jobs.

3.1 Basic Configuration Parameters

These are the connection-related parameters that Oracle Identity Governance requires to connect to the ServiceNow Target application.

Table 3-1 Basic Configuration Parameters for the ServiceNow Connector

Parameter Mandatory? Description

host

Yes

Enter the host name of the computer hosting your target system.

Sample valueven01623.service-now.com

authenticationType

Yes

Enter the type of authentication used by your target system.

Sample valuepassword

Connector Server Name

No

By default, this field is blank. If you are using this connector with the Java Connector Server, then provide the name of Connector Server IT Resource here.

authenticationServerUrl

No

Enter the URL of the authentication server that validates the client ID and client secret for your target system.

Sample value: https://ven01622.service-now.com/oauth_token.do

clientId

No

Enter the client identifier (a unique string) issued by the authorization server to your domain while registering your client application with the target system.

Sample valueab0781d7c00a120039f0dbb350692319

See Configuring the Target System for details on obtaining the clientId value.

clientSecret

No

Enter the value used to authenticate the identity of your domain. This value is generated while registering your client application with the target system.

Sample value?*AV79Zx}

See Configuring the Target System for details on obtaining the clientSecret value.

username

No

Enter the user name of the target system that you create for performing connector operations.

Sample valuejohnsmith

password

No

Enter the password of the target system user account that you create for connector operations.

Sample valuepassword

port

No

Enter the port number at which the target system is listening.

Sample value443

sslEnabled

No

If the target system requires SSL connectivity, then set the value of this parameter to true. Otherwise set the value to false.

proxyHost

No

Enter the name of the proxy host used to connect to an external target.

Sample valuewww.example.com

proxyPassword

No

Enter the password of the proxy user ID of the target system user account that Oracle Identity Governance uses to connect to the target system.

proxyPort

No

Enter the proxy port number.

Sample value80

proxyUser

No

Enter the proxy user name of the target system user account that Oracle Identity Governance uses to connect to the target system.

uriPlaceHolder

No

Enter a comma-separated list of key-value pairs for replacing place holders in the relURIs in the following format:

KEY;VALUE

Sample value: "tenant_id;domain name","api_version;apiversion=1.6"

3.2 Advanced Settings Parameters

Advanced configuration parameters vary depending on whether you are creating a target application or an authoritative application.

3.2.1 Advanced Settings Parameters for a Target Application

These are the configuration-related entries that the connector uses during reconciliation and provisioning operations against Target applications.

Note:

Unless specified, do not modify entries in the below table.

Table 3-2 Advanced Settings Parameters for a Target Application

Parameter Mandatory? Description

relURIs

Yes

This entry holds the relative URL of every object class supported by this connector and the connector operations that can be performed on these object classes.

Default value:

"__ACCOUNT__.CREATEOP=/api/now/v2/table/sys_user?sysparm_input_display_value=true",

"__ACCOUNT__.SEARCHOP=/api/now/v2/table/sys_user?$(Filter Suffix)$&sysparm_limit=$(PAGE_SIZE)$&sysparm_offset=$(PAGE_OFFSET)$",

"__ACCOUNT__=/api/now/v2/table/sys_user/$(__UID__)$?sysparm_input_display_value=true",

"__GROUP__.CREATEOP=/api/now/v2/table/sys_user_group","__GROUPLKP__.SEARCHOP=/api/now/v2/table/sys_user_group?$(Filter Suffix)$&sysparm_limit=$(PAGE_SIZE)$$&sysparm_offset=$(PAGE_OFFSET)$",

"__GROUPLKP__=/api/now/v2/table/sys_user_group/$(__UID__)$","__ROLELKP__.SEARCHOP=/api/now/v2/table/sys_user_role?$(Filter Suffix)$&sysparm_limit=$(PAGE_SIZE)$$&sysparm_offset=$(PAGE_OFFSET)$",

"__ACCOUNT__.__GROUP__.UPDATEOP=/api/now/table/sys_user_grmember","__ACCOUNT__.__ROLE__.UPDATEOP=/api/now/table/sys_user_has_role",

"__ACCOUNT__.__GROUP__.SEARCHOP=/api/now/v2/table/sys_user_grmember?sysparm_query=user.sys_id=$(__UID__)$&sysparm_limit=$(PAGE_SIZE)$$&sysparm_offset=$(PAGE_OFFSET)$",

"__ACCOUNT__.__ROLE__.SEARCHOP=/api/now/table/sys_user_has_role?sysparm_query=user.sys_id=$(__UID__)$&sysparm_limit=$(PAGE_SIZE)$$&sysparm_offset=$(PAGE_OFFSET)$",

"__ACCOUNT__.__GROUP__.DELETEOP=/api/now/table/sys_user_grmember/$(__MEMBERSHIP__.sys_id)$",

"__ACCOUNT__.__MEMBERSHIP__.__GROUP__.SEARCHOP=/api/now/v2/table/sys_user_grmember?sysparm_query=user.sys_id=$(__UID__)$%5Egroup.sys_id=$(__GROUP__.sys_id)$",

"__ACCOUNT__.__ROLE__.DELETEOP=/api/now/table/sys_user_has_role/$(__MEMBERSHIP__.sys_id)$",

"__ACCOUNT__.__MEMBERSHIP__.__ROLE__.SEARCHOP=/api/now/v2/table/sys_user_has_role?sysparm_query=user.sys_id=$(__UID__)$%5Erole.sys_id=$(__ROLE__.sys_id)$",

"Department.SEARCHOP=/api/now/v2/table/cmn_department?sysparm_limit=$(PAGE_SIZE)$$&sysparm_offset=$(PAGE_OFFSET)$","__ACCOUNT__.__ENABLE__.UPDATEOP=/api/now/v2/table/sys_user/$(__UID__)$?sysparm_input_display_value=true",

"__ACCOUNT__.__ENABLE__.UPDATEOP=/api/now/v2/table/sys_user/$(__UID__)$?sysparm_input_display_value=true"

nameAttributes

Yes

This entry holds the name attribute for all the objects that are handled by this connector. For example, for the __ACCOUNT__ object class that it used for User accounts, the name attribute is user_name.

Default value:

"__ACCOUNT__.user_name","__GROUP__.name","__GROUPLKP__.name","__ROLE__.name","__ROLELKP__.name","Department.name"

uidAttributes

Yes

This entry holds the uid attribute for all the objects that are handled by this connector.

Default value:

__ACCOUNT__.sys_id","__GROUP__.value","__GROUPLKP__.sys_id","__ROLE__.value","__ROLELKP__.sys_id","Department.sys_id"

Bundle Name

No

This entry holds the name of the connector bundle.

Default value:

org.identityconnectors.genericrest

Bundle Version

No

This entry holds the version of the connector bundle.

Default value: 12.3.0

opTypes

No

This entry specifies the HTTP operation type for each object class supported by the connector. Values are comma separated and are in the following format: OBJ_CLASS.OP=HTTP_OP In this format, OBJ_CLASS is the connector object class, OP is the connector operation (for example, CreateOp, UpdateOp, SearchOp), and HTTP_OP is the HTTP operation (GET, PUT, or

POST).

Default value:

"__ACCOUNT__.__GROUP__.UPDATEOP=POST","__ACCOUNT__.__ROLE__.UPDATEOP=POST"

Connector Name

No

This entry holds the name of the connector.

Default value:

org.identityconnectors.genericrest.GenericRESTConnector

Any Incremental Recon Attribute Type

No

By default, Oracle Identity Governance accepts timestamp information sent from the target system only in Long datatype format. A decode value of True for the Incremental Recon Attribute Type entry indicates that Oracle Identity Governance accepts timestamp information in any datatype format.

Default value: true

pageSize

No

This entry holds how many resources appears on a page for a search operation.

Default value: 100

jsonResourcesTag

No

This entry holds the json tag value that is used during reconciliation for parsing multiple entries in a single payload.

Default value: "__ACCOUNT__=result","__GROUP__=result","__GROUPLKP__=result","__ACCOUNT__.__GROUP__=result","__ACCOUNT__.__ROLE__=result","__ROLE__=result",

"__ROLELKP__=result","Department=result","__ACCOUNT__.__MEMBERSHIP__.__GROUP__=result","__ACCOUNT__.__MEMBERSHIP__.__ROLE__=result"

httpHeaderContentType

No

This entry holds the content type expected by the target system in the header.

Default value: application/json

httpHeaderAccept

No

This entry holds the accept type expected from the target system in the header.

Default value: application/json

specialAttributeTargetFormat

No

This entry lists the format in which an attribute is present in the target system endpoint. Values are comma separated and are presented in the following format: OBJ_CLASS.ATTR_NAME= TARGET_FORMAT.

Default value:

"__ACCOUNT__.__GROUP__=group","__ACCOUNT__.__ROLE__=role"

specialAttributeHandling

No

This entry lists the special attributes whose values should be sent to target one by one ("SINGLE"). Values are comma separated and are in the following format: OBJ_CLASS.ATTR_NAME.PROV_OP=SINGLE

For example, the __ACCOUNT__.__ENABLE__.CREATEOP value in decode implies that during an update provisioning operation, the GROUP attribute of the __ACCOUNT__ object class must be sent to the target.

Default value:

"__ACCOUNT__.__GROUP__.UPDATEOP=SINGLE","__ACCOUNT__.__ROLE__.UPDATEOP=SINGLE","__ACCOUNT__.__ENABLE__.CREATEOP=SINGLE",

"__ACCOUNT__.__ENABLE__.UPDATEOP=SINGLE"

customPayload

No

This entry lists the payloads for all operations that are not in the standard format.

Default value:

"__ACCOUNT__.__GROUP__.UPDATEOP={\"user\": \"$(__UID__)$\",\"group\": \"$(“value”)$\"}","__ACCOUNT__.__ROLE__.UPDATEOP={\"user\": \"$(__UID__)$\",\"role\": \"$(“value”)$\"}","__ACCOUNT__.__ENABLE__.UPDATEOP={\"active\":\"$(__ENABLE__)$\",\"locked_out\":\"false\"}"

statusAttributes

No

This entry lists the name of the target system attribute that holds the status of an account. For example, for the __ACCOUNT__ object class that it used for User accounts, the status attribute is active.

Default value:

"__ACCOUNT__.active"

passwordAttribute

No

This entry holds the name of the target system attribute that is mapped to the __PASSWORD__ attribute of the connector.

Default value: "user_password"

enableEmptyString

No

This entry holds the boolean value and indicates that an empty string needs to be sent to the target system. When the ServiceNow Table API receives a null value for any parameter, and if the enableEmptyString attribute is set to true, then an empty string is sent to the target system.

Default value: true

3.2.2 Advanced Settings Parameters for an Authoritative Application

These are the configuration-related entries that the connector uses during reconciliation runs against an Authoritative application.

Note:

Unless specified, do not modify entries in the below table.

Table 3-3 Advanced Settings Parameters for an Authoritative Application

Parameter Mandatory? Description

relURIs

Yes

This entry holds the relative URL of every object class supported by this connector and the connector operations that can be performed on these object classes.

Default value:

"__ACCOUNT__.SEARCHOP=/api/now/v2/table/sys_user?$(FilterSuffix)$&sysparm_limit=$(PAGE_SIZE)$&sysparm_offset=$(PAGE_OFFSET)$","__ACCOUNT__=/api/now/v2/table/sys_user/$(__UID__)$?sysparm_input_display_value=true"

nameAttributes

Yes

This entry holds the name attribute for all the objects that are handled by this connector. For example, for the __ACCOUNT__ object class that it used for User accounts, the name attribute is user_name.

Default value:

"__ACCOUNT__.user_name"

uidAttributes

Yes

This entry holds the uid attribute for all the objects that are handled by this connector.

Default value:

"__ACCOUNT__.sys_id"

Bundle Name

No

This entry holds the name of the connector bundle.

Default value:

org.identityconnectors.genericrest

Bundle Version

No

This entry holds the version of the connector bundle.

Default value: 12.3.0

Connector Name

No

This entry holds the name of the connector.

Default value:

org.identityconnectors.genericrest.GenericRESTConnector

Any Incremental Recon Attribute Type

No

By default, Oracle Identity Governance accepts timestamp information sent from the target system only in Long datatype format. The value of True for this parameter indicates that Oracle Identity Governance accepts timestamp information in any datatype format.

Default value: true

pageSize

No

This entry holds the number of resources that can appear on a page for a search operation.

Default value: 100

jsonResourcesTag

No

This entry holds the json tag value that is used during reconciliation for parsing multiple entries in a single payload.

Default value: "__ACCOUNT__=result"

httpHeaderContentType

No

This entry holds the content type expected by the target system in the header.

Default value: application/json

httpHeaderAccept

No

This entry holds the accept type expected from the target system in the header.

Default value: application/json

statusAttributes

No

This entry lists the name of the target system attribute that holds the status of an account. For example, for the __ACCOUNT__ object class that it used for User accounts, the status attribute is active.

Default value:

"__ACCOUNT__.active"

enableEmptyString

No

This entry holds the boolean value and indicates that an empty string needs to be sent to the target system. When the ServiceNow Table API receives a null value for any parameter, and if the enableEmptyString attribute is set to true, then an empty string is sent to the target system.

Default value: true

3.3 Attribute Mappings

The attribute mappings on the Schema page vary depending on whether you are creating a target application or a trusted application.

3.3.1 Attribute Mappings for a Target Application

The schema page for a target application displays the default schema (provided by the connector) that maps Oracle Identity Governance attributes to target system attributes. The connector uses these mappings during reconciliation and provisioning operations.

ServiceNow User Account Attributes

Table 3-4 lists the user-specific attribute mappings between the process form fields in Oracle Identity Governance and ServiceNow application columns.

If required, you can edit the default attribute mappings by adding new attributes or deleting existing attributes as described in Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-4 Default Attribute Mappings for ServiceNow User Account

Display Name Target Attribute Data Type Mandatory Provisioning Property? Provision Field? Recon Field? Key Field? Case Insensitive?

User Name

__NAME__

String

Yes

Yes

Yes

No

No

System Id

__UID__

String

No

Yes

Yes

Yes

No

Password

__PASSWORD__

String

No

Yes

No

No

No

First Name

first_name

String

No

Yes

Yes

No

No

Last Name

last_name

String

No

Yes

Yes

No

No

Title

title

String

No

Yes

Yes

No

No

Department

department

String

No

Yes

Yes

No

No

Phone

phone

String

No

Yes

Yes

No

No

Mobile Phone

mobile_phone

String

No

Yes

Yes

No

No

Password Needs Reset

password_needs_reset

String

No

Yes

Yes

No

No

Email

email

String

No

Yes

Yes

No

No

ServiceNow Server

NA

Long

Yes

No

Yes

Yes

No

Locked

locked_out

String

No

Yes

Yes

No

No

Date Format

date_format

String

No

Yes

Yes

No

No

Calendar Integration

calendar_integration

String

No

Yes

Yes

No

No

Time Zone

time_zone

String

No

Yes

Yes

No

No

Web Service Access Only

web_service_access_only

String

No

Yes

Yes

No

No

Internal Integration User

internal_integration_user

String

No

Yes

Yes

No

No

Status

__ENABLE__

String

No

No

Yes

No

No

Figure 3-1 shows the default User account attribute mappings.

Figure 3-1 Default Attribute Mappings for ServiceNow User Account

Description of Figure 3-1 follows
Description of "Figure 3-1 Default Attribute Mappings for ServiceNow User Account "

Role Entitlement Attributes

Table 3-5 lists the roles-specific attribute mappings between the process form fields in Oracle Identity Governance and ServiceNow target application attributes. The table lists whether a given attribute is mandatory during provisioning. It also lists whether a given attribute is used during reconciliation and whether it is a matching key field for fetching records during reconciliation.

If required, you can edit the default attribute mappings by adding new attributes or deleting existing attributes as described in Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-5 Default Attribute Mappings for Role Entitlement

Display Name Target Attribute Data Type Mandatory Provisioning Property? Recon Field? Key Field? Case Insensitive?

Role Name

__ROLE__~__ROLE__~value

String No Yes Yes No

Figure 3-2 shows the default roles entitlement mapping.

Figure 3-2 Default Attribute Mappings for Role Entitlement

Description of Figure 3-2 follows
Description of "Figure 3-2 Default Attribute Mappings for Role Entitlement"

Groups Entitlement Attributes

Table 3-6 lists the attribute mappings for group names between the process form fields in Oracle Identity Governance and ServiceNow target application attributes. The table lists whether a given attribute is mandatory during provisioning. It also lists whether a given attribute is used during reconciliation and whether it is a matching key field for fetching records during reconciliation.

If required, you can edit the default attribute mappings by adding new attributes or deleting existing attributes as described in Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-6 Default Attribute Mappings for Groups

Display Name Target Attribute Data Type Mandatory Provisioning Property? Recon Field? Key Field? Case Insensitive?

Group Name

__GROUP__~__GROUP__~value

String No Yes Yes No

Figure 3-3 shows the attribute mappings for group names between the process form fields in Oracle Identity Governance and ServiceNow target application attributes.

Figure 3-3 Default Attribute Mappings for Groups

Description of Figure 3-3 follows
Description of "Figure 3-3 Default Attribute Mappings for Groups"

3.3.2 Attribute Mappings for an Authoritative Application

The Schema page for an authoritative application displays the default schema (provided by the connector) that maps Oracle Identity Governance attributes to target system attributes. The connector uses these mappings during reconciliation operations.

Table 3-7 lists the user-specific attribute mappings between the reconciliation fields in Oracle Identity Governance and ServiceNow. The table also lists the data type for a given attribute and specified whether it is a mandatory attribute for reconciliation.

If required, you can edit these attributes mappings by adding new attributes or deleting existing attributes on the Schema page as described in Creating an Authoritative Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

You may use the default schema that has been set for you or update and change it before continuing to the next step.

The Organization Name, Xellerate Type, and Role identity attributes are mandatory fields on the OIG User form. They cannot be left blank during reconciliation. The target attribute mappings for these identity attributes are empty by default because there are no corresponding columns in the target system. Therefore, the connector provides default values (as listed in the “Default Value for Identity Display Name” column of Table 3-7) that it can use during reconciliation. For example, the default target attribute value for the Organization Name attribute is Xellerate Users. This implies that the connector reconciles all target system user accounts into the Xellerate Users organization in Oracle Identity Governance. Similarly, the default attribute value for Xellerate Type attribute is End-User, which implies that all reconciled user records are marked as end users.

Table 3-7 ServiceNow User Account Schema Attributes

Identity Display Name Target Attribute Data Type Mandatory Reconciliation Property? Recon Field? Default Value for Identity Display Name

ServiceNow GUID

__UID__

String

No

Yes

NA

User Login

__NAME__

String

No

Yes

NA

First Name

first_name

String

No

Yes

NA

Last Name

last_name

String

No

Yes

NA

Xellerate Type

NA

String

No

Yes

End-User

Email

email

String

No

Yes

NA

Status

__ENABLE__

String

No

Yes

NA

Oragnization Name

NA

String

No

Yes

Xellerate Users

Role

NA

String

No

Yes

Full-Time

Figure 3-4 shows the default User account attribute mappings.

Figure 3-4 Default Attribute Mappings for an Authoritative Application

Description of Figure 3-4 follows
Description of "Figure 3-4 Default Attribute Mappings for an Authoritative Application"

3.4 Correlation Rules

Learn about the predefined rules, responses and situations for Target and Authoritative applications. The connector use these rules and responses for performing reconciliation.

3.4.1 Correlation Rules, Situations, and Responses for a Target Application

When you create a Target application, the connector uses correlation rules to determine the identity to which Oracle Identity Governance must assign a resource.

Predefined Identity Correlation Rules

By default, the ServiceNow connector provides a simple correlation rule when you create a target application. The connector uses this correlation rule to compare the entries in Oracle Identity Governance repository and the target system repository, determine the difference between the two repositories, and apply the latest changes to Oracle Identity Governance.

Table 3-8 lists the default simple correlation rule for ServiceNow connector. If required, you can edit the default correlation rule or add new rules. You can create simple correlation rules also. For more information about adding or editing simple or complex correlation rules, see Updating Identity Correlation Rule in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-8 Predefined Identity Correlation Rule for a ServiceNow Target Application

Target Attribute Element Operator Identity Attribute Case Sensitive? Rule Operator

__NAME__

Equals

User Login

No

AND

In this identity rule:
  • __NAME__ is a single-valued attribute on the target system that identifies the user account.

  • User Login is the field on the OIG User form.

  • Rule Operator is AND

Figure 3-5 shows the simple correlation rule for a ServiceNow target application.

Figure 3-5 Simple Correlation Rule for a ServiceNow Target Application

Description of Figure 3-5 follows
Description of "Figure 3-5 Simple Correlation Rule for a ServiceNow Target Application"

Predefined Situations and Responses

The ServiceNow connector provides a default set of situations and responses when you create a target application. These situations and responses specify the action that Oracle Identity Governance must take based on the result of a reconciliation event.

Table 3-9 lists the default situations and responses for ServiceNow target application. If required, you can edit these default situations and responses or add new ones. For more information about adding or editing situations and responses, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-9 Predefined Situations and Responses for a ServiceNow Target Application

Situation Response

No Matches Found

None

One Entity Match Found

Establish Link

One Process Match Found

Establish Link

Figure 3-6 shows the situations and responses for ServiceNow that the connector provides by default.

Figure 3-6 Predefined Situations and Responses for a ServiceNow Target Application

Description of Figure 3-6 follows
Description of "Figure 3-6 Predefined Situations and Responses for a ServiceNow Target Application"

3.4.2 Correlation Rules, Situations, and Responses for an Authoritative Application

When you create an authoritative application, the connector uses correlation rules to determine the identity to which Oracle Identity Governance must assign a resource.

Predefined Identity Correlation Rules

By default, the ServiceNow connector provides a simple correlation rule when you create an authoritative application. The connector uses this correlation rule to compare the entries in Oracle Identity Governance repository and the authoritative application repository, determine the difference between the two repositories, and apply the latest changes to Oracle Identity Governance.

Table 3-10 lists the default simple correlation rule for ServiceNow connector. If required, you can edit the default correlation rule or add new rules. You can create complex correlation rules also. For more information about adding or editing simple or complex correlation rules, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-10 Predefined Identity Correlation Rule for ServiceNow Authoritative Application

Authoritative Attribute Element Operator Identity Attribute Case Sensitive?
_Name_ Equals

User Login

No
In the correlation rule element:
  • __Name__ is an attribute on the target system that uniquely identifies the user account.

  • User Login is the field on the OIM User form.

  • Rule operator: AND

The following figure shows the simple correlation rule for ServiceNow Authoritative application.

Figure 3-7 Simple Correlation Rule for a ServiceNow Authoritative Application

Description of Figure 3-7 follows
Description of "Figure 3-7 Simple Correlation Rule for a ServiceNow Authoritative Application"

Predefined Situations and Responses

The ServiceNow connector provides a default set of situations and responses when you create an authoritative application. These situations and responses specify the action that Oracle Identity Governance must take based on the result of a reconciliation event.

Table 3-11 lists the default situations and responses for the ServiceNow Authoritative Application. If required, you can edit these default situations and responses or add new ones. For more information about adding or editing situations and responses, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-11 Predefined Situations and Responses for a ServiceNow Authoritative Application

Situation Response

No Matches Found

Create User

One Entity Match Found

Establish Link

Figure 3-8 shows the situations and responses for ServiceNow that the connector provides by default.

Figure 3-8 Predefined Situations and Responses for a ServiceNow Authoritative Application

Description of Figure 3-8 follows
Description of "Figure 3-8 Predefined Situations and Responses for a ServiceNow Authoritative Application"

3.5 Reconciliation Jobs

These are the reconciliation jobs that the connector creates after you create a target or an authoritative application.

3.5.1 Reconciliation Jobs for a Target Application

These are the reconciliation jobs that are automatically created in Oracle Identity Governance after you create the Target application.

You must specify values for the parameters of user reconciliation jobs.

ServiceNow Full User Reconciliation Job

The ServiceNow Full User Reconciliation job is used to fetch all user records from the target system.

You can either use these predefined jobs or edit them to meet your requirements. Alternatively, you can create custom reconciliation jobs. For information about editing these predefined jobs or creating new ones, see Updating Reconciliation Jobs in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-12 describes the parameters of the ServiceNow Full User Reconciliation job.

Table 3-12 Parameters of the ServiceNow Full User Reconciliation Job

Attribute Description

Filter Suffix

Enter the search filter for fetching records from the target system during a reconciliation run.

Sample value: /0e220301db039a00b88df7a0cf9619

See Performing Limited Reconciliation for more information about filtered reconciliation.

Application Name

Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application.

Do not modify this value.

Object Type

Type of object you want to reconcile.

Default value: User

Scheduled Task Name

Enter the name of the scheduled task that is used for reconciliation.

Default value: <Application Name> ServiceNow Full User Reconciliation

Latest Token

Enter the value of the attribute that is specified as the value of the Incremental Recon Attribute attribute. The Latest Token attribute is used for internal purposes. By default, this value is empty.

Note: If an appropriate Increment Recon attribute has been specified, then do not enter a value for this attribute.

Sample value: 2017-11-30T04:44:2 9Z

Reconciliation Jobs for Lookup Field Synchronization

These lookup definitions are used as an input source for lookup fields in Oracle Identity Governance.

The following scheduled jobs are used for lookup fields synchronization:
  • ServiceNow Group Lookup Reconciliation Scheduled Job: This scheduled task is used to fetch data about groups during target resource reconciliation.

  • ServiceNow Role Lookup Reconciliation Scheduled Job: This scheduled task is used to fetch data about roles during target resource reconciliation.

  • ServiceNow Department Lookup Reconciliation Scheduled Job: This scheduled task is used to fetch data about departments during target resource reconciliation.

The parameters for all the reconciliation jobs are the same.

The parameters for all the scheduled jobs for lookup field synchronization are the same. Table 3-13 describes the parameters of the scheduled jobs.

Table 3-13 Parameters of the Reconciliation Jobs for Lookup Field Synchronization

Attribute Description

Application Name

Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application.

Do not modify this value.

Lookup Name

Enter the name of the lookup definition in Oracle Identity Governance that must be populated with values fetched from the target system.

Depending on the reconciliation job you are using, the default values are as follows:

  • For ServiceNow Group Lookup Reconciliation: Lookup.ServiceNow.Groups

  • For ServiceNow Role Lookup Reconciliation: Lookup.ServiceNow.Role

  • For ServiceNow Department Lookup Reconciliation: Lookup.ServiceNow.Department

Object Type

Enter the type of object whose values must be synchronized.

Depending on the scheduled job you are using, the default values are as follows:

  • For ServiceNow Group Lookup Reconciliation: __GROUPLKP__

  • For ServiceNow Role Lookup Reconciliation: __ROLELKP__

  • For ServiceNow Department Lookup Reconciliation: Department

Code Key Attribute

Enter the name of the connector attribute that is used to populate the Code Key column of the lookup definition (specified as the value of the Lookup Name attribute).

Default value: __UID__

Decode Attribute

Enter the name of the connector attribute that is used to populate the Decode column of the lookup definition (specified as the value of the Lookup Name attribute).

Default value :__NAME__

3.5.2 Reconciliation Jobs for an Authoritative Application

These are the reconciliation jobs that are automatically created in Oracle Identity Governance after you create an Authoritative application.

You must specify values for the parameters of user reconciliation jobs.

ServiceNow User Trusted Reconciliation Job

The ServiceNow User Trusted Reconciliation job is used to fetch all user records from the target system.

You can either use these predefined jobs or edit them to meet your requirements. Alternatively, you can create custom reconciliation jobs. For information about editing these predefined jobs or creating new ones, see Updating Reconciliation Jobs in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 3-12 describes the parameters of the user reconciliation job for trusted reconciliation.

Table 3-14 Parameters of the ServiceNow User Trusted Reconciliation Job

Parameter Description

Application Name

Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application.

Do not modify this value.

Filter Suffix

Enter the search filter for fetching records from the target system during a reconciliation run.

Sample value: /0e220301db039a00b88df7a0cf9619

See Performing Limited Reconciliation for more information about filtered reconciliation.

Object Type

Type of object you want to reconcile.

Default value: User

Scheduled Task Name

Enter the name of the scheduled task that is used for reconciliation.

Default value: Application Name ServiceNow User Trusted Reconciliation

Incremental Recon Attribute

Enter sys_updated_on as the value of this parameter. sys_updated_on is the name of the target system attribute that holds the timestamp at which the user record was modified.

Latest Token

Enter the value of the attribute that is specified as the value of the Incremental Recon Attribute attribute. The Latest Token attribute is used for internal purposes. By default, this value is empty.

Note: If an appropriate Increment Recon attribute has been specified, then do not enter a value for this attribute.

Sample value: <String>2019-11-13 05:33:36</String>