​

Introduction

• Authentication: is done by creating a dedicated user account with specified permissions and profiles
• API Usage: Glean will use the Table API and then Scripted REST API for advanced user criteria
• Permissions Enforcement: Glean respects all user access permissions, ensuring users only see search results for documents they have access to. When a user clicks on a search result, they are taken to the ServiceNow web application, which enforces the permission
• Data Storage: All data is stored in the customer’s project within the customer’s cloud account, ensuring no data leaves the customer’s environment

​

Content Captured:

• Knowledge Articles
• Service Catalog

• ITSM
• APM
• SPM

​

ServiceNow Permissions

• Admin access to setup the connector
• Admin access for the Service Account is preferred (Custom role can be defined)

​

Versions Supported

​

Objects Supported

​

Knowledge articles:

• knowledge base
• short description
• workflow state
• created by
• description
• knowledge base category
• view count
• custom fields (for knowledge articles created from custom templates)

​

Catalog items:

• title
• created by
• short description
• description
• catalog category
• sc_catalogs

​

ITSM:

• number
• short description
• description
• comments and work notes
• state
• priority
• impact
• urgency
• category
• assigned to
• opened by

​

Authentication Mechanism

​

Connector credentials requirements

• Glean requires authentication by utilizing a dedicated Service Account and OAuth Application
• Glean understands all user access permissions and strictly enforces them at the time of the query, ensuring that users cannot see results to which they do not have access.
• It’s important to note that all data is stored in the customer’s project in the customer’s cloud account, and no data leaves the customer’s environment.
• Glean only requires READ-level permissions.

​

Creating a Service Account in ServiceNow

​

Create a service account that Glean will use for fetching information from ServiceNow:

1. Navigate to Organization > Users and click New.
   • Set User ID to gleansearch
   • Check Web service access only.
   • Set the Time zone to GMT. This is required for Glean to pick up new content updates.
   • Leave the remaining fields as-is. Click Submit.
2. Click on the gleansearch user that was created.
   • Click Set Password and choose a strong password (save for connector setup).

​

Provide access to sys_audit_delete table

1. Create a new role: read_access_sys_audit_delete:
   1. Navigate to User Administration → Roles.
   2. Click on New and enter the name as
   3. read_access_sys_audit_delete
   4. Click Save.
2. Add an ACL rule that gives this role read access to the sys_audit_delete table:
   1. Elevate role to security_admin to be able to create a new ACL.
   2. Navigate to System Security → Access Control (ACL).
   3. Click on New and enter the following details.
      • Type: record
      • Operation: read
      • Name: Select the sys_audit_delete table
      • Add the new read_access_sys_audit_delete role under Requires role
   4. Click Submit.
3. Assign the new role read_access_sys_audit_delete to gleansearch user.

​

Configure an OAuth Application

1. Navigate to System OAuth → Application Registry and click New.
2. Click Create an OAuth API endpoint for external clients.
3. Set Name to Glean Search OAuth.
4. Set Refresh Token Lifespan to 2,147,483,647.
5. Set Access Token Lifespan to 86,400.
6. Leave the remaining fields as defaults and Click Submit.

​

Validate System Properties:

1. Navigate to the System Properties List (All → Enter sys_properties.list).
2. Identify and note the system property glide.knowman.apply_article_read_criteria and its value.
3. Identify and note the system property glide.knowman.block_access_with_no_user_criteria and its value.
4. Identify if there are any Knowledge Article templates enabled and want to index template-based articles.
   • Navigate to All → System Applications → All Available Applications → All
   • Search for the plugin Knowledge Management Advanced (com.snc.knowledge_advanced) and check if it is enabled.

​

Creating a Custom Role in ServiceNow

1. Create the user that will be used and name it: gleansearch
2. Create a custom role named: CustomRole
3. Click on the user (Organizations → Users) and then set CustomRole for the user gleansearch under Roles
4. When creating the ACL Rule (System Security → Access Control (ACL)) for the Scripted REST API, then set CustomRole as the role for the ACL Rule.
5. Set the ACL Rule that requires the CustomRole for both the new Scripted REST API and the /user_criteria endpoint.
6. In step 2, instead of setting roles for the user, provide read access to the necessary tables (see below). As a security admin, create a new ACL Rule for each table, granting CustomRole the read record access. Provide the read access for all fields of the table in a separate ACL Rule. Create two ACL Rules for each of the following tables:
   1. sys_user
   2. sys_user_role
   3. sys_user_has_role
   4. sys_user_group
   5. sys_user_grmember
   6. user_criteria
   7. kb_knowledge
   8. kb_knowledge_base
   9. kb_uc_can_read_mtom
   10. kb_uc_cannot_read_mtom
   11. kb_uc_can_contribute_mtom
   12. kb_uc_cannot_contribute_mtom
   13. kb_category
   14. kb_use
   15. sc_cat_item
   16. sc_cat_item_user_criteria_mtom
   17. sc_cat_item_user_criteria_no_mtom
   18. sc_category
   19. sc_catalog
   20. topic
   21. sys_audit_delete (if provided access)
   22. incident (if enabled)
   23. cmdb_ci_business_app (if enabled)
   24. dmn_demand (if enabled)
   25. pm_project (if enabled)
   26. rm_epic (if enabled)
7. Add the itil (Information Technology Infrastructure Library) role to the user gleansearch. This enables the user to read tables interaction (Interactions) and sc_request (Requests)
8. Follow the subsequent steps as described in the instructions.

​

API Endpoints