Connecting ServiceNow With a Custom Role
In the case that we are unable to use a ServiceNow user with admin privileges, we should be able to recreate the same Glean experience with a user that has a custom role. The majority of steps will be the same as listed in the ServiceNow Connector Set-up Instructions except for the following:
-
The User that will be fetching on behalf of does not need to be an admin (or have admin privileges). However, an admin (or a user with
security_admin
privileges) may be required to complete some of the following steps. -
Create the user that will be used. Let’s call this user
gleansearch
. -
Create a custom role. Let’s call this
CustomRole
. -
Click on the user (Organizations > Users) and then set
CustomRole
for the usergleansearch
under Roles near the bottom of the page. -
When creating the ACL Rule (System Security > Access Control (ACL)) for the Scripted REST API, then set
CustomRole
as the role for the ACL Rule. -
Set the ACL Rule that requires the
CustomRole
for both the new Scripted REST API and the/user_criteria
endpoint. -
In step 3, instead of setting roles for the user, provide read access to the necessary tables. As a security admin, you can do this by creating a new ACL Rule for each table, granting
CustomRole
the read record access. You also need to provide the read access for all fields of the table, which is done in a separate ACL Rule. Ultimately, you will create two ACL Rules for each of the following tables:sys_user
sys_user_role
sys_user_has_role
sys_user_group
sys_user_grmember
user_criteria
kb_knowledge
kb_knowledge_base
kb_uc_can_read_mtom
kb_uc_cannot_read_mtom
kb_uc_can_contribute_mtom
kb_uc_cannot_contribute_mtom
kb_category
kb_use
sc_cat_item
sc_cat_item_user_criteria_mtom
sc_cat_item_user_criteria_no_mtom
sc_category
sc_catalog
topic
sys_audit_delete
(if provided access)incident
(if enabled)cmdb_ci_business_app
(if enabled)dmn_demand
(if enabled)pm_project
(if enabled)rm_epic
(if enabled)
Here’s what this could look like:
- ACL to read the table (e.g.
sys_user
) - ACL to read the properties of the table (e.g. sys_user.*)
- Add the itil (Information Technology Infrastructure Library) role to the user gleansearch. This enables the user to read tables interaction (Interactions) and sc_request (Requests)
- Follow the subsequent steps as described in the instructions and then you should be all done.