# SailPoint ServiceNow CMDB Discovery Connector Documentation

> ServiceNow CMDB Discovery Connector Documentation

# Documentation

# Additional Settings

Schedule discovering applications connected to the ServiceNow CMDB instance on these configuration pages. You can modify and manage scheduling aggregation directly within the interface.

## Discovery Settings

1. In the **Additional Settings** section, select **Discovery Settings**.
2. To aggregate enterprise applications that are connected to your discovery source, select **Start Discovering**. The aggregation begins immediately and occurs once.
3. Select **Enable Schedule** to schedule recurring aggregations.

   > **Screenshot**
   >
   > [![Discovery Settings](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/common/assets/img/discovery_enable_schedule.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/common/assets/img/discovery_enable_schedule.png>)
4. Select the **Frequency** from the dropdown, and enter the time of day.

   - **Daily** - Aggregation occurs once per day at the time selected.

     1. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown.
   - **Weekly** - Aggregation occurs once per week on the day and time selected.

     1. Select a **Day** of the week, Sunday - Saturday, from the dropdown.
     2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown.
   - **Monthly** - Aggregation occurs once per month on the date and time selected.

     1. Select a **Date** of the month, 1 - 28, from the dropdown.
     2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown.

   > **Note**
   >
   > The time zone (GMT offset) for the entitlement aggregation schedule is determined by the time zone set for the connected virtual appliance cluster.
5. Select **Save**.

## Latest Application Discovery

Information about the most recent application discovery is displayed under **Latest Application Discovery**.

## Discovery Activity

To view the list of all enterprise application aggregations on this source, select **Discovery Activity**. When applications are being aggregated, an entry is added to the Discovery Activity section. This includes information like the admin who started the aggregation (for manual aggregations), the date and time the aggregation occurred, the number of objects scanned, and its current status. Aggregations are ordered by most recent aggregation task. You can also sort by status to quickly find success, warning, error, and terminated tasks.

> [!NOTE]
>
> **Screenshot**
>
> [![Discovery Activity](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/common/assets/img/discovery_activity.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/common/assets/img/discovery_activity.png>)

# Connecting SailPoint and ServiceNow CMDB

To connect SailPoint and ServiceNow CMDB, perform the following tasks:

## Adding Discovery Connector in SailPoint

Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to [Discovering Enterprise Applications](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/app_discovery.html#discovering-applications-automatically>).

1. Go to **Admin \> Connections \> Discovery Connectors**.
2. Select **Create Connector**.
3. Select **Connector Category**.
4. Select **Continue**.
5. Search for a source type and select **Configure**.
6. Review the directions and select **Start Connector Setup**.
7. Review the pre-populated source name, source owner, and description. To update, select **Edit**.

   > **Note**
   >
   > Source name must be unique.
8. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
9. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page.
10. Select **Finish**. A test connection is performed in the background.
11. If the test connection is successful, your source is created, and you are prompted to run a discovery.

    - If you want to discover applications now, select **Discover**.

      - **Additional Settings \> Discovery Settings** - The latest application discovery history is shown.
      - **Additional Settings \> Discovery Activity** - Discovered applications are listed.
    - If you want to discover applications later, select **Cancel**. As no discovery has taken place, in the source details:

      - **Additional Settings \> Discovery Settings** - The latest application discovery history is blank.
      - **Additional Settings \> Discovery Activity** - No discovered applications are listed.

      You are navigated to the **Sources** page, where the source created is listed.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary.

> [!NOTE]
>
> Ensure that the name and description of each connector is unique.

1. Enter a descriptive **Connector Name** for the connection.
2. Enter the **Description** that provides details necessary to distinguish it from similar connection sources.
3. In **Connector Owner**, enter the name of the owner responsible for administrating, operating and managing the source system.
4. Select **Save**.

## Connection Settings

Choose the appropriate authentication type and provide the information required to connect and interact with the source.

> [!NOTE]
>
> Each time you change the **Authentication Type** for the ServiceNow CMDB connector, you must perform a **Test Connection**.

You can configure your source using one of the following authentication types:

- [Configure the Connection with Basic Authentication](<#configure-the-connection-with-basic-authentication>)
- [Configure the Connection with OAuth 2.0 Authentication](<#configure-the-connection-with-oauth-20-authentication>)

### Configure the Connection with Basic Authentication

> [!NOTE]
>
> **Screenshot**
>
> [![Basic Authentication](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/basic.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/basic.png>)
>
> [![Basic Authentication](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/basic1.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/basic1.png>)

1. Enter the **Host URL** for the ServiceNow instance that is used for communication.
2. Select **Basic** as the Authentication Type.
3. Enter the **Username** and **Password** that have the appropriate permissions.
4. Select **Save**.

### Configure the Connection with OAuth 2.0 Authentication

> [!NOTE]
>
> **Screenshot**
>
> [![OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth.png>)

1. Enter the **Host URL** for the ServiceNow instance that is used for communication.
2. Select **OAuth 2.0** as the Authentication Type. Select [Refresh Token](<#refresh-token>) or [Client Credentials](<#client-credentials>) as the **Grant Type**.

#### Refresh Token

> [!NOTE]
>
> **Screenshot**
>
> [![Refresh Token](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth_rt.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth_rt.png>)

1. Enter the **Client ID** and **Client Secret** for OAuth 2.0 authentication.
2. Enter the **Refresh Token** for OAuth 2.0 authentication. For more information on creating an OAuth 2.0 profile on your ServiceNow instance, refer to [ServiceNow: Create an endpoint for clients to access instance](<https://docs.servicenow.com/bundle/rome-platform-administration/page/administer/security/task/t_CreateEndpointforExternalClients.html>).

   To create a refresh token, use the following cURL command:

   ```text
   $ curl -d "grant_type=password&client_id=be3aeb583ace210011c15b24a43e25d8
   &client_secret=client_password
   &username=admin&password=admin"
   POST https://instancename.service-now.com/oauth_token.do
   ```

   For more information, refer to [ServiceNow: OAuth API request parameters](<https://docs.servicenow.com/bundle/orlando-platform-administration/page/administer/security/reference/r_OAuthAPIRequestParameters.html>).
3. Select **Save**.

#### Client Credentials

> [!NOTE]
>
> **Screenshot**
>
> [![Client Credentials](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth_cc.png>)](<https://documentation.sailpoint.com/connectors/discovery/cmdb/servicenow_cmdb/help/img/oauth_cc.png>)

> [!NOTE]
>
> - The Okta External OIDC Provider in ServiceNow is supported with the Client Credentials Grant Type.
> - To configure OAuth 2.0 in the SailPoint Identity Governance connector, an OAuth 2.0 Token URL, Client ID, and Client Secret are required. The OAuth 2.0 Token URL, Client ID, and Client Secret are specific to the Okta instance that is configured in ServiceNow as an External OIDC Provider.
> - For configuration in ServiceNow, refer to [Product Documentation | ServiceNow](<https://docs.servicenow.com/bundle/vancouver-platform-security/page/administer/security/task/add-OIDC-entity.html>).

1. Enter the **OAuth 2.0 Token URL**.

   For example, if you use the Okta External OIDC Provider:

   `{yourOktaDomain.com}/oauth2/{authorizationServerId}/v1/token`

   For example, if you use the Inbound client credentials grant type by ServiceNow:

   `https://instancename.service-now.com/oauth_token.do`
2. Enter the **Client ID** and **Client Secret**.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Discovering Applications with ServiceNow CMDB

The SailPoint ServiceNow CMDB Discovery connector fetches the details of applications configured in ServiceNow CMDB. It provides continuous application discovery, revealing inventory and ownership across the enterprise while prioritizing governance efforts on high-impact applications. This guide provides instructions to configure a discovery source. For more information, refer to [Discovering Enterprise Applications - SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/app_discovery.html#available-discovery-sources>).

## Supported Features

- Test Connection
- Discover Application

## Required Permissions

- `itil` - A general ITSM role that grants read access to various CMDB tables.
- `cmdb_read` - A role that specifically allows read-only access to CMDB data.

To ensure the SailPoint ServiceNow CMDB connector functions correctly, verify that read access to the following tables has been provided via web services.

- User \[sys\_user\]

Complete the following to provide the application access:

1. Select the Global scope in ServiceNow.
2. Go to **System Definition \> Tables**.
3. Search for the table using the label or name.
4. Select the table and scroll to **Application Access**.
5. Select the **Can read** and **Allow Access to this table via web services** checkboxes.
6. Select **Update** and save the table.

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).