Configuring Other Parameters

There are other important parameters in addition to the connection parameters for the ServiceNow admin to configure.

1. Enter the SailPoint attribute to correlate with ServiceNow account. For example, name or accountId. To help ensure successful attribute correlation, you must use the exact name for the attribute as it appears in SailPoint in parenthesis (not the "friendly name" that’s displayed for the identity profile) and you must prefix any second level or custom fields with attributes.

   Note

   An understanding of the data model used to organize your data in SailPoint will help ensure you specify the correct value. Refer to the table of attributes in Second-level Fields for Identities for more information.

   1. Enter the ServiceNow Account attribute to correlate with the SailPoint Identity Cube. For example, user_name.

   Note

   The values of attributes being correlated as a result of mapping a SailPoint attribute and a ServiceNow account attribute are treated as case-insensitive.

   1. Select your choice from Approval Flow.

   The integration relies on ServiceNow Manager approvals before it can create access requests in SailPoint.

   1. To use a SailPoint approval workflow instead, select None.
   2. To use only ServiceNow as a manager in ServiceNow, use Manager Approval (Option included to maintain compatibility to earlier versions, soon to be deprecated).
   3. To use the easy to configure and native ServiceNow approvals, use Configurable Approvals from the Approval Flow list. For more information, refer to Configuring Approval Flow.

2. Select your choice for Generic Approval Definition Enabled (applicable if Configurable Approvals is selected for Approval Flow). For more information, refer to Generic Approval Definition.

3. Select your choice for Multi Account support enabled. Set the “Multi Account support enabled” property to “Yes” to activate the feature. For more information, refer to Configuring Multi Account.

   Screenshot

   

   1. Set the configuration for the Default comments for requested items. Keep it blank to impose comment configuration of SailPoint. For more information, refer to Configuration of the Comments Field.
   2. Select your choice for Is Sunset Date Mandatory for Access Requests? For more information, refer to Configuration of the Sunset Date Field.
   3. Select your choice for Skip user selection screen for users who can request access for self only. If the user will select access only for themselves, leave the default value as Yes. This bypasses the user selection screen and redirects them to the sign in page. If the user needs to be able to request access for others, change the value to No. This requires the user to select a user before it redirects them to the sign in page.

   4. Enter page URL to redirect after submission (Default: Service Portal page). This is where you want your user to be redirected after successfully creating a new ServiceNow Access request. For example,

   5. You can leave the field empty to redirect the user to the default Service Portal page.

   6. You can specify a relative path that starts with / to redirect the user to that page. For example, to send a user to the Manage Access page use /sp?id=manage_access.

   7. You can enter a URL with an absolute path to a page or site. For example,

      https://www.sailpoint.com/ 10. Enter a user-friendly Header that will be displayed in the sidebar. For example, SailPoint Identity Security Cloud for Service Catalog. 11. Select your choice for Show Header text box?

   Instructional text in the remaining customizable header fields will be applicable based on your choice:

   1. User Header text
   2. Add Access Header text
   3. Recommendations Header text
   4. Remove Access Header text

   5. Review & Submit Header text.

      For more information, refer to Configuring Page Headers. 12. Select whether you want to Display Non-Requestable Access Objects or not. 13. Set the configuration for List and order of Search results tab. Exact text separated by comma to be used. (For manage_access page and Native search only) For more information refer to Configuring the Search Results Tab 14. Enter additional query conditions for Additional query for fetching list of access profiles, Additional query for fetching list of roles, and Additional query for fetching list of entitlements. Through these, the admin user can filter Roles, Access Profiles and Entitlements using any attribute the access object has. Only those filtered values will be available for end users. By default, these fields are empty.

   Examples of a query condition

   Screenshot

   

   Screenshot

   

   Screenshot

   

   Screenshot

   

   Note

   For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

   1. Enter the number of search results in Count of displayed access profiles/roles/entitlements on one page (Max 250)
   Screenshot

   

   1. Enter user attributes to display on user selection screen (separated by comma).These are the attributes you want to make available on the users search page. Use field names from the sys_user table separated by a comma.

   Note

   For both SailPoint Access Request 2 and ISC Request Sample 2 widgets, ensure that the attributes configured under Display Fields exactly match the field names available in the sys_user table. Configure only those attributes that exist as valid fields in the sys_user table.

4. Enter user attributes to search by on user selection screen (separated by a comma). These are the attributes you want to use for the users search page. Use fields names from the sys_user table separated by a comma.

5. Select how you want to manage Separation of Duties policy checks for the selected users before a new access request can be raised. For example,

   • Disabled (default) - There is no Separation of Duties violation check for the selected users.
   • Soft: allow submission - The Separation of Duties violation check is applied for all the selected users. If there is a violation, a warning message is displayed and the request can be submitted.
   • Hard: reject submission - The Separation of Duties violation check is applied for all the selected users. If there is a violation, an error message is displayed and the request cannot be submitted.

6. To show the recommendations tab, select Yes for Show Recommendations, applicable only if required license available This property is applicable only if a required license is available.

7. Specify the field name that will be used to store the access request ID from SailPoint. This field name is used to link tickets created by SailPoint Identity Security Cloud for ServiceNow Catalog with those created for the same request by SailPoint for Service Desk. This property is applicable only if you have both the SailPoint Identity Security Cloud for Service Catalog and SailPoint for Service Desk store applications installed on the same ServiceNow instance. The default value is correlation_id. You can change it to another custom field if you are already using correlation_id on requested item for other integration. For more information, refer to Linking with the SailPoint for Service Desk Application.

8. Specify the value for status check timer activity in minutes. Default value is 1440 minutes which is 24 hours The default configuration for the workflow involves pooling statuses from SailPoint once every 24 hours. However, this can be adjusted to align with specific business requirements using the provided property.

   Important

   Exercise caution when adjusting this value, as setting it too low may lead to requests being canceled. Recommended value: no less than 720.

   Note

   For app version 3.1.0 and earlier, the required steps are outlined in Configure Status Pooling Timer.

   1. The Auto Approve Enabled field is applicable to customers with app version 3.2.0 and later. The default setting is No. If Yes is selected, the approval request will be auto-approved if the approver and requester/requested for are the same user.

   Note

   • This property applies exclusively to the rule types of ServiceNow User, ServiceNow Manager, Identity Security Cloud Owner and Identity Security Cloud Manager.
   • The property does not apply to ServiceNow Workflow, ServiceNow Flow, and Identity Security Cloud Workflow.

9. The Property to determine which logs to print. Choices are debug, info, warn and error. Default is warn is used to determine the level of logging. For more information, refer to Debug and Error Handlers.

10. The Native Search Redirect Page ID (example: manage_access) setting is useful if Native Search is implemented. For more information, refer to Configuring Native Search.
11. Select Save.

Application Level Configuration

Refer to Application Level Configuration for more information.

Employee Service Center Portal Configuration

The Manage Access request page can now also be included with the Employee Service Center portal.

Creating a Quick Link Record

A quick link to the Manage Access page must be manually configured in the Employee Service Center because this is not an automatic process during app installation.

1. Sign in as an administrator, and change the application scope to Global.

2. Go to the application navigator, enter Quick Links in the filter navigator, and open the Employee Center Quick Links menu.

   Screenshot

   

3. Select New, and enter the following details:

   1. Content type - Page
   2. Page - manage_access
   3. Provide a Quick link name and Title.
   4. Ensure it is marked as Active.

   5. (Optional) Provide a background image.

      Screenshot

      

4. Select Submit.

5. Go to the Employee Center homepage by entering https://instance-name.service-now.com/esc in the browser.

6. Select the logo in the top-left corner. This ensures that the redirect homepage is selected while adding the quick link widget.

   Screenshot

   

7. Highlight the homepage ID from the URL after id= and copy it.

   Screenshot

   

8. Change the application scope to Employee Center or Employee Center Pro depending on which scope your homepage is in. In this example, change to the Employee Center Pro scope.

9. Use the application navigator to open Service Portal Configuration, and then select Designer from the options shown.

   Screenshot

   

   Screenshot

   

10. Paste the copied homepage ID to search for it.

    Screenshot

    

11. Select the Pencil icon in the Quick Links widget. If the widget is not already listed on your homepage, search for it in the Widgets list on the left-hand side and add it to the page.

    Screenshot

    

12. In the widget instance pop-up, look for Quick links.

    Screenshot

    

13. Search for the newly created Quick links entry and select Save.

    Screenshot

    

14. Confirm that the Manage Access quick link is available on the homepage.

    Screenshot

    

Reports, Debug and Error Handlers

Admins and users with appropriate access to SailPoint Access Request - Service Catalog can reference end user requests via the Requested SailPoint Items report. To access the report, go to SailPoint Identity Security Cloud > Requested SailPoint Items in the fulfiller view. A list will display the active user requests and their SailPoint correlation IDs that were created within the instance for SailPoint Access Request - Service Catalog.

Visible columns include Correlation ID, which stores the request ID generated in SailPoint, along with all the variables displayed as columns.

Pages using widgetized code introduced from v4.0 will have the ability to display a varying level of debug and error messages. These play a crucial role to pinpoint bugs, troubleshoot issues, and ensure the stability.

Log levels can be configured to Debug, Info, Warn and Error. The default and suggested value is Warn.

ServiceNow displays a specific error type along with all error types that are higher in the hierarchy. The default error log hierarchy is as follows: Error > Warn > Info > Debug. Therefore, when the default value is set to Warn, both errors and warnings will be recorded in the ServiceNow logs table.

Setting the property to Debug will lead to an increased number of messages appearing in the logs table. It is recommended to use this setting judiciously, particularly when diagnosing a specific issue.

Admins have the option to select the Logs link to specifically identify errors associated with this application, in addition to the standard ServiceNow system logs table.

This table lists the specific errors that the widgetized SailPoint Service Connector code, implemented in version 4.0, will log.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.