Integrating IdentityNow with Your ServiceNow Service Catalog

[#1]

This Compass article has been replaced with Integrating SailPoint with ServiceNow Service Catalog. To learn more about this change, refer to this Connectivity Update.

SailPoint’s ServiceNow Service Portal Integration for IdentityNow enables SailPoint customers who also use ServiceNow to request and manage access through the Service Catalog – following a familiar workflow for a more seamless experience.

The ServiceNow Service Portal Integration for IdentityNow and IdentityIQ are separate ServiceNow apps available in the ServiceNow store.

What’s New?

• Starting in 2020, SailPoint ServiceNow apps will be distributed exclusively via the ServiceNow store. We’ve streamlined the process so you can install and deploy our apps more easily, following a process that’s familiar to ServiceNow users.
  
  
• Access approvals are now handled by ServiceNow—and securely communicated to your SailPoint platform—so you don’t have to interrupt your workflow and leave the ServiceNow platform.

IMPORTANT: Due to these significant improvements, if you’re currently using an earlier version of the SailPoint ServiceNow application, you’ll need to remove it before replacing it with this new version. After you’ve installed the new version from the ServiceNow store, upgrading to future versions will be much simpler.

PREREQUISITES:

• A supported SailPoint platform: an instance of an IdentityNow org with Access Requests enabled that you are authorized to access as an Administrator.
  
  
• A supported version of ServiceNow (Quebec, Paris, Orlando, New York*) that you are authorized to access as an Administrator.
  
  
• A source of ServiceNow accounts that SailPoint can load account information from, so each account can be associated with an identity, and access for each identity can be governed.

*This version is no longer supported by ServiceNow. SailPoint is providing "best effort" support for this version.

See the attached guide for instructions on integrating ServiceNow Service Catalog with IdentityNow.

IMPORTANT: When installing the SailPoint IdentityNow for Service Catalog v2 app check the Load demo data option before you click Install. This will ensure that the endpoint data required for the app to function correctly is loaded during installation.

[spatil19]

@kelly_wells thank you for this documentation and clear outline. However, I am trying to looking for a couple of things that I can't find in any of the docs on community.

1. How do we pull in access profiles and roles from IdentityNow into ServiceNow under manage access link for end users to request? And can a subset of access profiles and roles be brought in? or is it all access profiles and all roles will come in automatically?

2. For each of the items that requestable in service catalog, is it possible for them to follow a different approval workflow? For example:- we have 10 access profiles, which are split into application A and B with 5 access profiles each. Can my access profiles related to application A follow approvalworkflow1 and application B follow approvalworkflow2? And where is the configuration for that?

We are trying to setup a brand new Service Now service catalog information so v2.3.

[kelly_wells]

@spatil19 Thanks for letting me know that you found the documentation helpful! I believe that all IdentityNow access profiles and roles become eligible to be requested upon successful configuration of the integration. I don't believe you can select a subset, but I will defer to @joey_lee to confirm.

Likewise, I expect that all access request approvals must follow the same default workflow (based on this callout on page 13 of the .pdf guide): IMPORTANT: Modifications to the default workflow are not covered by your SailPoint Support agreement.

[charles_chen]

One of our clients try to follow the document and here's the comment:

The approver needs x_sap_intidn.user role in ServiceNow

“As an Administrator, you’ll need to assign the role associated with the application integration to every ServiceNow user who will use the ServiceNow Portal Integration for IdentityNow to request access.”

“x_sap_intidn.user Users with this role can access the SailPoint IdentityNow for Service Catalog Integration Manage Access page, where they can request access”.

No mention whatsoever in the document of the approver needing to have the role to support the OOTB workflow.

[spatil19]

@joey_lee do you have any input on my questions?

[nibanez]

Hi @spatil19  did you receive an answer for your question? I have the same doubts and I cannot find any documentation about it.

[kaweiss319]

Through this connector, are you able to expose the application tiles or would this require a custom solution? 

[begjo]

Thank you for this excellent article however I was hoping to search for documents on performance improvement while using ServiceNow Catalog to request access as it takes more than required time to process the request after clicking on submit. Looks like , I had come across something on compass earlier but unable to find it anymore.

[questjj]

Attempting a fresh configuration of 2.3, cant get snow to retrieve existing access profiles for a selected user.  We get this message:

No access found! Please search again!!

Any help uncovering what setup step I missed would be really appreciated.

[shadabalamora]

Hi Sailpoint IDN Experts

I am implementing Sailpoint IDN - Service Catalog. We know when user login into ServiceNow they click on tab>Manage Access, and then User needs to be selected and then we need to select Role/Access Profiles/Entitlement and then we can review and finally Submit the request.

My Question, Can we have additional page (where we can add UI to capture additional details) to get more input in addition to user and Access selection and then take the additional value in the Workflow.

Thank you

Shadab

[kkaufmann]

Has anyone successfully implemented a solution for working with ServiceNow delegates?  If a manager has assigned someone as a delegate in ServiceNow, how do we get that user access to Manage Access for the manager's direct reports?