Release Notes              

 

 

IBM ® Security Identity Manager

ServiceNow Adapter

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Version 7.1.10

First Edition (2020 June 11 13.11.33)

 

IBM Security Identity Manager ServiceNow Adapter 7.1.10 is available. Compatibility, installation, and other getting-started issues are addressed.

 

Copyright International Business Machines Corporation 2003, 2020. All rights reserved.
US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

 

Table of Contents

Preface. 3

License Agreement. 3

Adapter Features and Purpose. 3

Contents of this Release. 4

Adapter Version. 4

New Features. 5

Closed Issues. 6

Known Issues. 7

Installation and Configuration Notes. 9

Customizing or Extending Adapter Features. 10

Supported Configurations. 11

Installation Platform.. 11

Notices. 12

Trademarks. 13

 

 

 

 

Preface

Welcome to the IBM Security Identity Manager ServiceNow Adapter.

 

These Release Notes contain information for the following products that was not available when the IBM Security Identity Manager manuals were printed:

 

 

License Agreement

Review and agree to the terms of the IBM Security Identity Manager License prior to using this product. The license can be viewed from the "license" folder included in the product package.

 

Adapter Features and Purpose

The ServiceNow Adapter is designed to create and manage accounts on ServiceNow portal. The adapter runs in "agentless" mode. The adapter uses the REST API to establish communication with the ServiceNow server.

  

The Identity Manager adapters are powerful tools that require Administrator Level authority. Adapters operate much like a human system administrator, creating accounts, permissions and home directories Operations requested from the Identity Manager server will fail if the adapter is not given sufficient authority to perform the requested task.

 

 

Contents of this Release

Adapter Version

Component

Version

Release Date

2020 June 11 13.11.33

Adapter Version

7.1.10

Component Versions

Adapter build: 7.1.10.32

Profile  7.1.10

Connector:  N/A  (uses the HTTP Client connector from Security Directory Integrator)

Dispatcher 7.1.39 (packaged separately)

Documentation

The following guides are available in the IBM Knowledge Center

 

ServiceNow Adapter Installation and Configuration Guide

 

 

New Features

 Internal#

Enhancement # (RFE)

Description

 

 

Items included in current 7.1.10 release

 

  RTC 186616

 

Add support for HR attributes - Cost Center, Building, Business Unit, Employee type, Hire Date

 

 

 

Items included in 7.1.9 release

 

 

 

None

 

 

 

Items included in 7.1.8 release

 

  RTC 185407

N/A

Adapter must support private proxy

 

Note: To enable private proxy follow these steps. 

 

 

 

Items included in 7.1.7 release

 

  RTC 184350

 N/A

Added “Do not return inherited roles” in service form

 

  RTC 184351

 N/A

Added Proxy Support

 

 

 

Items included in 7.1.6 release

 

 

 

None

 

 

 

Items included in 7.1.5 release

 

 

 

 

On-Premise Solution support.

 

 

 

Items included in 7.1.4 release

 

 

 

 

None

 

 

Items included in 7.1.3 release

 

 

 

 

Add support for IGI 5.2.2 This adapter is now designed for use with IBM Security Identity Manager, Privileged Identity Manager, and Identity Governance and Intelligence.

 

 

Updated service form to include: company and manager.

 

 

Items included in 7.0.2 release

 

 

 

 

Updated rdn and external attributes for ServiceGroups: ServiceNowGroup and ServiceNowRole

 

 

Updated service form to include: description, owner and prerequisite.

 

 

Items included in 7.0.1 release

 

 

 

 

Initial release for ISIM

 

 

Closed Issues

Internal#

APAR#

Case# / Description

 

 

Items closed in current 7.1.10 release

 

Bugz 3248

TS003746169

RTC 186898

IJ25288

ServiceNow password issue for modify/create user

 

 

 

Items closed in 7.1.9 release

 

 

Bugz 3136, TS003240607 Bugz 3125, TS003162341

RTC 185908

 

 

 

 

Handle null conditions for user object in ServiceNow adapter

 

 

Bugz 3117

RTC 185778

TS003116632

 

 

IJ19873

 

FILTERED RECON FOR SERVICENOW ADAPTER FAILS FOR (!(ERUID=ING_*))

 

 

 

Items closed in 7.1.8 release

 

 

Bugz 3053

RTC 185238

 

 

IJ19873

 

ServiceNow filter of (!(eruid=iNG_*)) fails

 

 

Bugz 3054

RTC 185247,

TS002754323

 

 

IJ20667

 

ServiceNow 6.0.7.19 – recon is timing out / OOM, TS002754323

 

 

 

Items closed in 7.1.7 release

 

RTC 184680

 N/A

Skip bad records during recon

 

 

 

Items closed in 7.1.6 release

 

RTC 182351

 

Fixed “Strange value in ServiceNow timezone supporting data”

 

Known Limitation:  Time zone attribute cannot be set to “system timezone” after been set to some other value.

 

 

 

Items closed in 7.1.5 release

 

 

181206

 

Internal - As an ServiceNow adapter developer, I must ensure that the dn target attribute should be mapped to dn governance attribute by default

 

 

 

Items closed in 7.1.4 release

 

 

 

IJ02613

Fixed incorrect setStatusWarning call in ALs

 

 

Items closed in 7.1.3 release

 

 

 

42650,082,000

Updated searchAL to handle empty groups

 

 

Items closed in 7.0.2 release

 

 

 

 

NULL

 

 

Items closed in 7.0.1 release

 

 

 

 

Initial release for ISIM

 

 

 

 

Known Issues

Internal#

APAR#

Case# / Description

 

 

Invalid attributes values might be ignored by ServiceNow

If invalid attributes values are sent to ServiceNow and the attribute is not required, ServiceNow might ignore the attribute but return successfully instead of returning errors.

 

 

Unable to set choice list field with empty value

Due to API limitation, the adapter is unable to set a choice list with empty value(NULL). There is a workaround if the field value is integer: Overriding the "--None--" display value with NULL_OVERRIDE, as suggested in: Changing the --None-- Display Value Then set the "none" option value to NULL_OVERRIDE in "Design Form" in "Configuration System". "Calendar Integration" is an example of such fields. If the field value type is string and the null value is pointing at another choice, e.g. if null value is displaying System Default, then a possible workaround is to edit the choice label and mark which is the system default. So instead of selecting the null value, we can select the system default with the modified label.

 

 

Unable to reflect data change that happened on ServiceNow

If any modification done by the adapter triggered changes on the ServiceNow server, such as business rules or role inheritance, then these modification will lead to data inconsistency between server and ISIM/PIM/IGI. This is because the adapter is not aware of any modification happens on the server by ServiceNow until reconciliation. We recommend either turn off such business rule on ServiceNow or perform reconciliation after modify those attributes on ISIM/PIM/IGI.

 

 

Only default attribute is included in current release

The current release contains only default attributes of Fuji release.

 

 

 

We recommend to verify any issue encountered with the ServiceNow's REST API explorer first, to make sure it's not due to any setting or restriction related with your instance.

 

 

Installation and Configuration Notes

See the IBM Security Identity Manager ServiceNow Adapter Installation and Configuration Guide for detail instructions.

 

The ServiceNow Adapter Installation and Configuration Guide can be obtained from the IBM Knowledge Center.

 

 

 

Corrections to Installation and Configuration guide

 

The following corrections to the Installation Guide apply to this release:

 

1. Add following point in section 'Service/Target form details' :

       Proxy

       If specified, connect to a proxy server rather than directly to ServiceNow API Login URL. The format is proxyhost:port (for example, proxy:8080), where proxy is the name of  the proxyhost, and 8080 is the port number to use.

       Proxy Username

       Specify the proxy user name that is used with proxy server. Required if Use Proxy Authentication.

       Proxy Password

       Specify the proxy password that is used with proxy server. Required if Use Proxy Authentication.

 

       HR Plugins Enabled

       Select this checkbox if HR Plugins are installed on service now portal. This is for HR attributes hire date and employment type.

 

 

2. Add the following point in chapter 'Troubleshooting' section 'Error messages and problem solving'

 

 Problem

Corrective Action

 Reconciliation API throws error "Transaction cancelled: maximum execution time exceeded"

This error comes when execution time exceeded. By default on instance maximum time duration is 60 sec. whenever any API takes time more than that it throws this error –

"error":{"message":"Transaction cancelled: maximum execution time exceeded","detail":"Transaction cancelled: maximum execution time exceeded Check logs for error trace or enable glide.rest.debug property to verify REST request processing"}

 

We can increase this execution time on instance, Navigate to System Definition > Transaction Quota Rules then search name with REST Table API request timeout. Change the maximum duration field's value.

 

3. Managing Custom Column (Business Unit) Attribute through Service Now Adapter

The adapter currently support for Business Unit Attribute. This attribute must be added in User table on Service now portal. If it is not added then can add on portal with below steps –

1.     Search for "tables" in service now navigation.

2.     Select tables inside System definition section.

3.     Search for User label then select User table with name of sys_user

4.     Click on New then give Type as  Reference.

5.     In reference specification tab Select business unit table.

6.     Give Column label and Column name.

Adding custom column to the mapping file

1.     Add the custom attribute name on ISIM and custom attribute name (Column name) defined on Service now portal separated by pipe (|) like this -

erservicenowbusinessunit|u_column_name

 where erservicenowbusinessunit is attribute which is defined on ISIM. u_business_unit is custom attribute name (Column name) defined on Service now portal. Pipe (|) is used as delimiter.

3.     Save the file as .txt text file

4.     A sample mapping file is provided in the adapter package

 

Using the custom attributes to the mapping file

 

1.     Specify the file path for the mapping file on the service form

For e.g.: C:\Program Files\ibm\SDI\V7.2\timsol\servicenow\ SampleCustomAttrMapping.txt

 

2.     Restart the Dispatcher service

 

Customizing or Extending Adapter Features

The Identity Manager adapters can be customized and/or extended. The type and method of this customization

may vary from adapter to adapter.

 

Refer to the ‘IBM Security Identity Adapter Development and Customization Guide’ 

 

Support for Customized Adapters

The integration to the IBM Security Identity Manager server - the adapter framework - is supported. However, IBM does not support the customizations, scripts, or other modifications. If you experience a problem with a customized adapter, IBM Support may require the problem to be demonstrated on the GA version of the adapter before a case is opened.

  

Supported Configurations

Installation Platform

The IBM Security Identity Manager Adapter was built and tested on the following product versions.

 

The IBM Security Identity Manager Adapter was built and tested on the following product versions.

This adapter installs into Security Directory Integrator (SDI) and may be installed on any platform supported by the SDI product and supported by the target system libraries or client, where applicable. IBM recommends installing SDI on each node of the ISIM/PIM WAS Cluster and then installing this adapter on each instance of SDI. Supported SDI versions include:

 

Adapter Installation Platform: 

Due to continuous Java security updates that may be applied to your ISIM servers, the following SDI releases are the officially supported versions:

  • IBM Tivoli Directory Integrator 7.1.1-TIV-TDI-FP0004 + 7.2.0-ISS-SDI-LA0008
  • IBM Security Directory Integrator 7.2 + FP0004

Earlier versions of SDI that are still supported may function properly, however to resolve any communication errors, you must upgrade your SDI releases to the officially supported versions by the adapters. Please refer to the adapters installation and configuration guides for the latest update on IBM Security Directory Integrator versions and fix packs

 

 

 

 

Managed Resource:

 

ServiceNow Portal (user accounts only)

ServiceNow On-Premise Solution

                                               

 

IBM Security Identity Manager:

 

Identity Manager v7.0.x

 

IBM Security Privileged Identity Manager:

 

ISPIM v2.x

 

IBM Security Identity Governance and Intelligence:

 

IGI v5.2.x

 

Notices

This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services,

or features discussed in this document in other countries. Consult your local IBM representative for information on the

products and services currently available in your area. Any reference to an IBM product, program, or service is not

intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent

product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it

is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing

of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

 

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY  10504-1785  U.S.A.

 

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your

country or send inquiries, in writing, to:

 

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
1623-14, Shimotsuruma, Yamato-shi
Kanagawa 242-8502 Japan

 

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact:

IBM Corporation
2ZA4/101
11400 Burnet Road
Austin, TX 78758  U.S.A.

 

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

Microsoft, Windows, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

 

 

End of Release Notes