Configuring OAuth2 with ServiceNow

[r0b1n]

Hi, 

Has anyone used the  "ServiceNow Security Operations Event Ingestion Addon for Splunk ES" or the "ServiceNow Security Operations Addon" app to configure OAuth2 ?

If yes, how do you set the user in the "created by" field in ServiceNow? It seems to be automatically set to the user who configured the OAuth2 connection.

With basic auth it is simple because you decide which user connects to ServiceNow, but with OAuth2 it is just a clientID and secret but there is no user field and it seems a user is being sent alongside the event by Splunk.

[sarcome]

Thanks for the reply.  The issue seems to come from our AD configuration. The popup redirects to an SSO login window, and if I use the "Not you?" button to specify a local user, it ignores it and jumps to the SSO login again. 

I have a support case with Splunk and this is what they've observed. So we need to check out this redirection issue internally.

[Tenlyn]

For OAuth 2.0. Authentication in Splunk_TA_snow, under ServiceNow account configuration you type in Client Id and Client Secret. Once you click on save/Update button, if the connection is successful, a pop-up window opens where you have to login with a proper user and password.

Mind that the browser doesn't take your personal credentials, but you login with a user that was predefined in ServiceNow.