All Apps and Add-ons

Configuring OAuth2 with ServiceNow

r0b1n
Engager

Hi, 

Has anyone used the  "ServiceNow Security Operations Event Ingestion Addon for Splunk ES" or the "ServiceNow Security Operations Addon" app to configure OAuth2 ?

If yes, how do you set the user in the "created by" field in ServiceNow? It seems to be automatically set to the user who configured the OAuth2 connection.

With basic auth it is simple because you decide which user connects to ServiceNow, but with OAuth2 it is just a clientID and secret but there is no user field and it seems a user is being sent alongside the event by Splunk.

Labels (2)
0 Karma

sarcome
Explorer

Thanks for the reply.  The issue seems to come from our AD configuration. The popup redirects to an SSO login window, and if I use the "Not you?" button to specify a local user, it ignores it and jumps to the SSO login again. 

I have a support case with Splunk and this is what they've observed. So we need to check out this redirection issue internally.

Tenlyn
Engager

For OAuth 2.0. Authentication in Splunk_TA_snow, under ServiceNow account configuration you type in Client Id and Client Secret. Once you click on save/Update button, if the connection is successful, a pop-up window opens where you have to login with a proper user and password.

Mind that the browser doesn't take your personal credentials, but you login with a user that was predefined in ServiceNow.

Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...