Receiving a 401 Unauthorized error response from ServiceNow

[YJ]

Hi,

Have anyone faced this issue where you received a Unauthorized 401 error response from ServiceNow?

The scenario is as below.

We are using a AD service account userA to interact with ServiceNow for incident creation .

On Splunk Side, we are using Basic Auth.

On AD, user account is set to never expired.  

So far below we have checked the service account status. No changes was made but the issue was sudden.

Ran the query 

>index=_internal sourcetype="ta_snow_ticket host IN ( search head)

Above query was the one, we saw the Return code is 401 (Unauthorized)

What else can be checked? As of now, we are planning to reset the service account password and try again.

But if it works the issue is finding what cause the password to be changed when it have been set to never expires.

[PaulPanther]

Have you verified that the used user has permissions to access ServiceNow via API? You could verify that with postman or a plain curl call.

[YJ]

Hi Paul,

That was what I was suspecting, the service account permission to access the Servicenow. The only problem i have is getting the other team(Servicenow) to provide info for my troubleshooting as they are denying that it is their end with issue. I was thinking since the service account is an AD account, there will surely be a security group assign to the service account . I have actually point out that the service account did not have any grouping assigned to it thus there could be a possibility that the servicenow account does not have the permission to access the Servicenow. 

There were actually similar issues where we found that some AD users security group were missing after an issue happened. I will try to go through this path and check on the permission again.. Thanks for the advice.