The Complete ServiceNow

System Administrator Course

Section 6 - User Administration
Course Outline
1 Course Introduction 6 User Administration

2 ServiceNow Overview 7 Core Applications

3 Lists, Forms, & the UI 8 System Administration

4 Customizations 9 Building A Custom App

5 Tables & Fields 10

Section Outline
1 Users 6 Access Control Execution

2 Groups 7 LDAP

3 Roles 8 SSO

4 Access Controls 9 Impersonation

5 Access Operations 10
 • A ServiceNow account
• A record in the sys_user table
• Users may be apart of 0 or more groups
• Users may have 0 or more roles
• Users may also be assigned delegates

Users
 • A record in the sys_user_group table
• Buckets which hold users who share a
common purpose/role
• Roles are assigned to groups
• Groups contain 0 or more roles
• May inherit other groups
Groups
Users & Groups
Demo
 • Grants permissions to parts of the system
• A record in the sys_user_role table
• Assign roles to a group
• Contain access control rules
• Many out-of-box roles

Administrator group

Roles
Admin role

User
Popular Out-of-Box Roles
• admin
• security_admin
• itil
• itil_admin
• impersonator
• knowledge_admin
• report_admin
• catalog_admin
• asset
• ecmdb_admin
 • A record in the sys_security_acl table
• Used to grant access
• Specifies
• Object and operations
• Permissions required

• * wildcard
Access Controls • Thousands of out-of-box access controls
Tying It All Together
• Access controls are assigned to roles
• Roles are assigned to groups
• Users are assigned to groups

Network Group
Write access

ITIL role

Network role Anand Steve Lee

Delete
access
Access Operations
Operation Action

execute Run app or script

create Insert records

read Display records

write Update records

delete Remove records

list_edit Update records from list view

report_on Create reports

 Access Controls Flowchart
Deny access to
No object
Does user have
one of the required
roles?
Yes

Yes
Fail
User makes Does ACL for
request for record matched object exist?
Evaluate conditions
No
Pass

Grant access to
object
 Access Control Execution
Deny access to
Fail object
Evaluate rule
Does field rule match: permissions

1) table.field Pass
Rule
2) parent table.field
found
3) *.field Rule
User makes Grant access to
request for record found object
4) table.*

5) parent table.* No Does table rule match:

rule
6) *.* 1) table No
rule
2) parent table

3) *
Roles & ACLs
Demo
LDAP
• Lightweight Directory Access Protocol
• Industry standard for directory services
• Active Directory
• Defines structure for users & groups
• 2 parts
• Authentication
• Data population

Is user account u0392 active?

ServiceNow Company LDAP

Yes
Single Sign-On (SSO)
• Used for authentication
• 3rd party (provider)
• Single account for all system access
• SSO provider communicates with ServiceNow
• Example: Okta, Facebook

Browser

ServiceNow SSO Provider

Impersonation
• Used for testing access controls
• Only users with the admin or impersonator role can
impersonate users
• It’s as if that user is currently logged in
LDAP, SSO, &
Impersonation
Demo
Demo