An LDAP integration allows your instance to use your existing LDAP server as the master source of user data.

This article is a supplement to the ServiceNow documentation. For full documentation please see the ServiceNow Documentation

Please note that it is important to try this integration in a development instance first and test the integration before going live in production.

Step 1: Define LDAP SERVER

You’ll need to expose the LDAP Server to ServiceNow. Here are few different ways to do this:

Option 1 - LDAP Server with Mid Server

This is the most common method as it is the easiest to configure and doesn’t require much effort from a company AD admin.

You’ll need to setup a midserver to use this method. Please note that you can’t authenticate (login) using this method and you can’t use a SSL connection.

For authentication, an SSO connection is often configured. So you use the LDAP Integration to pull in users/groups and SSO to authenticate (login).

Option 2 - LDAP Server with VPN

For this method, you need to ask ServiceNow for a VPN Request though HI Support. This method isn’t that preferred is that you are relying on the ServiceNow VPN to work and other maintenance concerns.

Details from HI Support:

ServiceNow provides secure communications with customer networks over the public Internet using IPSEC VPN technology. A clustered pair of Cisco ASA devices are used as the termination point for encrypted IPSec tunnels. Please note, a site-to-site VPN connection between ServiceNow and your network is only used for traffic that is initiated by ServiceNow. Traffic destined for ServiceNow will always be HTTPS, and will always use the internet as a transport. As your ServiceNow instance is deployed into two ServiceNow datacenters for our Advanced High Availability, we will be building two VPN tunnels to your network.

Option 3 - External IP Address

For this method, you expose an external IP Address to ServiceNow.

Be sure a network administrator configures the local firewall to allow the application server to access the LDAP server. If the LDAP server is located within an internal network, the firewall forwards (or NATs) the application server's IP address through the firewall on the correct port.

Option 4 - LDAPS with PKI certificate

Most companies don’t have LDAPS (note the “S”). However for the companies that do, this is the superior method to connect in my opinion.

Step 2: CREATE LDAP Server

Create LDAP Server Record

Left Navigator Bar > Create New Server
Fill in form fields. Field descriptions from the ServiceNow Documentation

Make sure to specify which LDAP Attributes to import. Without specifying the LDAP attributes, the import set creates many fields, which can exceed the row size limit during the import process.

Common Attributes

description,employeeNumber,managedby,department,division,description,dn,employeeID,givenname,mail,manager,member,memberof,mobile,objectguid,physicaldeliveryofficename,samaccountname,sn,source,telephonenumber,thumbnailPhoto,title,useraccountcontrol,userPrincipalName

3. Click Submit
4. When set to Active, the connection is tested. Red is bad. Green is good!

Additional Notes

STEP 3: LDAP BroWSE

In the following step, you need to specify the RDN and Filters for the User and Group accounts. The RDN and Filters, tell ServiceNow where to look for the data.

How do you know where the data is stored in LDAP? Every LDAP directory structure is different, so you need to Browse.

In the LDAP Server you setup in the last step, use the Related link Browse to browse the LDAP Server and find the data you want to pull.

Step 4: LDAP OU DefinitionS

After you determine the data you want to pull you update the LDAP OU Definitions (Located in the LDAP Server record at the bottom of the form).

Click the Browse button on the LDAP OU Definition after you set it up to verify it is going to the right location.

Sometimes you need to setup new extra LDAP OU Definitions if the data is in different directories and not just parent/child directories.

Step 4: Data Source

Under each LDAP OU Definition, there is a data source. In the data source you can run the import and see where what import set the data is being loaded into.

Click “Load All Records” to load the data into import sets.

Step 5: Import Sets

Import sets are temporary “staging tables” in ServiceNow that data sits before it is “transformed” into actual ServiceNow data.

Out-of-the-box, the user import set is ldap_import, and the group import is ldap_group_import.

LOOK for Truncated import set data

Go review the import set data and make sure the columns created for the data are big enough. You may need to increase the size of a column in the import set if the data is being truncated.

Step 6: Transform Maps

Configure Transform Map

When you get to the Transform Maps, make sure you are testing this work in development first!

The transform maps convert the data from the import set into actual user an group records.

The LDAP User Import transform map is the one you typically modify. Some common configurations of the user transform map.

Coalesce Match. Important to choose a coalesce in the field map so that you don’t get duplicate user records. Companies often use samaccountname or objectguid for the coalesce field.
Additional fields. If you have additional fields to map, here’s the place.
Import User Photo from LDAP. Here is an article on how to Import User Photo from LDAP.

Run Transform

When you are ready to transform, click the Transform Related Link in the Transform Map.

View the Log after data load to see if any errors occur.

Step 6: Scheduled LOADS

After your data is imported correctly. Schedule that data loads. This is done under System LDAP > Scheduled Loads. You activate the data import and set a run schedule. Most companies run it daily in the evening.