LDAP integration keeps your ServiceNow user records in sync with Active Directory or LDAP servers without managing passwords in multiple places. You'll set up automated imports that pull user data on a schedule while your SSO provider handles authentication.
Why LDAP integration exists
Before LDAP integration, admins were either creating ServiceNow users manually or running one-off imports that immediately went stale. Users existed in Active Directory with current department info, manager relationships, and group memberships, but ServiceNow had outdated data that broke assignment rules and approval workflows. IT teams ended up maintaining user data in two places, and the ServiceNow data was always wrong. The people who feel this pain are platform admins who field tickets about incorrect assignments, and end users who can't get approvals routed properly.
How LDAP sync works
LDAP integration is a scheduled job that queries your directory server and creates or updates ServiceNow user records based on field mappings you define. You'll create an LDAP Server record that holds connection details, configure which OUs to sync from, map LDAP attributes to ServiceNow fields through a Transform Map, and set up a sync schedule. The first run imports all users (full sync), then subsequent runs only process changes (delta sync). This is purely about user data — passwords never sync because your SSO provider handles authentication.
Production improvements and ongoing maintenance
Once basic sync works, focus on performance and data quality. Move from full syncs to delta-only after your initial import. Add field mappings for department, cost center, and manager relationships that drive your business processes. Set up email notifications when syncs fail. Create before transform scripts to handle data cleanup — like standardizing phone number formats or mapping department codes to readable names. Monitor sync duration and consider splitting large OUs into separate jobs if runtime becomes an issue.
Before you start
- •admin role or ldap_admin role
- •Network connectivity to your LDAP server on port 389 or 636
- •LDAP service account with read access to target OUs
- •SSO configuration completed if users will authenticate via SAML/OIDC
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Create the LDAP Server record
Navigate to System LDAP > LDAP Servers and click New. Set Server to your domain controller's hostname or IP. Use port 636 for SSL or 389 for non-SSL. Enter your service account credentials in User name and Password — use domain\username format for AD. Set Connection timeout to 30000 (30 seconds). Test the connection using the Test LDAP Server Connection related link before saving.
Always use a dedicated service account for LDAP sync — never use your personal AD account.
Configure the LDAP OU
From your LDAP Server record, click New in the LDAP OU Configuration related list. Set RDN to the distinguished name of your target OU (like 'OU=Employees,DC=company,DC=com'). Choose Table as sys_user. Set Query field to 'samaccountname' for Active Directory. Enable Active and leave other fields default. The Filter field stays empty unless you need to exclude specific user types.
Start with a small test OU containing 10-20 users before pointing at your entire directory.
Create field mappings
Open the Transform Map created automatically when you saved your LDAP OU (it's named after your RDN). Click the Field Maps tab and add mappings for essential fields. Map 'samaccountname' to user_name, 'cn' to first_name + last_name, 'mail' to email. Add mappings for department, title, phone, and manager if those attributes exist in your LDAP. Set Coalesce to true on user_name so updates find existing records instead of creating duplicates.
Don't map every available LDAP attribute — focus on fields your ServiceNow processes actually use.
Configure the transform map settings
In your Transform Map, set Run business rules to false (LDAP syncs should bypass user creation business rules). Enable Create new records and Update existing records based on your needs. In the Advanced tab, set Source table to your LDAP OU's RDN. Leave Target table as sys_user. Save the transform map.
Test with manual sync
Return to your LDAP OU Configuration record and click Load LDAP Records in the related links. This runs a one-time sync so you can verify field mappings work correctly. Check the Import Set table (system_import_set_ldap) for any errors. Verify a few test users were created or updated in the sys_user table with correct data.
Set up scheduled sync
Navigate to System Definition > Scheduled Jobs and find the job named after your LDAP OU (created automatically). Open it and set Run as to your LDAP sync service account. Configure the schedule — daily at 2 AM is typical. Enable Active. The job will perform full syncs initially, then switch to delta syncs automatically after successful runs.
Best practices
Never sync passwords through LDAP — configure SSO separately and let ServiceNow authentication fall back to your identity provider.
Set up email notifications on the scheduled job so you know immediately when LDAP sync fails — broken sync means new users can't access ServiceNow.
Always map the manager field if it exists in your LDAP — approval workflows depend on accurate manager relationships and this data goes stale quickly when maintained manually.
Use transform scripts to clean data during import rather than trying to fix it afterward — standardize phone formats, map department codes, and handle null values before records hit sys_user.
Monitor sync job duration and split large OUs if runtime exceeds 30 minutes — long-running syncs can impact performance and are more likely to fail.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue