ServiceNow Okta Integration Guide

Architecture Overview

Implementation Steps

// Business Rule to log role assignments during SCIM provisioning
(function executeRule(current, previous) {
    if (current.isNewRecord() || current.roles.changes()) {
        gs.info('SCIM Role Assignment: User ' + current.user_name + ' assigned roles: ' + current.roles);
        // Optional: Call Okta API to update user profile
        var rm = new sn_ws.RESTMessageV2('Okta User API', 'Update User');
        rm.setStringParameterNoEscape('user_id', current.sys_id);
        rm.setRequestBody(JSON.stringify({profile: {serviceNowRoles: current.roles.toString()}}));
        var response = rm.execute();
    }
})(current, previous);

// Flow Designer script step to sync ServiceNow role changes to Okta
(function execute(inputs, outputs) {
    try {
        var userId = inputs.user_sys_id;
        var roles = inputs.user_roles.split(',');
        
        // Call Okta Workflows spoke to update user profile
        var oktaResponse = sn_fd.FlowAPI.getRunner()
            .name('Okta Update User Profile')
            .inBackground()
            .withInputs({
                'okta_user_id': inputs.okta_user_id,
                'servicenow_roles': roles.join(';')
            })
            .run();
            
        outputs.success = true;
        outputs.response = oktaResponse;
    } catch (error) {
        outputs.success = false;
        outputs.error_message = error.message;
        gs.error('Okta sync failed: ' + error.message);
    }
})(inputs, outputs);

// Script to validate SCIM provisioned user attributes
var testUser = new GlideRecord('sys_user');
testUser.addQuery('email', 'test.user@yourcompany.com');
testUser.addQuery('source', 'scim');
testUser.query();
if (testUser.next()) {
    gs.info('SCIM User Found: ' + testUser.user_name);
    gs.info('Roles: ' + testUser.roles);
    gs.info('Active: ' + testUser.active);
    gs.info('Last Login: ' + testUser.last_login_time);
    // Validate Okta group mappings
    var grMember = new GlideRecord('sys_user_has_role');
    grMember.addQuery('user', testUser.sys_id);
    grMember.query();
    while (grMember.next()) {
        gs.info('Assigned Role: ' + grMember.role.name);
    }
} else {
    gs.error('SCIM provisioned test user not found');
}

// Scheduled job to monitor SCIM provisioning health
var scimStats = new GlideAggregate('sys_log');
scimStats.addQuery('level', 'error');
scimStats.addQuery('source', 'LIKE', '%scim%');
scimStats.addQuery('sys_created_on', '>', gs.hoursAgoStart(24));
scimStats.addAggregate('COUNT');
scimStats.query();
if (scimStats.next() && scimStats.getAggregate('COUNT') > 10) {
    // Create incident for SCIM integration issues
    var incident = new GlideRecord('incident');
    incident.initialize();
    incident.short_description = 'High SCIM provisioning errors detected';
    incident.description = 'More than 10 SCIM errors in the last 24 hours. Review Okta integration health.';
    incident.priority = 2;
    incident.assignment_group = 'Identity Management';
    incident.insert();
    gs.eventQueue('scim.health.alert', incident, gs.getUserID(), gs.getUserName());
}

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom SCIM Transform Maps to enrich user provisioning with additional ServiceNow-specific attributes like location, department, and cost center based on Okta user profile extensions. This eliminates manual data entry and ensures consistent user record completeness across systems while supporting advanced reporting and organizational analytics.
• →Configure ServiceNow Business Rules on the sys_user table to trigger outbound Integration Hub flows when user roles change, automatically updating Okta user profiles with ServiceNow role information for bidirectional synchronization. This creates a comprehensive identity governance model where both systems maintain current user access state information.
• →Set up proactive monitoring using ServiceNow Event Management to track SCIM API response times and SAML assertion processing latency, creating early warning alerts before user experience is impacted. Configure dashboard widgets displaying integration health metrics and provision success rates for ongoing operational visibility.
• →Leverage Okta's SCIM filtering capabilities to provision only specific user populations to ServiceNow based on user attributes or group memberships, reducing license consumption and improving security posture. Create separate Okta applications with different SCIM configurations for employee versus contractor populations with distinct role mapping strategies.
• →Implement ServiceNow scheduled jobs to periodically reconcile user status between Okta and ServiceNow, identifying and correcting any synchronization drift that might occur during system maintenance windows or network disruptions. Include automated remediation logic that can re-sync individual user records without full reprovisioning cycles.
• →Configure custom certificate rotation workflows using ServiceNow's Certificate Management features to proactively update SAML signing certificates before expiration, preventing authentication outages. Create calendar reminders and approval workflows for certificate updates that can be tested in sub-production environments first.

Known Limitations

• —SCIM provisioning is subject to Okta's rate limiting of 600 requests per minute, which can impact bulk user operations during large organizational changes or initial deployment phases. ServiceNow cannot override these limits, so large user populations may require staggered provisioning approaches or manual batch processing during peak sync periods.
• —ServiceNow's out-of-box SCIM implementation supports only basic user attributes and group memberships, requiring custom development for complex organizational hierarchies or custom user fields. Advanced use cases like manager relationships, multi-value attributes, or complex approval workflows need additional scripting and Transform Map customization beyond standard configuration.
• —The Integration Hub Okta spoke requires Professional licensing and has limited pre-built actions compared to full REST API capabilities, potentially necessitating custom RESTMessageV2 implementations for advanced Okta features. Spoke actions also inherit Flow Designer's execution limitations around long-running processes and complex error handling scenarios.
• —SAML session management between Okta and ServiceNow can create inconsistent logout experiences, where users logged out of one system may remain authenticated in the other until session timeout occurs. This behavior varies based on browser settings and can impact security policies requiring immediate access revocation.
• —Certificate management for SAML integration requires manual intervention for renewals and updates, with no automated certificate rotation capabilities in the standard ServiceNow SAML framework. Organizations must implement custom monitoring and renewal processes to prevent authentication outages from expired certificates.

Frequently Asked Questions