Service Account Management Pattern for…

intermediateTested on Xanadu

The Service Account Management Pattern provides a standardized approach for creating and maintaining dedicated user accounts specifically for system integrations and automated processes in ServiceNow. Unlike personal user accounts, service accounts are designed for non-interactive system-to-system authentication with restricted permissions, automated password rotation, and comprehensive audit logging.

This pattern addresses the security risks of using personal accounts or overprivileged accounts for integrations by implementing minimum privilege principles, consistent naming conventions, and governance controls. It ensures that each integration has its own isolated credentials that can be independently managed, monitored, and rotated without affecting other systems or users.

The pattern works by establishing a framework for service account lifecycle management including creation workflows, role assignment validation, password policies, usage monitoring, and automated cleanup processes. It integrates with ServiceNow's built-in security features while adding custom controls for enterprise-grade service account governance.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Use This When

Use this pattern when building REST API integrations, scheduled imports, web services connections, or any automated system that needs to authenticate to ServiceNow. It's essential for enterprise environments where security compliance requires segregated service accounts with audit trails and regular credential rotation.

Avoid When

Avoid this pattern for simple development environments where security overhead isn't justified, or when using OAuth/JWT token-based authentication that doesn't require dedicated user accounts. Don't implement this if your organization lacks the operational maturity to maintain regular password rotation and monitoring processes.

Implementation

Server-side

// Service Account Management Script Include
var ServiceAccountManager = Class.create();
ServiceAccountManager.prototype = {
    initialize: function() {
        this.SERVICE_ACCOUNT_PREFIX = 'svc_';
        this.DEFAULT_PASSWORD_LENGTH = 32;
        this.AUDIT_TABLE = 'u_service_account_audit';
    },

    createServiceAccount: function(accountName, description, roles, requestedBy) {
        // Validate naming convention
        if (!accountName.startsWith(this.SERVICE_ACCOUNT_PREFIX)) {
            accountName = this.SERVICE_ACCOUNT_PREFIX + accountName;
        }

        // Check if account already exists
        var existingUser = new GlideRecord('sys_user');
        existingUser.addQuery('user_name', accountName);
        existingUser.query();
        if (existingUser.next()) {
            gs.error('Service account ' + accountName + ' already exists');
            return false;
        }

        // Create the service account
        var serviceUser = new GlideRecord('sys_user');
        serviceUser.initialize();
        serviceUser.user_name = accountName;
        serviceUser.first_name = 'Service';
        serviceUser.last_name = 'Account - ' + description;
        serviceUser.email = accountName + '@system.local';
        serviceUser.active = true;
        serviceUser.locked_out = false;
        serviceUser.web_service_access_only = true; // Prevent interactive login
        serviceUser.password_needs_reset = false;
        
        // Generate secure password
        var password = this._generateSecurePassword();
        serviceUser.user_password.setDisplayValue(password);
        
        var userSysId = serviceUser.insert();
        if (!userSysId) {
            gs.error('Failed to create service account: ' + accountName);
            return false;
        }

        // Assign minimum required roles
        this._assignRoles(userSysId, roles);

        // Set password expiration (90 days from now)
        this._setPasswordExpiration(userSysId, 90);

        // Create audit record
        this._auditServiceAccount(userSysId, 'CREATED', requestedBy, 'Service account created with roles: ' + roles.join(', '));

        gs.info('Service account created: ' + accountName + ' (ID: ' + userSysId + ')');
        return {
            success: true,
            userSysId: userSysId,
            username: accountName,
            temporaryPassword: password // Should be securely transmitted
        };
    },

    rotatePassword: function(userSysId) {
        var serviceUser = new GlideRecord('sys_user');
        if (!serviceUser.get(userSysId)) {
            gs.error('Service account not found: ' + userSysId);
            return false;
        }

        // Generate new password
        var newPassword = this._generateSecurePassword();
        serviceUser.user_password.setDisplayValue(newPassword);
        
        // Extend password expiration
        this._setPasswordExpiration(userSysId, 90);
        
        serviceUser.update();

        // Audit the rotation
        this._auditServiceAccount(userSysId, 'PASSWORD_ROTATED', 'system', 'Automated password rotation');

        gs.info('Password rotated for service account: ' + serviceUser.user_name);
        return newPassword;
    },

    validateServiceAccountUsage: function() {
        // Find service accounts that haven't been used recently
        var unusedAccounts = [];
        var serviceAccounts = new GlideRecord('sys_user');
        serviceAccounts.addQuery('user_name', 'STARTSWITH', this.SERVICE_ACCOUNT_PREFIX);
        serviceAccounts.addQuery('active', true);
        serviceAccounts.query();

        while (serviceAccounts.next()) {
            var lastLogin = new GlideRecord('sys_audit');
            lastLogin.addQuery('tablename', 'sys_user');
            lastLogin.addQuery('documentkey', serviceAccounts.sys_id);
            lastLogin.addQuery('fieldname', 'last_login_time');
            lastLogin.orderByDesc('sys_created_on');
            lastLogin.setLimit(1);
            lastLogin.query();

            var daysSinceLastUse = 999;
            if (lastLogin.next()) {
                var lastUse = new GlideDateTime(lastLogin.newvalue);
                var now = new GlideDateTime();
                daysSinceLastUse = gs.dateDiff(lastUse.getDisplayValue(), now.getDisplayValue(), true) / (24 * 60 * 60 * 1000);
            }

            if (daysSinceLastUse > 60) { // 60 days threshold
                unusedAccounts.push({
                    username: serviceAccounts.user_name.toString(),
                    sysId: serviceAccounts.sys_id.toString(),
                    daysSinceLastUse: Math.floor(daysSinceLastUse)
                });
            }
        }

        return unusedAccounts;
    },

    _assignRoles: function(userSysId, roles) {
        for (var i = 0; i < roles.length; i++) {
            var roleGr = new GlideRecord('sys_user_role');
            roleGr.addQuery('name', roles[i]);
            roleGr.query();
            if (roleGr.next()) {
                var userRole = new GlideRecord('sys_user_has_role');
                userRole.initialize();
                userRole.user = userSysId;
                userRole.role = roleGr.sys_id;
                userRole.insert();
            }
        }
    },

    _generateSecurePassword: function() {
        var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*';
        var password = '';
        for (var i = 0; i < this.DEFAULT_PASSWORD_LENGTH; i++) {
            password += chars.charAt(Math.floor(Math.random() * chars.length));
        }
        return password;
    },

    _setPasswordExpiration: function(userSysId, days) {
        var expirationDate = new GlideDateTime();
        expirationDate.addDaysLocalTime(days);
        
        var userGr = new GlideRecord('sys_user');
        if (userGr.get(userSysId)) {
            userGr.password_expires_on = expirationDate;
            userGr.update();
        }
    },

    _auditServiceAccount: function(userSysId, action, performedBy, details) {
        var audit = new GlideRecord(this.AUDIT_TABLE);
        audit.initialize();
        audit.service_account = userSysId;
        audit.action = action;
        audit.performed_by = performedBy;
        audit.details = details;
        audit.timestamp = new GlideDateTime();
        audit.insert();
    },

    type: 'ServiceAccountManager'
};

This code demonstrates a comprehensive service account management system with automated password generation, role assignment, and audit logging. Key features include enforced naming conventions with the 'svc_' prefix, web service access only to prevent interactive logins, and automated password expiration. The validation method identifies unused accounts for cleanup, while audit trails track all service account activities for compliance reporting.

Alternatives

OAuth Application Registry

Better for modern API integrations as it eliminates password management overhead and provides token-based authentication, but requires more complex setup and may not work with legacy systems that need basic authentication.

Certificate-Based Authentication

Provides stronger security through PKI infrastructure and eliminates password rotation needs, but adds complexity in certificate lifecycle management and requires specialized knowledge to implement properly.

Shared Technical User Account

Simpler to implement and manage for small environments with fewer integrations, but creates security risks through shared credentials and makes it difficult to trace actions to specific systems or audit integration usage.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue