Skip to main content
This article covers the ServiceNow (ITSM) connector, which provides read-only identity and entitlement visibility plus ITSM ticket logging for AppStore access requests. To create, update, and delete ServiceNow accounts and role assignments, use ServiceNow User Provisioning instead. The two connectors use different OAuth redirect URLs (see Phase 1).

​
After this article

You will be able to connect ServiceNow to Lumos to sync users, their roles, and last login, and to log ITSM request tickets in ServiceNow when access is requested in the AppStore.

​
Capabilities

​
Required plan and roles

  • ServiceNow plan: no minimum plan is required.
  • Connecting user: the integration inherits the permissions of the user who connects it. Connect while logged into ServiceNow as a dedicated service account with the roles below, not your personal admin account.
  • Required roles on the connecting user/service account:
  • Some roles don’t exist on every instance, for example sn_request_comments_write and sn_request_write. A role combination that has worked for ITSM is user_admin, rest_service, catalog_admin, and itil. A smaller subset without itil has also worked for some customers.
  • Read-only: the ITSM connector is read-only for identity and entitlement information. Provisioning (create, update, delete accounts and role assignments) isn’t available on this connector. Use ServiceNow User Provisioning.

​
Instructions

Phase 1: Create an OAuth client in ServiceNow
  1. In ServiceNow, open the Application Registry and create a new application, choosing Create an OAuth API endpoint for external clients.
  2. Set Name to Lumos and set the Redirect URL to https://app.lumosidentity.com/integrations/servicenow_oauth2_callback.
  3. Leave all other settings as-is and save.
  4. Copy the Client ID and Client Secret.
Phase 2: Connect in Lumos
  1. Click the ServiceNow card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Instance Subdomain: from your login URL (subdomain.service-now.com), enter the subdomain.service-now.com value.
  3. Enter the ServiceNow Client ID and Client Secret from Phase 1.
  4. Click Connect ServiceNow. When the ServiceNow login pop-up appears, make sure you’re logged in as the intended service account. The integration inherits that user’s permissions.
Phase 3: Configure ITSM logging
  1. In Lumos, go to your ITSM settings, choose ServiceNow in the dropdown, and click Connect.
  2. Choose the sync you want to configure.
  3. Specify the values: Project = Request, Request Type = Requested Items, Resolve With (e.g. Closed Complete).
  4. Click Save. Lumos will then create an sc_request (state New) with a linked sc_req_item when access is requested in the AppStore, comment on the request item as approvals are decided, and resolve it with your Resolve With status when the request completes.
The ITSM entity hierarchy is Request (sc_request) → Requested Item (sc_req_item) → Catalog Task. Ticket state values map as 1 = New, 6 = Resolved, 7 = Closed.

​
API Endpoints Used

​
Troubleshooting

“Failed to forward OAuth callback to ICS” when connecting. This generic message usually masks a 403 from ServiceNow: Missing required api access scope: tableapi on GET /api/now/table/sys_user, which Lumos calls immediately after OAuth to validate credentials. Grant the connecting service account rest_service (provides Table API access) and user_admin, then reconnect. 403 Forbidden / insufficient permissions during sync. Verify the connecting user holds every required role and has read access to sys_user, sys_user_group, sys_user_role, and sys_user_has_role. Testing with a full admin account can isolate whether the problem is role-based. Item field not set on request items. Grant the snc_platform_rest_api_access role write access on sc_req_item.cat_item. A specific role (e.g. security_admin) never appears as an entitlement. This is a ServiceNow platform limitation, not a sync bug. Elevated-privilege roles from the High Security plugin are hidden from any non-interactive session, so the connector’s OAuth-based role listing gets a clean response with the record omitted. A custom read ACL on sys_user_role doesn’t fix it. Workarounds are ServiceNow-side (a scripted REST endpoint running as an elevated user, or relaxed High Security settings). Incomplete or missing data. Check active/inactive filter conditions, confirm the integration user can see the records in the ServiceNow UI, and review ACLs for row-level security. Connection or credential errors. Confirm the instance subdomain format, that the instance is reachable from the internet (firewall rules for on-premise), that the OAuth application is active, and that the Client ID/Secret are correct. Regenerate credentials if issues persist. Reconnecting with valid credentials clears an integration error state.