ISC SNOW Service Catalog Error : “Failed Creating Access Request.Forbidden” for Non ORG_ADMIN Users (Authorization Code Flow)

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi Team,

We are facing an issue with ISC SNOW Service Catalog Intgration when a standard user (without ORG_ADMIN role) tries to request access for themselves.

Issue

When a non-admin user submits an access request via Service Catalog, the request fails with the following error:

“Failed Creating Access Request. Forbidden.”

Current Setup

Integration Type: ServiceNow Service Catalog Integration using the plugin.

Connection Type: Authorization Code Flow (PAT and API Client with sp:scopes:all) used.

Request Type: User requesting access for themselves.

Understanding

Based on the SailPoint documentation:

ORG_ADMIN role is typically required when using client_credentials flow.

In our case, we ar using authorization_code flow, which should act in the context of the logged-in user.

Therefore, a user should be able to request access for themselves without requiring admin privileges.

Problem

Despite using authorization_code flow, the request is still failing with a 403 Forbidden error, as if elevated privileges are required.

Ask

Has anyone encounter a similar issue?

Are there any known limitations or configuration gaps that could cause this behavior?

Thanks in advance for your help !

2

Hi @thiruppathit

This sounds like you are missing a step in the configuration as I’ve set this up before and not encountered this issue.

Did you use the following for your setup? Can you confirm for step #7, that you are using an ORG_ADMIN PAT with a client id / secret that have sp:scopes:all?

3

Hi @trettkowski

Yes, the PAT token with sp:scopes:all has been generated using an account with ORG_ADMIN permission.

Thanks,

Thiruppathi T

4

Got it, is the 403 forbidden error inside SNOW? If you could show a screenshot of the error, that may help. Also just to confirm, you aren’t using segments of any kind, correct?

5

Yes, the error is from SNOW workflow.

Attached screenshot for reference,

image
image2103×1066 173 KB

Not using any segments in ISC.

image
image2103×966 58 KB

6

Thank you for confirming!

Based on the thread below, I would try swapping your API Client credentials for a PAT instead to see if that makes it works. In theory, it should be working, but this may be an easy fix.

7

I saw this post , ORG_ADMIN is mandatory with client_credentials flow as per the documentation.

Just to confirm, are you suggesting that we switch to the client_credentials flow temporarily and then switch back to the authorization_code flow afterward?

8

Correct, from what you’ve described the Auth Code should be working for you, but I wonder if you switch to the client_credentials flow if that will still present the same error.

9

Hi @trettkowski

It’s strange that the client_credentials flow works perfectly, while the authorization_code flow fails with a “Forbidden” error when a non ORG_ADMIN user submits an access request from ServiceNow. This makes me wonder whether it’s a bug or if there’s something misconfigured in my setup.

10

Hi @trettkowski

After long investigation, identified “Limiting External Access Request” feature enabled on the tenant was causing the issue.

Instead using “approvalMustBeExternal : true”, it is better to use workflows to block any requests that raised from SailPoint Console.

I have developed a workflow now to allow access request only from ServiceNow and block it otherwise.

Thank you so much for your response and advise, much appreciated.