I have a question: Is there a way to create a mechanism in ServiceNow that allows users to select specific access from a predefined table and triggers the creation of a certification campaign in IdentityNow upon submission. I am curious if anyone has been successful in executing this use case:
Example Flow
User Interaction: A user logs into ServiceNow and navigates to the Self-Service Request form.
Access Selection: They select their desired access (e.g., “Sales Application Access”) from the dropdown populated by the predefined access table.
Submission: Upon submitting the request, the workflow kicks in, validating the request against access policies.
Approval Process: The request goes through the necessary approval stages.
Triggering IdentityNow: After approval, the ServiceNow workflow makes an API call to IdentityNow, triggering the creation of a certification campaign that includes the requested access.
Campaign Generation: IdentityNow generates the certification campaign, which can then be reviewed and certified
Yes, this is possible using ServiceNow workflows and SailPoint APIs. Create a ServiceNow form where users select access from a predefined table. After submission and approval, use IntegrationHub or a scripted REST API call to trigger a SailPoint certification campaign. The API payload should include campaign type, access details, and reviewers. Ensure secure authentication between ServiceNow and SailPoint using an integration token.
it’s a great use case that aligns with the ongoing integration trends between ServiceNow and SailPoint IdentityNow.
To answer your query: yes, it is technically possible to build a mechanism in ServiceNow to trigger a certification campaign in IdentityNow, but it requires custom development and careful coordination between both platforms.
How This Can Be Achieved
Here’s how your described flow can be implemented:
Predefined Access Table in ServiceNow
Populate a table with entitlements, access profiles, or application-specific access types.
Allow users to select from this list via a ServiceNow catalog item or form.
ServiceNow Workflow Configuration
After the user submits the request and it’s approved through standard ServiceNow approval flows, add a workflow step that performs an HTTP Request (REST API call) to IdentityNow.
API Call to IdentityNow – Campaign Creation
Use the SailPoint IdentityNow /campaigns API to create a campaign.
The API supports creating manager, application, or entitlement-based campaigns.
You must ensure the access selected in ServiceNow maps accurately to the entitlement/application in IdentityNow.Example Endpoint (simplified):
Payload Construction
You will need to dynamically construct the JSON body in ServiceNow based on user selections.
Ensure it includes required parameters like name, type, reviewers, applications, or entitlements.
Error Handling & Logging
Implement error handling in ServiceNow to catch API failures or invalid mappings.
Optionally log the campaign creation status back to the ServiceNow request.
I am currently working on implementing entitlement, access profile, and role provisioning based on requests submitted through ServiceNow. Once the request is approved in ServiceNow, access will be granted via a REST API call. Below is an example of the workflow configured in ServiceNow to achieve this integration.
Also, the use case requires the person submitting the Self Service Request to upload a CSV with the access items in it - into the request. It would be for a disconnected application. Can the Workflows from both platforms handle this data ingestion?
I personally wouldn’t recommend allowing users to upload a csv because frankly, most users are bad at forms in general, and you want them to give them as little control over variables as possible.
If you want to pull in access items from a specific source for a user to select, you can do that using a catalog client script that populates a select box. This limits the user to requesting a single access item at a time.
If you wish to allow multiple item selection, that requires a list collector, which requires that the data be in a ServiceNow table. I’ve certainly had use cases that call for this, but custom tables in ServiceNow can be a non-starter for some orgs.
This makes sense my friend. Strick adherence to completing the form correctly would need to be done to ensure the campaign is created properly. The catalog client script would be part of the SNOW Workflow correct? Sounds like it will take some careful planning and communication to make this as effortless as possible.
