Configuring client accessible secrets

Learn how to configure your instance to use client accessible secrets.

Use this example implementation to configure Secrets Management without using proxies, or giving ServiceNow access to your decrypted data.

For more detail on using client-side Secrets Management to manage access to passwords and groups, see About client-side Secrets Management.

These instructions assume you have a MID Server configured on your local network. For information on this process see MID Server.

Process overview

• 1. Create encryption keys and certificate

  Create encryption keys and a certificate using terminal commands on your local environment.

• 2. Add your certificate to the ServiceNow Trusted Key Store

  Upload your key and certificate to the ServiceNow Trusted Key Store.

• 3. Create a secret group with criteria

  Create a group for your secrets. Secret groups are used to organize your secrets into groups. Using these groups enables you to apply access policies to those secrets at a group level. Then associate your secrets group to an identity group and add your MID Server to that identity group.

• 4. Upload the public/private keypair to the MID Server

  Upload your public/private keypair to your MID Server. This keypair enables the MID Server to handle authentication requests from your instance.

• 5. Create credentials and test credential encryption

  Create a credential to authenticate into a third-party system and test that ServiceNow can't access the credential.

• 6. Configure Flow Designer to manage the integration

  On your instance, use Workflow Studio to manage an integration between your local network and your instance.

• 7. Test the end-to-end client-side encrypted secrets integration

  Test your integration, and review the execution details to confirm your configuration is working.

• Create encryption keys and certificate
  Create encryption keys and a certificate using terminal commands on your local environment.

• Add your certificate to the ServiceNow Trusted Key Store
  Upload your key and certificate to the ServiceNow Trusted Key Store.

• Create a secret group with criteria
  Secret groups organize secrets and apply access policies at the group level. Associate a secret group with an identity group to control MID Server access.

• Upload the public/private keypair to the MID Server
  Upload your public/private keypair to your MID Server. This keypair enables the MID Server to handle authentication requests from your instance.

• Create credentials and test credential encryption
  Create a credential to authenticate into a third-party system.

• Configure Flow Designer to manage the integration
  On your instance, use Workflow Studio to manage an integration between your local network and your instance.

• Test the end-to-end client-side encrypted secrets integration
  Test your integration, and review the execution details to confirm your configuration is working.

• Test a Windows Management Instrumentation credential encrypted with Secrets Management
  Verify that your Windows Management Instrumentation (WMI) credential is encrypted with Secrets Management and use an Integration Hub workflow to complete end-to-end testing.

• Cloning and Secrets Management
  Learn how to reconfigure secrets groups and client secrets groups after a clone.

Parent Topic:Secrets Management