{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":19796,"path":"impact/configure-oauth-auth-method-prod.md","title":"Configure the OAuth authentication method production instance","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure the OAuth authentication method production instance\n\nExport OAuth records from the development instance, import them into the production instance, correct Key Management Framework \\(KMF\\) credential encryption, and configure development-to-production authentication so that both instances can validate their connections to each other.\n\n## About this task\n\nAfter the development instance is validated, see [Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/configure-oauth-auth-method.md), the production instance must be able to communicate with development, and development must be able to communicate with production. This requires two rounds of record export and import; one in each direction with KMF credential correction performed after each import.\n\n**Important:** When OAuth records are imported into a new instance, KMF re-encrypts password fields using the receiving instance's cryptographic key. The stored values will appear jumbled and must be manually overwritten with the correct password before the connection can be validated.\n\n## Before you begin\n\n-   Complete [Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/configure-oauth-auth-method.md) on the development instance and confirm that the development connection validates successfully.\n-   The integration user account must already exist on the production instance with the `sn_se.scan_engine_admin` and `sn_se.internal_rest_integration` roles assigned. See [Create an integration user account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/task-create-integration-user.md).\n-   Have the integration account password available in a text editor. You will paste it multiple times during this procedure.\n-   Role required: Scan Engine Admin \\(`sn_se.scan_engine_admin`\\).\n\n## Procedure\n\n1.  Stage 1 — Export OAuth records from the development instance\n2.  On the development instance, navigate to **All** > **Scan Engine** > **My SN Instances** and open the development instance record.\n\n3.  Select and hold \\(or right-click\\) the form header of the MySN instance record and select **Export** > **XML**.\n\n4.  Save the file to a local folder \\(for example, `SE_Data`\\).\n\n5.  From the MySN instance record, drill into the **OAuth User Profile** field, open the linked record, and export it as XML.\n\n6.  Navigate to **All** > **System OAuth** > **Application Registry** and filter the list to show only records scoped to **Scan Engine**.\n\n    \\[Omitted image \"scan-engine-app-registry-filterout.png\"\\] Alt text: Application registry filtering Scan Engine scope.\n\n    Two records should be present: `OAuth Client Dev` and `OAuth Provider Dev`.\n\n7.  Select both records and export them together as XML.\n\n8.  Open the **OAuth Provider Dev** record and locate the auto-generated OAuth entity profile record linked at the bottom of the form.\n\n    \\[Omitted image \"scan-engine-oauthprovider-dev-profile.png\"\\] Alt text: OAuth Entity profile for OAuth Provider-Dev.\n\n9.  Open the OAuth entity profile record and export it as XML.\n\n    You should now have four XML files in your export folder:\n\n    -   MySN instance record\n    -   OAuth user profile\n    -   Two application registry records \\(OAuth Client Dev and OAuth Provider Dev\\)\n    -   OAuth entity profile record\n10. Stage 2 — Prepare Key Management Framework access on the production instance\n11. Log in to the production instance.\n\n12. In the Navigator, type `key` and open **Key Management Administration**.\n\n13. Add your user account to the selected users list and save.\n\n    The role `sn_kmf.admin` is automatically assigned to your account.\n\n14. Log out and log back in, then navigate to your user record.\n\n15. In the **Roles** related list, select **Edit** and also assign `sn_kmf.cryptographic_manager`.\n\n16. Log out and log back in to activate both KMF roles.\n\n17. Stage 3 — Import development records into the production instance\n18. On the production instance, navigate to **All** > **Scan Engine** > **My SN Instances**.\n\n19. Import the four XML files in the following order, using **Import XML** for each file:\n\n    1.  OAuth entity profile record\n    2.  Second OAuth entity profile record \\(if present\\)\n    3.  MySN instance record\n    4.  OAuth user profile \\(OAuth2 configuration\\) record\n20. Stage 4 — Correct KMF-encrypted credentials on the production instance\n21. Navigate to `sys_auth_profile_oauth2.list` and open the **Integration Account** OAuth user profile record.\n\n22. Switch the application scope to **Scan Engine**.\n\n23. If the **Username** and **Password** fields are not visible, configure the form to display them, or open the record using the list layout.\n\n    When prompted whether to edit in Scan Engine or Global scope, select **Global** for the form configuration only.\n\n24. Overwrite the **Password** field with the integration account password from your text editor and select **Save**.\n\n    Importing the record causes KMF to re-encrypt the password field with the production instance key. Overwriting it restores the correct value.\n\n25. Navigate to **All** > **System OAuth** > **Application Registry** and open **OAuth Client Dev**.\n\n26. Unlock the **Client Secret** field, overwrite it with the integration account password, and select **Save**.\n\n27. Return to the Application Registry list and open **OAuth Provider Dev**.\n\n28. Unlock the **Client Secret** field, overwrite it with the integration account password, and select **Save**.\n\n29. Stage 5 — Grant KMF module access and validate the development connection\n30. In the Navigator, type `key`.\n\n31. Navigate to **All** > **Key Management Framework** > **Module Access Policies** > **All**.\n\n32. Filter the **Script table** column to show **Script Includes** only and locate the record named **ScanEngine API Util**.\n\n33. Open the record, change the access decision to **Track**, and select **Save**.\n\n34. Navigate to **All** > **Scan Engine** > **My SN Instances**, remove any active filters, and open the development instance record.\n\n35. Select **Validate Connection**.\n\n    Connection Status updates to `Connection valid`. The production instance can now communicate with the development instance. See [Validate your instance connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/validate-instance-connection.md) for additional information.\n\n36. Stage 6 — Create the OAuth client and provider for the production instance\n37. Confirm the application scope is set to **Scan Engine**.\n\n38. Navigate to **All** > **Scan Engine** > **My SN Instances** and confirm that a MySN instance record exists for the production instance.\n\n    If the production instance record has not been created yet, complete [Register your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/register-your-instance.md) before continuing as follows. The record must exist before OAuth fields can be configured.\n\n    |Field|Value|\n    |-----|-----|\n    |Instance Name|The instance name as it appears in `stats.do` for the production instance.|\n    |URL|The full URL of the production instance.|\n    |Environment|**Production**|\n\n39. Navigate to **All** > **System OAuth** > **Inbound Integrations** and select **New Integration**.\n\n40. Select **Resource Owner Password Credential Grant** and fill out the form as follows:\n\n    |Field|Value|\n    |-----|-----|\n    |Name|OAuth Client Prod|\n    |Provider Name|Leave empty.|\n    |Client ID|Copy the auto-generated value to your text editor for use in the next step.|\n    |Client Secret|Enter the integration account password.|\n    |Auth Scope|**useraccount**|\n    |Advanced options: Token Format|**Opaque**|\n\n41. Select **Save**.\n\n42. Navigate to **All** > **System OAuth** > **Application Registry** and select **New**.\n\n43. Select **Connect to an OAuth Provider \\(simplified\\) — Outbound** and fill out the form as follows:\n\n    |Field|Value|\n    |-----|-----|\n    |Name|OAuth Provider Prod|\n    |Client ID|Paste the client ID copied from OAuth Client Prod.|\n    |Client Secret|Enter the integration account password.|\n    |Default Grant Type|Resource Owner Password Credentials|\n    |Redirect URL|Select the redirect URL for the production instance. Example: https://prod.servicenow.com/oauth\\_redirect.do|\n    |Token URL|Use the redirect URL with the path changed to `oauth_token.do`. Example: https://prod.servicenow.com/oauth\\_token.do|\n\n44. Select **Save**.\n\n    An OAuth entity profile record is automatically generated and appears at the bottom of the form. Leave this record as-is.\n\n45. Stage 7 — Link OAuth records to the production MySN instance and validate\n46. Navigate to **All** > **Scan Engine** > **My SN Instances** and open the production instance record created in [Register your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/register-your-instance.md).\n\n47. Configure the record as follows:\n\n    |Field|Value|\n    |-----|-----|\n    |Authentication Type|OAuth|\n    |OAuth Application Registry|OAuth Provider Prod|\n    |OAuth User Profile|Select the existing Integration Account profile \\(the same profile used for the development connection\\).|\n\n48. Select **Save**, then click **Validate Connection**.\n\n    **Note:** Because the KMF module access policy for ScanEngine API Util was already set to **Track** in Stage 5, the connection should validate immediately without additional KMF steps. See [Validate your instance connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/validate-instance-connection.md) for additional information.\n\n    Connection Status updates to `Connection valid`.\n\n49. Stage 8 — Export production records and import into the development instance\n50. From the production instance, navigate to **All** > **System OAuth** > **Application Registry** and export the following records as XML:\n\n    -   **OAuth Client Prod**\n    -   **OAuth Provider Prod**\n    -   The **OAuth entity profile** auto-generated by OAuth Provider Prod\n51. Export the production MySN instance record as XML.\n\n52. Log in to the development instance and navigate to **All** > **Scan Engine** > **My SN Instances**.\n\n53. Import the four XML files using **Import XML**.\n\n54. Navigate to **All** > **System OAuth** > **Application Registry** and correct the KMF-encrypted client secret on both **OAuth Client Prod** and **OAuth Provider Prod** by overwriting each with the integration account password.\n\n    See Stage 4 for the correction procedure.\n\n55. Navigate to **All** > **Scan Engine** > **My SN Instances**, remove any active filters, and open the production instance record.\n\n56. Select **Validate Connection**.\n\n    Connection Status updates to `Connection valid`. Both instances now have valid MySN instance records for development and production.\n\n\n## Result\n\nBoth the development and production instances have validated MySN instance records in each direction. Definition synchronization, update set summary synchronization, and exception reason synchronization are now available.\n\n## What to do next\n\n-   [Definitions integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/definitions-integrations.md)\n-   [Exception reason integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/exception-reason-integration.md)\n-   [User story integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/user-story-integration-properties.md)\n-   [Deployment and synchronization integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/deployment-sync-integrations.md)\n\n**Parent Topic:**[Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/configure-oauth-auth-method.md)\n\n"}}