Create Access Control Lists (ACLs) for Live Connect

Grant user accounts query access to specific ServiceNow tables through Live Connect using table-level ACLs.

Before you begin

Confirm the following:

• The sn_odbc_rest_access or sn_jdbc_rest_access role must be assigned to a user account (personal or service account).

• For personal user accounts using basic authentication, the snc_basic_auth_api_access role must also be assigned.

• The ServiceNow tables that must be accessible via Live Connect must be identified.

Role required: security_admin

About this task

Access to tables through the Live Connect is not granted globally. For each table that a user account needs to query, the account must have explicit read access. You can grant this access in any of the following ways:

• Create two ACLs, one for the egress_sql operation (which controls Live Connect data export) and one for the read operation (which controls record-level access).

• Assign a role to a user account that includes read permissions for the table.

A user account can only query tables for which it has explicit read access through either method.

By default, Live Connect checks access at the table, row, and field level for every query. This follows ServiceNow secure-by-default approach. Live Connect validates all ACLs in your instance record by record. This may result in longer response times. This is expected.

If your use case does not require row and field-level checks, you can turn them off. Assign the sn_live_connect_privileged_mode role to the user account. For example, you might build a dashboard used by multiple people or a Business Intelligence integration. Table-level ACL checks remain in effect and can’t be turned off.

Procedure

1. Navigate to All > System Security > Access Control (ACL).

2. Select New.

3. On the Access Control form, configure the first ACL for the egress_sql operation.

<table><thead><tr><th>

Field

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Operation

</td><td>

Select egress_sql from the drop-down list.

</td></tr><tr><td>

Decision Type

</td><td>

Select Allow if from the drop-down list.

</td></tr><tr><td>

Name

</td><td>

Select the table to grant access to (for example, incident [incident]).

</td></tr><tr><td>

Requires role

</td><td>

Enter the role assigned to your user account (for example, sn_odbc_rest_access or sn_jdbc_rest_access).Optionally, add the sn_live_connect_privileged_mode role to turn off row and field-level checks at the user account level.

</td></tr></tbody> </table>4. Select and hold (or right-click) the form header, and select Save.

1. Create the second ACL for the same table by selecting New.

2. On the Access Control form, configure the second ACL for the read operation.

   Field Value Operation Select read from the drop-down list. Decision Type Select Allow if from the drop-down list. Name Select the same table you specified in the egress_sql ACL. Requires role Enter the same role you specified in the egress_sql ACL.

3. Select and hold (or right-click) the form header and select Save.

4. Grant access to additional tables by repeating steps 2 through 7 for each table.

   Note: Access is granted on a per-table basis.

Result

You have successfully configured table-level access control for Live Connect. The user account can query the tables for which both egress_sql and read ACLs have been created, subject to the role requirements you specified.

Parent Topic:Live Connect configuration on your ServiceNow instance