Create the MID Server user and grant the role

To communicate with the instance, MID Servers need a user ID and the mid_server role. Create the user ID for a MID Server and grant the respective role. To prevent MID Server validation failure, ServiceNow enforces role requirements for MID Server users.

Before you begin

Role required: admin

<table id=“table_skp_xr4_nhb”><tbody><tr><td>

up indicator for installation phase

</td></tr></tbody> </table>## About this task

The MID Server connects to an instance using the SOAP web service. To allow authentication with the instance, each MID Server must be associated with a ServiceNow user account. The same ServiceNow user account can be shared across multiple MID Servers, but if the account uses Basic Auth, use separate accounts per MID Server so login credentials are unique. Following this task will grant each MID Server user the mid_server role, which is required for the MID Server user on all instances. The mid_server role allows the MID Server to access protected tables when strict SOAP security is in place. The system adds the necessary roles automatically with this role.

Note: The strict SOAP security feature, enabled by default for any instance that uses basic authentication, protects all tables with Access Control Lists (ACL).

If multiple MID Servers are using the same logged in user, an issue record is created when more than one is Up at a time. It is recommended that MID Servers use a unique logged in user. See (KB1552863) MID Server Unique Logged In User for more information and remediation steps.

Important: Improve security by using MID Server mutual authentication instead of basic authentication. See Enable MID Server mutual authentication for more information.

Procedure

1. From the instance, navigate to User Administration > Users.

2. Click New.

3. Complete the fields in the form.

<table id=“table_isc_b4z_r1b”><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

User ID

</td><td>

User name for the MID Server user. This name is specified in the mid.instance.username parameter of the configuration file that the MID Server installer creates. For details, see MID Server parameters.

Note: Avoid using the same MID Server logged in user across multiple MID Servers.

</td></tr><tr><td>

First name

</td><td>

The user’s first name.

</td></tr><tr><td>

Last name

</td><td>

The user’s last name.

</td></tr><tr><td>

Password

</td><td>

Password for the MID Server user. This password is specified in the mid.instance.password parameter of the configuration file (config.xml) in the agent folder of the MID Server installation directory.

</td></tr></tbody> </table> Important: The XML specification defines five predefined special characters that all XML processors must recognize. To use a predefined character in an XML file, such as the MID Server config.xml file, replace it with its entity reference.

|Predefined character|Entity reference|
|--------------------|----------------|
|"|"|
|&|&|
|'|'|
|<|<|
|>|>|

1. Right-click the header and select Save.

2. Under the Roles related list, click Edit.

3. Select the mid_server role for this user.

   Each MID Server account must have this role to access protected tables.

4. Click Save.

5. Confirm that the MID Server account was created successfully and the account has connectivity to the instance.

   1. On the host machine where you intend to install the MID Server, open a browser and navigate to the instance.

   2. Use your new MID Server user credentials to log in.

      If the login is successful, then any MID Servers you install on that host will be able to connect to the instance.

MID Server role validation

Real-time system validation of MID Server role assignments prevents incompatible settings.

To prevent MID Server validation failure and ensure that your MID Server is configured correctly, the system runs several business rules that monitor the roles and settings you select for your MID Server user. The instance displays a warning and blocks the change when you attempt to save an incompatible configuration.

Elevated privileges not permitted

The mid_server role cannot be configured for elevated privileges. The Invalid MID Server settings business rule runs on the Role [sys_user_role] table and prevents the elevated_privileges field from being set to true for the mid_server role.

[Omitted image “ElevatedPrivilegeWarning.png”] Alt text: MID Server role

Relationship table protection

The User Role [sys_user_has_role] table creates the relationship between the User [sys_user] and the Role [sys_user_role] tables.

• Incompatible role

  The mid_server and security_admin roles are incompatible and cannot be assigned to the same user. The system determines the user's current role and runs the Security Admin incompatible with MID business rule on the User Role [sys_user_has_role] table. This rule prevents an administrator from adding the security_admin role for a user who currently has the mid_server role.

  [Omitted image "SecurityAdminRoleBlocked.png"] Alt text: Warnings for incompatible security_admin role assignment

• Incompatible user role and user record settings

  The Incompatible MID Server user role business rule runs on the User Role [sys_user_has_role] table to protect its data from incompatible configurations. Validation for this related table ensures that an administrator cannot assign the mid_server role to a user who already holds the security_admin role.

What to do next

Download the MID Server files for your operating system.