Interfacing with Thycotic Secret Server from ServiceNow

Step 4: Make an API call from ServiceNow

Now that you’ve tested connectivity and API access using cUrl, it’s time to implement the same calls into ServiceNow server-side Javascript (script include). To get started, you’ll want to create a new “Script Include” in ServiceNow and create a class extending AbstractAjaxProcessor. From there, we can build out a proper class with methods to get API tokens and execute Secret Server API calls with either REST or SOAP.

Skeleton class

/**
 * Represents a Thycotic Secret Server integration
 * @constructor
 */
SecretServerAPI.prototype = Object.extendsObject(AbstractAjaxProcessor, {
  // Class constants
  MID_PROXY: 'Secret Server Proxy MID Server Name',
  SS_URL: 'https://FQDN/secretserver',
  API_ENDPOINT: 'https://FQDN/secretserver/api/v1/',
  API_AUTH_ENDPOINT: 'https://FQDN/secretserver/oauth2/token',
  WS_ENDPOINT: 'https://FQDN/secretserver/webservices/sswebservice.asmx',
  API_USERNAME: 'SS_USERNAME',
  API_PASSWORD: 'SS_PASSWORD',
  
  // Class methods
  // ...
});

Adding class methods for our API script include.

The next two sections show how to build methods that interact with the Secret Server API using ServiceNow server-side Javascript. The next section shows getting an API authentication token using either REST or Web Services (SOAP). Note – a REST OAuth2 token can NOT be used to make SOAP calls and vice-versa.

In the examples, I use client.setMIDServer(this.MID_PROXY); in the call. This is only needed if you are access your Secret Server via a ServiceNow MID server / proxy. It can be omitted if ServiceNow has direct access to the Secret Server in use.

The token received from calling these methods will be used to make future API authenticated calls.

SOAP API “get token” method

/**
 * Gets an access token for SOAP / WS API from the Secret Server service.
 * This allows for future authenticated calls to the API.
 * @function
 * @public
 * @returns {String} A token
 */
getWSToken: function() {
  try {
    // Setup request
    // "REST" call to SOAP interface. Living on the edge...
    var client = new sn_ws.RESTMessageV2();
    client.setHttpMethod('get');
    client.setEndpoint(this.WS_ENDPOINT + '/Authenticate');
    client.setQueryParameter('username', this.API_USERNAME);
    client.setQueryParameter('password', this.API_PASSWORD);
    client.setQueryParameter('organization', '');
    client.setQueryParameter('domain', '');
    client.setHttpTimeout(10000);
    client.setMIDServer(this.MID_PROXY);
    // Make request, decode XML response, and return the access token
    return (new XMLHelper(client.execute().getBody())).toObject().Token;
  } catch (ex) {
    gs.error('Exception: (' + ex + '), ' + ex.getMessage());
    return ex.getMessage();
  }
},

SOAP API “get secret attachment” method

/**
 * Gets a secret's attachment value by Secret Item ID
 * @function
 * @public
 * @param {Integer} secret_id  Secret ID
 * @param {Integer} secret_item_id  Secret Item ID
 * @returns {Object} An attachment
 */
getSecretAttachment: function(secret_id, secret_item_id) {
  try {
    var wstoken = this.getWSToken();
    // Setup request
    var client = new sn_ws.RESTMessageV2();
    client.setHttpMethod('get');
    client.setEndpoint(this.WS_ENDPOINT + '/DownloadFileAttachmentByItemId');
    client.setQueryParameter('token', wstoken);
    client.setQueryParameter('secretId', secret_id);
    client.setQueryParameter('secretItemId', secret_item_id);
    client.setHttpTimeout(10000);
    client.setMIDServer(this.MID_PROXY);
    // Make request, decode XML response, and return the access token
    var attachment = (new XMLHelper(client.execute().getBody())).toObject();
    // File attachments are base64 encoded by default
    if( !attachment.Errors && attachment.FileAttachment )
      attachment.FileAttachment = GlideStringUtil.base64Decode(
        attachment.FileAttachment);
    return attachment;
  } catch (ex) {
    gs.error('Exception: (' + ex + '), ' + ex.getMessage());
    return ex.getMessage();
  }
},