Administration · LessonBy Sneha I, ServiceNow Trainer, 8 yrs · Published · ServiceNow · all levels
LDAP integration
Import users and groups from Active Directory: listeners, OUs, transform maps, scheduled imports and the MID server role.
Quick answer
Import users and groups from Active Directory: listeners, OUs, transform maps, scheduled imports and the MID server role.
Key takeaways
- Coalesce on an immutable attribute or you will create duplicates
- Run through a MID server when the directory sits behind the firewall
- Import only the OUs you need, then filter further with an LDAP query
- Never delete leavers, deactivate them
How the pieces fit
An LDAP server record holds the connection. One or more OU definitions describe which parts of the directory to read. Each OU maps to an import set table, which a transform map turns into sys_user or sys_user_group records.
MID server or direct
If the directory is not reachable from the internet, the connection runs through a MID server inside your network. That is the usual pattern. Direct connections require a published, secured LDAPS endpoint.
Keeping the import sane
Filter at the source rather than importing everything and deleting later.
- Use an LDAP filter that excludes disabled accounts and service accounts
- Coalesce on a stable value such as objectSid or userPrincipalName, never on display name
- Schedule a full load weekly and a filtered incremental daily
- Set inactive rather than deleting users who leave, so history stays intact
Practice challenge
+0 XPStreak ×0
Question 1 of 2
What turns imported LDAP rows into user records?
Frequently asked questions
Should authentication also come from LDAP?
Most deployments use SAML for single sign on and LDAP only for user and group data. That keeps password handling in the identity provider.
Why are users being duplicated on each run?
The transform map is coalescing on a field that changes, such as name or email. Switch to a stable identifier.