LDAP integration
Quick answer
Import users and groups from Active Directory: listeners, OUs, transform maps, scheduled imports and the MID server role.
Key takeaways
- Coalesce on an immutable attribute or you will create duplicates
- Run through a MID server when the directory sits behind the firewall
- Import only the OUs you need, then filter further with an LDAP query
- Never delete leavers, deactivate them
How the pieces fit
An LDAP server record holds the connection. One or more OU definitions describe which parts of the directory to read. Each OU maps to an import set table, which a transform map turns into sys_user or sys_user_group records.
MID server or direct
If the directory is not reachable from the internet, the connection runs through a MID server inside your network. That is the usual pattern. Direct connections require a published, secured LDAPS endpoint.
Keeping the import sane
Filter at the source rather than importing everything and deleting later.
- Use an LDAP filter that excludes disabled accounts and service accounts
- Coalesce on a stable value such as objectSid or userPrincipalName, never on display name
- Schedule a full load weekly and a filtered incremental daily
- Set inactive rather than deleting users who leave, so history stays intact
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
What turns imported LDAP rows into user records?
- A. A business rule
- B. A transform map
- C. An inbound action
- D. A flow
Show answer
B. A transform map
The import set table holds raw rows, the transform map writes them to sys_user.
When is a MID server required for LDAP?
- A. Always
- B. When the directory is not reachable from the internet
- C. Only for groups
- D. Only for LDAPS
Show answer
B. When the directory is not reachable from the internet
The MID server bridges the instance to networks it cannot reach directly.