Troubleshooting HashiCorp Vault Credential Resolver for ServiceNow Rome Instance

Summary:

• Due to some recent changes in ServiceNow, previously installed HashiCorp Vault Credential Resolver plugins may no longer be configured properly or the prior way to install is no longer available for Rome instances of ServiceNow. These changes involve CyberArk being the default Credential Storage Vault.

Solution for Upgraded Instances:

1. Ensure "Discovery" and "External Credential Storage" plugins have been activated on the instance as these may have been deactivated. If not, activate again and wait for those to finish.
2. Navigate to "Credentials" in Discovery section of ServiceNow. *Note: The proper permissions need to be in the role being used to achieve this.
3. Click the credential previously setup storing your vault MID credentials.
4. Make sure to check the field "Applies to" to confirm if this is for all MID servers or only Specific MID Servers. If only specific, ensure to click the lock and search for the MID server this update should apply to.
5. Make sure "External Credential Store" is checked.
6. Click the dropdown for "Credential Storage Vault" where CyberArk is listed.
   
7. Select "None" in the dropdown.
   
8. Click "Update".
9. Test the connection to your MID server to ensure that your credentials are working as expected.
   1. If not, go through and confirm Vault Agent configuration file is correct along with the path being utilized. Then check the AppRole config that the Vault Agent is configured to use ensuring that "secret_id" and "role_id" are still valid. Finally, double check that the correct path is being set in the Credential ID field in ServiceNow for the credential being used.
   2. If yes, the setup is ready to go again.

Solution for New ServiceNow Rome instances:

1. The steps found in Installing the Vault Credential Resolver should still be followed to install properly and configure the Vault Agent that will be used along with the AppRole setup needed.
2. Activate "Discovery" and "External Credential Storage" plugins for ServiceNow.
3. Click "Credentials".
4. Select the type of credentials from the list provided.
5. Once the "External Credential Store" box is ticked, new fields will populate and CyberArk will become the default.
   
6. As mentioned in Configuring the Resolver to Use a Secret, set "Credential ID" to the secret path. If utilizing namespaces, the namespace will be at the front of the path as such:
   

    <namespace/path/to/secret>

   
7. Click on "CyberArk" and change to "None" where the "Lookup key" field will disappear and the rest of the configuration for the credential can be set, tested, and submitted.