Okta Workflows ServiceNow connections may become unhealthy or fail to create new connections with a 401 error due to ServiceNow implementing restrictions on inbound Basic Authentication API requests. To resolve or prevent this issue, action needs to be taken on the ServiceNow side by configuring the service account as Web Service Access Only or assigning the appropriate API access role within the ServiceNow instance.

This issue may be seen when using a ServiceNow card or attempting to create a new connection, and the ServiceNow connection returns the following error:

401 Unauthorized

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• ServiceNow Connector

ServiceNow is implementing restrictions on inbound Basic Authentication API requests and requiring administrators to validate and classify integration accounts. Instances are transitioning from Tracking Mode to Enforcement Mode, which blocks unclassified credentials and throws HTTP 401 errors. No updates or code changes are required within the Okta tenant.

Because the Okta Workflows ServiceNow connector relies on customer-supplied credentials, access control policies are managed entirely within the ServiceNow instance.

How does an administrator determine if the basic authentication restrictions apply?

Determine if the 401 error is caused by the ServiceNow basic authentication restrictions by reviewing the ServiceNow documentation to identify impacted users.

• How To Identify Impacted Users

NOTE: If the account is not flagged, the 401 error may be caused by other configuration issues. See the following KBA for more troubleshooting steps: Error 401 Unauthorized when attempting to create or reauthorise a ServiceNow connection in Workflows or Failed to load error on action card.

How does an administrator resolve the ServiceNow basic authentication restrictions?

Review Understanding ServiceNow’s New Basic Authentication Restrictions for more information, and in the ServiceNow instance, configure the service account as Web Service Access Only or assign the appropriate API access role by choosing one of the following methods.

• Set the account to Web Service Access Only (WSAO) to preserve Basic Authentication API access while blocking interactive user interface logins.
• Assign the appropriate API access role to the account as a temporary workaround to permit Basic Authentication for API access.

Verify the Connection in Okta Workflows

Verify the connection and ensure the account is no longer flagged by ServiceNow by performing the following actions.

• Run a test flow or card in Okta Workflows that performs a query in ServiceNow to confirm connectivity.
• Review the basic authentication user exceptions in the ServiceNow instance to confirm the Okta Workflows service account no longer appears as a flagged account.

NOTE: Re-authenticate the ServiceNow connection in Okta Workflows if it previously experienced a 401 error or if a different service account is used.

Related References

• Reviewing ServiceNow Basic Authentication Account Security
• Understanding ServiceNow’s New Basic Authentication Restrictions
• ServiceNow Basic Authentication Documentation
• Authorization
• Error 401 Unauthorized when attempting to create or reauthorise a ServiceNow connection in Workflows or Failed to load error on action card