ServiceNow LDAP, Groups, Roles

A few things to know when writing Javascript in Service Now:

1) When importing groups and users from LDAP, you need to make sure that you map the dn from LDAP to the source field in the sys_user table, as part of the transform map.  Otherwise the OnAfter call of ldapUtils.addMembers(source,target) during the group transform will not be able to associate the user with a group when you go to sync the group.

2) When manipulating roles, you need to modify the sys_user_has_role for users and sys_user_has_group table for groups.  The examples that exist out there now where you just assign this field to a comma delimited list of strings does not work in Calgary.

3) Related to (2), keep in mind that membership of groups works the same way.  There is not a simple Reference. So, to add someone to a group or a role, you need to modify the correct membership table.

Code snippet from our implementation partner:

var roleToAssign = 'itil';

var groupToAssign = "Group Name";

if (!groupHasRole(groupToAssign, roleToAssign)){

   addRoleToGroup(groupToAssign, roleToAssign);

}

function groupHasRole(groupName, roleName){
   var groupRoleGR = new GlideRecord('sys_group_has_role');
   // We presume group and role exist
   groupRoleGR.addQuery('role.name', roleName);
   groupRoleGR.addQuery('group.name', groupName);
   groupRoleGR.query();
   return groupRoleGR.hasNext();
}

function addRoleToGroup(groupName, roleName){
   var newGroupRole = new GlideRecord('sys_group_has_role');
   newGroupRole.initialize();
   newGroupRole.role.setDisplayValue(roleName);
   newGroupRole.group.setDisplayValue(groupName);
   newGroupRole.insert();
}