hi everyone this is the fifth video in the series of integrations and we are going to discuss about a very cool feature which is newly introduced in servicenow as part of probably home release so finally we have the ability to verify our jwt tokens within servicenow without the use of custom scripts earlier in earlier versions of service now whenever we needed to verify the jwt token we needed to use external js libraries so that we are able to successfully verify the jwt token and process the remaining part of the script or the configuration that was done in the servicenow instance but now we have the out of the box configuration available so that the incoming jwt token can be verified and accordingly an access token can be generated for us to perform any kind of operation that we are wanting to perform within the instance so let's get started and see how it works so first of all i am going to my oauth application registry and i will create a new application register you can see that this is the newest option added over here create an awt api endpoint for external clients let's click on this one and i'm going to give it a name as test jwt this is the client id automatically generated and client secret will be automatically generated once i save this form and on what basis the jwt token will be generated and accepted by the system is based on the user specific fields so by default email is selected and even i prefer to use email a and based on your organization setup you can also select probably user id if that makes things easy for you and let me save this record and and and and i think i have a few of the required information which i need to showcase the demo now to move forward i also need to generate a jwt token within service now for that within service now or maybe outside service now now if you're doing an integration between two service no instances then the instance which is sending the data outbound will be generating the jwt token and the instance which is receiving that request will be verifying whether the jwt token is authentic or not or is it a valid one or not or if you're integrating with some other third party applications then that particular application needs to send the awt token and it will be verified by the application b okay so let's move forward now how do we generate a jwt token within service now that video is already published by me couple of months back and it is available in youtube and this is the description of the video generate a json web token jwt in service now so here i have explained everything which you need to generate a json web token and service now the certificates the key store the scripts everything so one such script i am going to use right now to generate a jwt token and request an access token from the service now instance before i jump on to generating a token let me first set up my things in the postman because i will be showcasing everything with the help of postman so let's go to the body and first of all i will specify the client id which is this one next is client secret then the most important part is the gland type it is not your usual kind of grain type and it goes something like this you are in colon i e t f then [Music] parents what then type jwtp too big to say but this is how it is and nothing much can be done we will have to use it this way and now i need to pass my jwt token first let's generate the jwt token using a background script i have already written that script with me over here since he did that configuration in my instance long back and the certificate is still valid so in the payload what i am passing is in the aud this should be the client id okay let me first replace that we will go back to the what application registry and this is my client id possibly this should be passed in the aud claim as well as iss claim and since i'm using the email option in the application registry configuration for the user field i am passing the email id of one of the user which exists in the system and servicenow user table that is passed as part of the sub claim then this is the existing jwt provider ssid so let's open the jwt provider and you will see i am using this one this was already set up and you can find more details in the generator json web token video about this now if i click on unscript a jwt token is generated and let me copy this token control c and if i go to the postman i need to pass the token over here to request an access token control v click on send so there is an issue it says invalid jwt token sorry invalid jwt signature now why the hell i am getting this particular error now let's hop to the jwt dot io website and see why this is not working this is the gwt dot io website and i am going to paste my jwt token over here so you can see that all the details which i have passed to generate the token can be seen over here this is the user detail in the sub claim aud and iss contains the client id of the oauth application registry then this is jti and it also says invalid signature now why that is happening so to validate a particular jwt token i also need the public key of the certificate which was used to create this token now let's go to the certificates module and certificate 2 is the one this is the public key let me copy this and let's see if this works on the jwt dot io website if yes then it will also work in the servicenow instance see now my signature seems to be verified so we need to do a certain configuration in the servicenow instance as well so that my jwt token is verified i and i don't get that again okay so let's go back to the application registry now there are a couple of things over here first is enable jti verification if i keep this checkbox checked for every call to the instance i need to send a different token altogether which is also a recommended approach when you are dealing with things in the production because it tightens your security but as part of the testing over here i am simply going to uncheck it so that we can do lot of things with the same token and then i have this jwt verifier maps let's click on new over here so this is the key id which is automatically generated and this is a shared key i'm going to leave it as blank and then i need to select my certificate over here as i said it is certificate 2 which is the public key of the certificate which was used to generate the jwt token let's submit this one and i'm also going to copy this key id and paste it over here now in real life scenarios you will not be passing the data in this format since it is already available in the system you will be writing couple of scripts to get it from there and pass it to your scripts and nothing hard coded will be required in that case but since i'm just giving a demo i'm not planning to take so much of time and this is done now let's generate one more token and see if it works this time one and this is my token let's pass this token in the postman and click on send again it is invalid jwt signature okay let's check it again what we have missed no [Music] things look to be okay over here and i am going to take the shared key let's generate another one postman and send for some reason postman did not like my token that's sad let's try again it should not be required but let's check one more thing so let me update this value everything else remains the same and um okay let us check one more thing so this is the key it was generated and if i go to the jwt keys down here i need to update this kid now let's try again hopefully it will work this time this is my token i am back in postman and let's click on send okay so now i am finally able to generate my access token and this is how we do it using client id client secret type and assertion we need to make sure of couple of things like i did that passing the variables wherever it is required like aud and iss are usually the client ids of my recording application registry sub contains the user data if you have selected user id or username in the user field then you need to pass the username which is usually first name dot last name or whatever conventions are used in different different organizations if you have selected email then the user email needs to come here and whatever kid is generated as part of your map the same needs to be present in your jwt keys and if you are using similar kind of script which i have used then you need to pass the same key id otherwise it will not validate now there is one more thing uh whatever we have seen so far we are using four options as part of my request client id client secret type and then the token and this token can also be used to create let's say an incident record in the system let's see how we can do that i am going to do a post call let's select any of them and then i am going to use json object first is short description that i want to pass second variable that i want to pass is description oh let's one more thing impact so this is my object and now i can simply pass authorization and the access token which i just copied yeah this is the one if i click on send and incident should be created in the system this is the incident number let's verify whether it is actually created or the postman is trying to fool me so the incident is created for real this is the short description description and the impact is one and this is the same number so this is how we request an access token using a jwt token and using that access token we can do or perform whatever operation we are willing to perform now there is one more thing to it as of this example i use client id and client secret along with the grant type and the jwt token but if i don't want to use client id and client secret there is also another option available for the same there is a field called public client which is not on the form by default let's wait for a second and i am going to add it if i check this checkbox and if i click on save i don't need to use a client id and client secret as part of my request i can simply uncheck this if i click on send now i am still able to request access token okay and i can use the success token what is happening come on and if i click on send again another incident will be created let this reduce the lifespan to let's say five seconds and request different different tokens to see if it works out send okay probably my token jwd token has expired i need to request a new one send and i am able to request a new token let's wait for a couple of seconds and i am going to request a new one see this is a token which is different than the previous one since i gave the token expression times five and i can still use this to create another ticket i think i kept the token time very small so meanwhile i went to create a new one it has already expired and i'm going to request a new token first let's see this time yes so that was an issue with a total token expiry time between the duration when i generated the jwt token requested an access token and i went to a different tab it was already expired so this is pretty much it and this is how we can request an access token based on rjwt token so this is for people who are already on home but for the others who are on fire releases i will be demonstrating the integration using the gwt token in my upcoming videos again using custom scripts because the jwt token verification is only available as part of home release so far so let's see how things turn out if not everybody is upgrading to the home then this feature is something which you will not be able to make use of but even otherwise there are some custom scripts available online which can be utilized to create a jwt token but since servicenow offers a very easy to navigate only configurable but in the service now instance to be able to generate a jwt token my recommendation would be to use the same but when it comes to token verification i don't think there is any other way available in the servicenow instance which is available out of the box apart from this particular release but it is possible via external apis and external javascript libraries which can be used and i'm going to show that in one of my future videos thank you for watching and don't forget to subscribe