connect(servicenow): align /connect ServiceNow with SNOW V2 spec#217
Draft
mukesh4139 wants to merge 9 commits into
Draft
connect(servicenow): align /connect ServiceNow with SNOW V2 spec#217mukesh4139 wants to merge 9 commits into
mukesh4139 wants to merge 9 commits into
Conversation
…c config schema G1: gate oauth2/basic/graph behind SNOW_ALLOW_LEGACY (out of V2 scope, retained as legacy). G2: authType vocabulary -> entra_user/entra_certificate. G11: config.json reshaped to spec v2 (scope, portalBaseUrl, makerPermissions, entra, connections, stepStatus). There is no spoon - only two auth methods. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
…e (G3, G4) G3: new step0-prerequisites.md gates the flow on ENV-001/002, ENV-CAPACITY-001, ESS-SOLN-001 (reused existing checkpoints, mirrors Workday setup); hands off to /setup on failure, re-runs on resume. Dispatcher now enters ServiceNow via step0. G4: step1 1.3b probes Entra admin (Graph role check) and asks the ServiceNow-admin question, persisting makerPermissions. Also finished G2 rename in the connect dispatcher. Know thyself - and thy permissions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
…ic handoff (G7, G14, G8, G12) New step5-portal-and-validate.md implements the missing spec Steps 5c/5b/5e/6: G7 sets ServiceNowPortalBaseURI on both packs (SN-BASEURL-001 or attest, + reset-after-update warning); G14 OBO connection-parameter sharing (attest, no auto-validation); G8 drives the live 'Show my HR cases'/'Show my IT tickets' prompts with 401/403/empty/broken-link routing (the true E2E proof); G12 hands topic creation to the topics/create skill. step4 now chains into step5 instead of stopping. Follow the white rabbit to a working link. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
…user attest (G9, G10, G13, G15) G9: admin consent promoted to a discrete step 2.2b (SN-ENTRA-CONSENT-001 + escalation to a consent-capable admin). G10: new 2.5b adds the SNI trustedCertificateSubjects manifest requirement for the cert path (SN-ENTRA-CERT-001). G13: security_admin elevation reminder before ServiceNow OIDC work in both auth paths (spec 1.7). G15: SN-SYSUSER-001 attestation + oid->User ID mapping enforced on the cert system user. G5 (manual/attest default vs MCP accelerator) framed inline per ADR 0001 - full MCP rework flagged for review. Wired SN-* checkpoint references into the steps. What is real? The attestation you can verify. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
Author
|
@microsoft-github-policy-service agree company="Microsoft" |
…spine Free your mind: ServiceNow follows Neo out of the connect/stepN Matrix and into the setup-orchestrator form Workday already lives in. - setup/servicenow/tasks.md: canonical 7-group checklist (S1-S7) with hidden Step/checkpoint/gate metadata, reusing ENV-*/ESS-SOLN-001 for groups 1-2 and mutually-exclusive auth-path groups 4 (entra_user) / 5 (entra_certificate). - setup/servicenow/SKILL.md: resume-aware router mirroring setup/SKILL.md, with ServiceNow-specific auth-path-variant rendering and attest-only ServiceNow OIDC. Playbooks, FlightCheck servicenow.py, and the connect redirect land in follow-ups. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
…nect redirect Complete the ServiceNow /connect migration to the Workday-style setup orchestrator. There is no spoon-fed step sequence anymore — /connect servicenow now delegates to the resume-aware orchestrator. - Add the 7 ServiceNow setup playbooks (S1-S7): environment, ESS install, connection basics (realizes user-presence spec gap SG-1), the two mutually exclusive Entra sign-in paths (entra_user / entra_certificate), extension pack + connection, and validate/handoff. ServiceNow-internal OIDC rows (S4.3/S4.4/S5.3) stay attest-only: the agent never automates them. - Redirect connect/step1.md + connect/SKILL.md ServiceNow branch to the orchestrator; legacy connect/servicenow/step*.md retained behind ALLOW_LEGACY. - Update test_setup_router.py for the new ServiceNow routing and add test_servicenow_router.py to pin the orchestrator wiring against drift. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
There is no going back to the old flow. Now that /connect servicenow delegates entirely to the setup orchestrator, the connect/servicenow/stepN files were an orphaned island — nothing outside the folder routed into them. Delete all 14, matching how the Workday migration removed connect/workday/. - Drops the legacy oauth2/basic/graph auth paths (out of V2 scope). Only entra_user and entra_certificate are supported. - Remove the now-dead ALLOW_LEGACY gate and legacy-playbook handoff from the orchestrator (capture-servicenow-config, tasks) and the connect docs (step1, SKILL); requests for legacy auth now hard-stop with guidance. - Add test_connect_servicenow_monolith_removed to pin the deletion (parallel to the Workday monolith-removed guard). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
Free the ServiceNow setup skills 4/5 from their MANUAL-only limbo:
the Entra side of the flow is Microsoft-Graph-only, so it can be
verified programmatically the same way Workday's WD-ENTRA-* checks are.
Adds checks/servicenow_entra.py emitting three checkpoints, each
runnable in isolation via --checkpoint:
* SN-ENTRA-SCOPE-001 — sign-in app exposes user_impersonation,
pre-authorizes the Power Platform ServiceNow connector
(c26b24aa), and requests openid / profile / User.Read.
* SN-ENTRA-CONSENT-001 — tenant-wide admin consent (AllPrincipals
oauth2PermissionGrant) covering those three delegated scopes.
* SN-ENTRA-CERT-001 — the service-account app (App B) holds a
non-expired AsymmetricX509Cert credential; cross-checks the
recorded thumbprint when one is captured.
Unlike Workday's gallery app, the ServiceNow apps are custom
registrations with no applicationTemplateId, so resolution is driven
entirely by the identifiers the playbooks persist
(entra.* / certificate.*), degrading to SKIPPED — never a silent pass —
when they are absent. Registers the specs (clients=GRAPH, no Dataverse),
adds SN-ENTRA to OWNED_PREFIXES for drift protection, wires the category
into the CLI (new servicenowentra scope; folded into servicenow + full),
and persists stable certificate.appBObjectId / appBClientId so the cert
check can resolve App B.
Tests: 29 new cases mirroring test_entra_app.py (result+remediation
phrase assertions); full flightcheck suite green (889). Verified live —
SCOPE + CONSENT PASS against the provisioned tenant, CERT SKIPs when the
certificate path is not provisioned.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
The maker who already created the ServiceNow connection during install was still told to hand-wire it to the extension pack's connection reference in Copilot Studio. Binding an already-created connection is not an OAuth flow - it is one Dataverse write of connectionreferences.connectionid. Automate it. - New scripts/bind_connections.py (ServiceNow-only setup action): finds the ServiceNow connection reference, no-ops if already bound, else binds via sibling-reuse or BAP connection discovery. 0/1/many active connections handled; most-recently-created wins and is reported with its owner so the maker can veto. --dry-run and --json supported; best-effort, never crashes. - Wire P6.3 of install-servicenow-extension-pack.md to run the auto-bind before the manual fallback, keying off exit codes (0 bound, 4 create-first, 3 no-reference, 1 error), then re-verify with SN-CONN-001. - 14 unit tests covering helpers and every run() branch. Verified live: correctly resolved the reference and reported already-bound (no mutation) against the maker's environment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2f2aaa1-f501-45e5-ad8a-3d7951b8e374
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Migrates
/connect servicenowfrom the monolithicconnect/servicenow/stepNflow to the Workday-style setup orchestrator (the pattern from #181), and
in the process closes the SNOW V2 spec gaps. ServiceNow was the last connect
skill still on the old monolith; this brings it in line with Workday.
What changed
setup/servicenow/tasks.md(canonical 7-groupchecklist with per-row metadata) and
setup/servicenow/SKILL.md, aresume-aware Message-block router.
basics, the two mutually exclusive Entra sign-in paths (user and
certificate), extension pack + connection, and validate/handoff. The
router reads
authTypeand renders only the matching auth path.entra_user+entra_certificate;adds the prerequisites gate, permission probe, admin-consent and portal-base-URL
steps, end-to-end validation, and an explicit user-presence check in ServiceNow.
claim mapping are attestation rows; the agent never automates them, and the
certificate private key is referenced by file path only.
connect/step1.md+connect/SKILL.mddelegateServiceNow to the orchestrator, and the old
connect/servicenow/step files(14) are deleted, matching how # Workday
/connectsetup orchestrator: 6 skills, shared components, and FlightCheck coverage #181 removedconnect/workday/. This dropsthe out-of-scope legacy
oauth2/basic/graphauth paths.FlightCheck automation (Entra side — Tier 1)
The Entra-facing setup steps are Microsoft-Graph-only, so they are now verified
programmatically like Workday's
WD-ENTRA-*checks. Addschecks/servicenow_entra.pywith three--checkpoint-runnable checks:user_impersonation,pre-authorizes the Power Platform ServiceNow connector (
c26b24aa), andrequests the Graph delegated perms openid / profile / User.Read.
AsymmetricX509Certcredential (thumbprint cross-checked when recorded).ServiceNow apps are custom registrations (no gallery template), so resolution
is config-hint-only and degrades to SKIPPED — never a silent pass — when the
app is not yet provisioned. Registered in the registry (drift-protected via
OWNED_PREFIXES) and wired into a newservicenowentraCLI scope. 29 newtests; full flightcheck suite green. Verified live: SCOPE + CONSENT PASS on the
provisioned tenant, CERT SKIPs when the certificate path is absent.
Tests
test_setup_router.py,test_servicenow_router.py).tests/flightcheck/checks/test_servicenow_entra.py— 29 cases mirroring theWorkday Entra-app suite (result + remediation phrase assertions).
Deferred
Tier 2/3 checks still need local config or a live ServiceNow tenant to validate
(ServiceNow-internal OIDC provider, system user, claim mapping — attest by
spec). Those playbook rows fall back to attestation, so the flow is spec-correct
today. Draft pending @mukesh review.