Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field
Hi there,
While having Multi-factor Authentication enabled on your instance, users probably use an authenticator app on their mobile like the "Google Authenticator". The user account and the mobile device of the user are paired.
So what if a user has a new mobile device? The old pairing doesn't work anymore, so the user will not be able to login… HELP!!!
A short article on experiences gained on the job.
Docs
The ServiceNow Product Documentation does mention the pairing briefly:
Q: What if I must change devices and re-pair or reenter the code into a different mobile device?
A: Go to your user profile in the ServiceNow instance under My Profile and click multi-factor authentication to get access to the code to reenter and pair your device."
That's nice… though the user can't log in anymore, so how should the user reach the My Profile page?
User Multifactor Authentications
The paring records between the user accounts and the mobile devices are stored in the "User Multifactor Authentications" table [user_multifactor_auth].
The simplest thing to do would be for an administrator to remove the record in the Multifactor Authentications table for the user concerned. Ones trying to login again, the user would be presented with the "Enable multi-factor authentication" page, where the user can create a new pairing.
UI Action
What we came up with, was to create a Related Link (UI Action) on the User record form lay-out. A Related Link with which the pairing can easily be removed. The ServiceNow Administrator doesn't have to know the User Multifactor Authentications table from the top of his mind, this saves time and easier maintainability.
UI Action
Name: Remove Multi-factor Authentication pairing
Table: User [sys_user]
Order: 100
Active: Checked
Show update: Checked
Form link: Checked
Comments: Related link which is showed when a user has an active Multi-factor Authentication pairing. The related link performs a delete on the record.
Condition:
gs.getUserID() == !current.getUniqueValue() && gs.getProperty('glide.authenticate.multifactor') && current.active && new QT_MultifactorAuthenticationUtils().get_pairing(current.getUniqueValue())Script:
(function() {
// Script Include and function called upon
new QT_MultifactorAuthenticationUtils().remove_pairing(current.getUniqueValue());
})();
Script Include
Name: QT_MultifactorAuthenticationUtils
Accessible from: This application scope only
Active: Checked
Description: Script Include which holds the functions used within the QT Core Configuration add-on for Multifactor Authentication.
Script:
// Class and function(s)
var QT_MultifactorAuthenticationUtils = Class.create();
QT_MultifactorAuthenticationUtils.prototype = {
initialize: function() {
},
get_pairing: function(sys_id) {
// Get the record
var grUserMultifactorAuth = new GlideRecord('user_multifactor_auth');
if(grUserMultifactorAuth.get('user', sys_id)) {
return true;
}
return false;
},
remove_pairing: function(sys_id) {
// Get the record
var grUserMultifactorAuth = new GlideRecord('user_multifactor_auth');
if(grUserMultifactorAuth.get('user', sys_id)) {
grUserMultifactorAuth.deleteRecord();
}
},
type: 'QT_MultifactorAuthenticationUtils'
};
Result
When an Administrator would open a User record for a User that has Multifactor Authentication enabled, a new UI Action will be visible under the Related Links:
Share
An Update Set with this Service Portal widget can be downloaded from Share:
- Remove Multi-factor Authentication pairing
---
And that's it actually. Hope you like it. If any questions or remarks, let me know!
| C |
If this content helped you, I would appreciate it if you hit bookmark or mark it as helpful.
Interested in more Articles, Blogs, Videos, Podcasts, Share projects I shared/participated in? |
Kind regards,
Mark Roethof
ServiceNow Technical Consultant @ Quint Technology
1x ServiceNow Developer MVP
1x ServiceNow Community MVP
---
