Skip to content

Add support for authenticating with OAuth Client Credential Grant#292

Open
jmunroBT wants to merge 1 commit intoSnow-Shell:masterfrom
jmunroBT:oauth_client_credential_grant
Open

Add support for authenticating with OAuth Client Credential Grant#292
jmunroBT wants to merge 1 commit intoSnow-Shell:masterfrom
jmunroBT:oauth_client_credential_grant

Conversation

@jmunroBT
Copy link

@jmunroBT jmunroBT commented Jan 26, 2026

These changes were developed to support OAuth flows required by our internal production use of this module, and we’re sharing them here in case they’re useful to the broader community. Maintainers are welcome to adapt or refine it further as they see fit.


This pull request enhances the ServiceNow PowerShell module's OAuth authentication flow, adding support for both the "password" and "client_credentials" OAuth grant types.

OAuth Grant Type Support and Session Handling:

  • Added explicit support for the OAuthClientCredential parameter set in New-ServiceNowSession, allowing users to authenticate using the "client_credentials" grant type for machine-to-machine scenarios.
  • The session object now records the grant type (GrantType) and always stores the client credential, ensuring the correct refresh or re-authentication flow can be determined later.

Token Request and Refresh Logic:

  • Updated New-ServiceNowSession to dynamically build the OAuth token request body based on the grant type, supporting both "password" (user credentials) and "client_credentials" (no user context) flows.
  • Improved token refresh logic in Get-ServiceNowAuth to distinguish between grant types: it re-authenticates using client credentials if no refresh token is available, or uses the refresh token if present (password grant). It also handles the absence of a refresh method gracefully.
  • Ensured the refresh token is only updated or stored when provided by the ServiceNow response, which only occurs in the password grant flow.

Bug Fixes and Minor Improvements:

  • Fixed a typo in the default parameter value for Invoke-RestMethod:TimeoutSec, ensuring correct timeout handling for REST calls.
  • Improved error messaging for failed token retrieval scenarios.


[Parameter(Mandatory, ParameterSetName = 'OAuth')]
[Parameter(Mandatory, ParameterSetName = 'OAuthProxy')]
[Parameter(Mandatory, ParameterSetName = 'OAuthClientCredential')]
Copy link
Collaborator

@gdbarron gdbarron Jan 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we'll need to add a OAuthClientCredentialProxy paramset for ClientCredential, Proxy, and ProxyCredential params.

@gdbarron
Copy link
Collaborator

This looks nice, thanks! I'll have to do some local testing, but on first glance I just had that one comment on the paramsets. Also, nice finds on those couple of typos!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants