Skip to tutorial content
Rate module Not yet rated

Credential Aliases and External Vaults

4 min read
On this page

In this lesson, you will learn:

  • What a credential alias is
  • What an external vault does
  • When to use one

🔁 Quick look back: Last time: Credential Order and Credential Affinity. You learned how order and affinity decide which credential is tried.

1 The Problem: Passwords Stored in Two Places Drift Apart

SNWR’s security team keeps passwords in a password vault. If Discovery also keeps a copy:

  • When the vault rotates a password, ServiceNow’s copy is wrong.
  • Scans fail until someone updates it.

🎯 The problem: Passwords stored in two places drift apart.

👉 The fix: Consider letting Discovery read passwords from the vault, and use aliases where patterns need a named credential.

Compare stored in ServiceNow vs external vault.
Figure 1. Two ways to hold Discovery passwords.

2 Aliases and vaults

Key term: Credential alias

A name that points to a credential. Patterns and spokes use the alias, so you can swap the credential without editing them.

Key term: External credential storage

The MID Server gets passwords from a vault at scan time, instead of from ServiceNow.

💡 Good to know: Need a refresher? See AppDev › Integrations › Authentication, Connections and Credentials for aliases in integrations.

3 When to use a vault

  • The client already uses a vault for service accounts.
  • Passwords rotate often.
  • Security wants one source of truth.

4 Project Clear View: How We Implemented It

📍 Situation: Farah asked whether Discovery could use SNWR’s vault.

🧭 Decision: Start with credentials in ServiceNow, and plan the vault for phase 2.

🛠️ Steps we took:

  1. Explained both options to Farah.
  2. Agreed that phase 1 keeps credentials in ServiceNow, with 90-day rotation.
  3. Added ‘external vault’ to the phase 2 list.
  4. Used aliases where the patterns expect them.

✅ What we verified:

  • Farah accepted the phase 1 approach.
  • The vault is on the next-steps list.

📁 Evidence: A decision note in the design document and the next-steps list.

5 Quick recap

  • An alias lets you swap a credential without editing patterns.
  • An external vault keeps one copy of each password.
  • The MID Server fetches from the vault at scan time.
  • Vaults suit clients who rotate passwords often.

6 Check yourself

Think of your answer first. Then tap to check.

1 What does a credential alias do? Show answer

It’s a name that points to a credential, so you can swap it without editing patterns.

2 How does an external vault work with Discovery? Show answer

The MID Server fetches passwords from the vault at scan time.

3 What did SNWR decide for phase 1? Show answer

Keep credentials in ServiceNow, and plan the vault for phase 2.

Nice work! You know where Discovery passwords can live. 🎉
Next up: Nmap Credential-less Discovery

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.