Security Best Practice regarding OAuth 2.0 Resource Owner Password Credential typeSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } What is OAuth 2.0 Resource Owner Password Credential grant type? The resource owner password credentials (i.e., username and password) can be used directly as an authorization grant to obtain an access token. The credentials should only be used when there is a high degree of trust between the resource owner and the client (e.g., the client is part of the device operating system or a highly privileged application), and when other authorization grant types are not available (such as an authorization code). Even though this grant type requires direct client access to the resource owner credentials, the resource owner credentials are used for a single request and are exchanged for an access token. This grant type can eliminate the need for the client to store the resource owner credentials for future use, by exchanging the credentials with a long-lived access token or refresh token. ServiceNow supports the OAuth 2.0 grant type known as Resource Owner Password Credential (ROPC) as discussed in our product documentation:https://www.servicenow.com/docs/r/platform-security/authentication/configure-an-oauth-resource-owner-password-credential-grant.htmlhttps://www.servicenow.com/docs/r/platform-security/authentication/resource-owner-password-credential-workflow.htmlhttps://www.servicenow.com/docs/r/platform-security/authentication/resource-owner-password-grant.htmlServiceNow provides a number of plugin/app integration products that may use OAuth to implement authentication and authorization between API endpoints. In some cases customers may choose to use OAuth ROPC grant type but instead they should take into account security best practices referenced in the Related Links. These references essentially state that ROPC should not be used. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } https://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-disable-resource-owner-password-credentials-ropc-in-oauth-2-token-grants.html https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2251003 #note available only to NOW personnel and Partnershttps://datatracker.ietf.org/doc/html/rfc6749#section-1.3.3https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.4https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/05-Testing_for_OAuth_Weaknesseshttps://docs.verify.ibm.com/ibm-security-verify-access/docs/tasks-oauth2bestpractice#avoid-using-the-ropc-flow