Basic Auth Restriction Tracking Active

This page describes the nowisor-basic-auth-restriction-inactive check (new in pack v1.1.0). It audits glide.authenticate.basic_auth.restriction.active and fires when Basic Auth API restriction tracking is not turned on — or reports not_applicable when the feature is not present on the instance.

What this finding means

ServiceNow's Basic Auth API restriction feature (KB3025707 / KB3055080) records which interactive accounts authenticate to inbound APIs using single-factor Basic Auth, so you can triage them before access is enforced. This check reads glide.authenticate.basic_auth.restriction.active:

• false — tracking is off. The platform is not building the inventory of hybrid (UI-login + Basic-Auth-API) accounts, so you are blind to the exposure ahead of enforcement. Finding (Medium).
• not registered — the property is absent, which usually means the instance predates the feature. The check reports not_applicable / feature_not_present (informational) rather than asserting a failure, and recommends planning for the rollout.
• true — tracking is on; no finding.

Why it matters

You cannot remediate hybrid Basic Auth accounts you cannot see. Tracking is the non-blocking first phase: it populates sys_user_basic_auth_exception so the other Basic Auth checks (undecided accounts, role-without-WSAO) have data to work with. Leaving it off means walking into enforcement blind — either a surprise outage for integrations that get blocked, or a persistent MFA bypass for accounts nobody triaged.

How to remediate

Set glide.authenticate.basic_auth.restriction.active = true (System Properties) to begin tracking. This is non-blocking — it records, it does not block — so it is safe to enable in production. Then review the populated exceptions and proceed to enforcement posture.

Verified against ServiceNow Zurich Patch 6 (dev265147), 2026-06-11.