{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40489,"path":"platform-security/authentication/configure-servicenow.md","title":"Configure ServiceNow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure ServiceNow\n\nConfigure ServiceNow with Azure AD details to use SSO.\n\n## Before you begin\n\nPlugin: `Integration - Multiple Provider single sign-on Installer`\n\nEnable the Multi Provider SSO properties:\n\n- - Select **Enable multiple provider SSO**.\n- Select **Enable Auto Importing of users from all identity providers into the user table**.\n- Select **Enable debug logging for the multiple provider SSO integration**.\n- Enter **email**, The field on the user table that.….\n\nRole required: admin\n\n## Procedure\n\n1. Navigate to **All** > **Multi-Provider SSO** > **Identity Providers**.\n\n2. On the Identity Providers page, select **New**.\n\n3. On the Identity Providers windows, select **SAML**.\n\n4. On the Import Identity Provider Metadata, you can either:\n\n - **URL**: App Federation Metadata URL to auto-populate the details on the Identity Provider configuration page.\n - **Import**: Import the XML to import the details on the Identity Provider configuration page.\n5. Right click on the top of the screen, click **Copy sys\\_id**, and use this value to the **Sign on URL** in **Basic SAML Configuration** section.\n\n6. On the form, fill in the fields.\n\n\n
\n\nProperty\n\n\n\nRequired\n\n\n\nDescription\n\n
\n\nName\n\n\n\nYes\n\n\n\nName for the IdP. This IdP is the auto redirect sys id.\n\n
\n\nActive\n\n\n\nYes\n\n\n\nActive should be set to true for the IdP to be used for authentication.**Note:** The option to set this property only comes after a successful test connection.\n\n
\n\nDefault\n\n\n\nNo\n\n\n\nAuto Redirect IdP, formerly known as the Primary IdP, automatically redirects users to access the base instance URL. This property sets this IdP configuration as the default.\n\n
\n\nAuto Redirect IdP\n\n\n\nNo\n\n\n\nIdP configuration that you can set as the Auto Redirect IdP.**Note:** If you make a new Auto Redirect IdP configuration active, the**glide\\_sso\\_id** cookie updates with the new Auto Redirect IdP. The **glide.authenticate.sso.update.idp.cookie** system property, automatically enabled, controls this feature.\n\n
\n\nIdentity Provider URL\n\n\n\nYes\n\n\n\nURL to your IdP. Each IdP URL must be unique.\n\n
\n\nIdentity Provider's AuthnRequest\n\n\n\nYes\n\n\n\nURL to the HTTP-Redirect binding obtained from the SingleSignOnService element.\n\n
\n\nIdentity Provider's SingleLogoutRequest\n\n\n\nNo\n\n\n\nURL obtained from the SingleLogoutService element.\n\n
\n\nServiceNow Homepage\n\n\n\nYes\n\n\n\nURL, including the login page, of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/navpage.do\n\n
\n\nEntity ID/Issuer\n\n\n\nYes\n\n\n\nBase URL, excluding the login page of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/\n\n
\n\nAudience URI\n\n\n\nYes\n\n\n\nBase URL, excluding the login page of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/\n\n
\n\nNameID Policy\n\n\n\nYes\n\n\n\nValue of the NameIDFormat element the integration uses.\n\n
\n\nExternal logout redirect\n\n\n\nNo\n\n\n\nURL where the integration redirects users after they log out.\n\n
\n\nFailed Requirement Redirect\n\n\n\nNo\n\n\n\nURL for redirecting failed authentication requests. By default, this is the URL endpoint of an error page or logout page configured in the IdP. You can populate this value in the glide.authenticate.failed\\_requirement\\_redirect field.\n\n
7. Encryption And Signing tab\n\n **Note:** Use your own certificates for the encryption and signing.\n\n \\[Omitted image \"encryption-signing.png\"\\] Alt text: Encryption and Signing tab\n\n |Property|Description|\n |--------|-----------|\n |Signing/Encryption Key Alias|Alias of the key entry stored in [SAML 2.0 SP Keystore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_CreatingAServiceProviderKeyStore.md).|\n |Signing Key Password|Password of the key entry stored in [SAML 2.0 SP Keystore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_CreatingAServiceProviderKeyStore.md).|\n |Encrypt Assertion|Check box to encrypt the assertion in the SAML response. The metadata generated for the IDP embeds the x509 certificate, which the IDP uses to encrypt the assertion in the SAML response that it generates.|\n |Signing Signature Algorithm|URL that points to the SAML 2.0 Identity Provider AuthnRequest Consumer for eSignature Authentication.|\n |Sign AuthnRequest|Check box to enable the IdP single-sign on service to receive a signed AuthnRequest.|\n |Sign LogoutRequest|Check box to enable the IdP single-sign on service to receive a signed LogoutRequest.|\n\n8. User Provisioning tab\n\n \\[Omitted image \"user-provisioning.png\"\\] Alt text: User Provisioning Tab.\n\n |Property|Description|\n |--------|-----------|\n |Auto Provisioning User|Automatic user provisioning, creates the users when user doesn't exists in the instance User Table based on the information provided by the IdP.|\n |Update User Record Upon Each Login|Update to user information in the instance User table with the information in the IdP each time that the user logs in using SAML.|\n\n9. Advanced tab\n\n \\[Omitted image \"advanced.png\"\\] Alt text: Advanced tab\n\n\n
\n\nProperty\n\n\n\nDescription\n\n
\n\nUser Field\n\n\n\nField on the User table that contains the value that the IdP requires to identify the user. This unique id is part of the response. For example, a user name, employee id, and so on. In the sys user table, this unique id is matched with the user details.\n\n
\n\nNameID Attribute\n\n\n\nField that you leave empty unless you configure a new NameID policy. If you configure a new policy, the system requires the User table it must use to identify the user logging in. The system matches the NameID token to the name of that User table field.\n\n
\n\nCreate AuthnContextClass\n\n\n\nCheck box to specify a particular context class such as Password Protected Transport. If the check box is cleared, the IdP selects the most appropriate context class.\n\n
\n\nAuthnContextClassRef Method\n\n\n\nURN of the login mechanism that you want the IdP to use to authenticate users.\n\n
\n\nForce AuthnRequest\n\n\n\nCheck box to force AuthnRequests to occur.\n\n
\n\nIs Passive AuthnRequest\n\n\n\nCheck box if the AuthnRequest is passive.\n\n
\n\nSingle Sign-On Script\n\n\n\nSingle Sign-On script. The default is MultiSSOV2\\_SAML2\\_custom.\n\n
\n\nSign Logout Response\n\n\n\nLogout response details in this field.\n\n
\n\nClock Skew\n\n\n\nNnumber of seconds between the two attributes that make up the SAMLResponse nonce. The default is 60. A valid SAMLResponse must fall between the notBefore and notOnOrAfter date-time values. See Sample SAML 2 Response with the SubjectConfirmation and SubjectConfirmationData Elements and Sample SAML 2 Response with the AudienceRestrictions and Audience Elements for a sample SAMLResponse message.\n\n
\n\nProtocol Binding for the IDP's SingleLogoutReuqest\n\n\n\nOne of the supported values listed in the Binding attribute from the SingleLogoutService element.\n\n
\n\nMetadata URL from which IDP properties are imported\n\n\n\nIdP properties import from this URL. If set, it enables the automatic import of SAML certificate from the IdP if the previous certificate has expired. **Note:** If you upgrade from SAML2 Update 1 to Multi-Provider SSO or if you manually set up your SSO connection, the IdP Metadata URL does not automatically populate.\n\n
\n\nRequest\n\n\n\nUnique id as part of request. The id can be a user name, employee id, and so on.**Note:** Both redirect and post binding is supported for request. The option to set this field only appears after a successful test connection. For more information, see [Test IdP connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_TestIdPConnections.md).\n\n
\n\nResponse\n\n\n\nUnique id as part of response. The id can be a user name, employee id, and so on. **Note:** Both redirect and post binding is supported for response. The option to set this field only appears after a successful test connection. For more information, see [Test IdP connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_TestIdPConnections.md).\n\n
10. Select **Test Connection** at the upper-right corner of the page.\n\n11. Enter your credentials.\n\n The SSO Logout Test Results are displayed.\n\n12. Select **Activate** to activate the configuration.\n\n\n"}}