| \n\n**Using a metadata descriptor URL**\n\n | \n\nSelect the URL check box and enter the URL of the IdP that you're using.\n\n |
| \n\n**Using metadata descriptor XML file**\n\n | \n\nSelect the XML check box and paste in the XML data generated from the IdP you're using.\n\n |
| \n\n**Entering metadata manually**\n\n | \n\nClose the pop-up window and manually enter the data in the property fields.\n\n |
| \n\nProperty\n\n | \n\nRequired\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nName\n\n | \n\nYes\n\n | \n\nEnter the name for the IdP. This IdP is the auto redirect sys id.\n\n |
| \n\nActive\n\n | \n\nYes\n\n | \n\nActive should be set to true for the IdP to be used for authentication.**Note:** The option to set this property only comes after a successful test connection.\n\n |
| \n\nDefault\n\n | \n\nNo\n\n | \n\nThe Auto Redirect IdP, formerly known as the Primary IdP, automatically redirects users to access the base instance URL. This property sets this IdP configuration as the default.\n\n |
| \n\nAuto Redirect IdP\n\n | \n\nNo\n\n | \n\nSets this IdP configuration as the Auto Redirect IdP.**Note:** If you make a new Auto Redirect IdP configuration active, the**glide\\_sso\\_id**cookie updates with the new Auto Redirect IdP. The **glide.authenticate.sso.update.idp.cookie** system property, automatically enabled, controls this feature.\n\n |
| \n\nIdentity Provider URL\n\n | \n\nYes\n\n | \n\nEnter the URL to your IdP. Each IdP URL must be unique.\n\n |
| \n\nIdentity Provider's AuthnRequest\n\n | \n\nYes\n\n | \n\nEnter the URL to the HTTP-Redirect binding obtained from the SingleSignOnService element.\n\n |
| \n\nIdentity Provider's SingleLogoutRequest\n\n | \n\nNo\n\n | \n\nEnter the URL obtained from the SingleLogoutService element.\n\n |
| \n\nServiceNow Homepage\n\n | \n\nYes\n\n | \n\nEnter the URL, including login page, of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/navpage.do\n\n |
| \n\nEntity ID/Issuer\n\n | \n\nYes\n\n | \n\nEnter the base URL, excluding login page. of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/\n\n |
| \n\nAudience URI\n\n | \n\nYes\n\n | \n\nEnter the base URL, excluding login page. of the instance for which the IdP authenticates. For example: https://yourinstance.service-now.com/\n\n |
| \n\nNameID Policy\n\n | \n\nYes\n\n | \n\nEnter the value of the NameIDFormat element the integration uses.\n\n |
| \n\nExternal logout redirect\n\n | \n\nNo\n\n | \n\nEnter the URL where the integration redirects users after they log out.\n\n |
| \n\nFailed Requirement Redirect\n\n | \n\nNo\n\n | \n\nEnter the URL for redirecting failed authentication requests. By default, this is the URL endpoint of an error page or logout page configured in the IdP. You can populate this value in the glide.authenticate.failed\\_requirement\\_redirect field.\n\n |
| \n\nClient Type\n\n | \n\nNo\n\n | \n\nChoose the client type, based on the type of your client. Options:**Iframe Embedded**.**Note:** If client type field is required for your configuration, you can edit the form and add the field. To know more, see [Configure client type for OAuth and SSO records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/client-type.md).\n\n |
| \n\nProperty\n\n | \n\nDescription\n\n |
|---|---|
| \n\nAuto Provisioning User\n\n | \n\nEnable automatic user provisioning, creates the users when user doesn't exists in the instance User Table based on the information provided by the IdP.\n\n |
| \n\nUpdate User Record Upon Each Login\n\n | \n\nUpdates user information in the instance User table with the information in the IdP each time the user logs in using SAML.\n\n |
| \n\nUser groups applied to provisioned users\n\n | \n\nSpecifies the user groups that are automatically assigned to users created through SAML user provisioning.\n\n When a user is provisioned from the SAML identity provider, the instance adds the user to each group listed in this field, so provisioned users receive consistent group membership — and any roles or access those groups grant — without manual assignment.\n\n |
| \n\nProperty\n\n | \n\nDescription\n\n |
|---|---|
| \n\nUser Field\n\n | \n\nEnter the field on the User table that contains the value the IdP requires to identify the user. This is a unique id as part of the response. For example, user name, employee id, and so on. In the sys user table, this unique id is matched with the user details.\n\n |
| \n\nNameID Attribute\n\n | \n\nLeave this field empty unless you configure a new NameID policy. If you configure a new policy, the system requires the User table it must use to identify the user logging in. The system matches the NameID token to the name of that User table field here.\n\n |
| \n\nCreate AuthnContextClass\n\n | \n\nSelect the check box to specify a particular context class such as Password Protected Transport. If the check box is cleared, the IdP selects the most appropriate context class.\n\n |
| \n\nAuthnContextClassRef Method\n\n | \n\nEnter the URN of the login mechanism you want the IdP to use to authenticate users.\n\n |
| \n\nForce AuthnRequest\n\n | \n\nSelect the check box to force AuthnRequests to occur.\n\n |
| \n\nIs Passive AuthnRequest\n\n | \n\nSelect the check box if the AuthnRequest is passive.\n\n |
| \n\nSingle Sign-On Script\n\n | \n\nSelect the Single Sign-On script. The default is MultiSSOV2\\_SAML2\\_custom.\n\n |
| \n\nSign Logout Response\n\n | \n\nEnter the logout response details in this field.\n\n |
| \n\nClock Skew\n\n | \n\nEnter the number of seconds between the two attributes that make up the SAMLResponse nonce. The default is 60. A valid SAMLResponse must fall between the notBefore and notOnOrAfter date-time values. See Sample SAML 2 Response with the SubjectConfirmation and SubjectConfirmationData Elements and Sample SAML 2 Response with the AudienceRestrictions and Audience Elements for a sample SAMLResponse message.\n\n |
| \n\nProtocol Binding for the IDP's SingleLogoutReuqest\n\n | \n\nEnter one of the supported values listed in the Binding attribute from the SingleLogoutService element.\n\n |
| \n\nMetadata URL from which IDP properties are imported\n\n | \n\nThe IdP properties import from this URL. If set, it enables the automatic import of SAML certificate from the IdP if the previous certificate has expired. **Note:** If you upgrade from SAML2 Update 1 to Multi-Provider SSO or if you manually set up your SSO connection, the IdP Metadata URL does not automatically populate.\n\n |
| \n\nRequest\n\n | \n\nAn unique id as part of request, the id can be user name, employee id, and so on.**Note:** Both redirect and post binding is supported for request. The option to set this field only appears after a successful test connection. For more information see, [Test IdP connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_TestIdPConnections.md).\n\n |
| \n\nResponse\n\n | \n\nAn unique id as part of response, the id can be user name, employee id, and so on. **Note:** Both redirect and post binding is supported for response. The option to set this field only appears after a successful test connection. For more information see, [Test IdP connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_TestIdPConnections.md).\n\n |
| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nContinuous Authentication Configured\n\n | \n\nSelect the check-box to set the configuration active.\n\n |
| \n\nContinuous Authentication Consumer URL\n\n | \n\nProvide the Consumer URL from the Identity Provider.\n\n |
| \n\nContinuous Authentication Script\n\n | \n\nSelect the look-up icon to choose the script provided from the platform. In this configuration, for SAML: **MultiSSOv2\\_SAML2\\_ContinuousAuth\\_custom**\n\n |