{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40713,"path":"platform-security/authentication/use-facebook-based-sso.md","title":"Use Facebook-based Single Sign-On \\(SSO\\)","bundle":null,"doc_type":null,"release":"australia","body":"\n# Use Facebook-based Single Sign-On \\(SSO\\)\n\nLog in to your ServiceNow instance by using your Facebook credentials on the Facebook-based SSO.\n\n## Before you begin\n\nThe Facebook-based SSO is shipped along with your ServiceNow instance.\n\nYou can define the Identity Provider \\(Idp\\) configurations to the **OIDC\\_Facebook** IdP as your **Identity Providers**. For more information about Idp configurations, see [Configure a Facebook-based Single Sign-On \\(SSO\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/configure-facebook-based-sso.md).\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Multi-Provider SSO** &gt; **Identity Providers**.\n\n2.  Select **OIDC\\_Facebook**.\n\n3.  On the OIDC\\_Facebook page, specify the following fields:\n\n    **Note:**\n\n    -   Most of the fields are auto-populated when using the default IdP.\n    -   Details of the ServiceNow Homepage must be provided.\n    -   User-related details such as Client ID and Client Secret from Facebook must be provided within the IdP.\n<table id=\"table_gtj_4r3_jrb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of the OIDC IdP record. Enter `OIDC_Facebook`.\n\n</td></tr><tr><td>\n\nDefault\n\n</td><td>\n\nOption to set the OIDC IdP configuration as default.\n\n</td></tr><tr><td>\n\nOIDC Entity Profile\n\n</td><td>\n\nOAuth Entity Profile for the OIDC configuration. Enter `Facebook default_profile`.\n\n</td></tr><tr><td>\n\nExternal logout redirect\n\n</td><td>\n\nThe URL where the integration redirects users after they log out. Typically, this URL is the portal that is used for SSO. This field is automatically set to **external\\_logout\\_complete.do**. For example, `https://<yourinstance>.service-now.com/external_logout_complete.do`.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nOption to make the OIDC IdP configuration active.**Note:** This option can only be set to active after a successful test connection.\n\n</td></tr><tr><td>\n\nAuto Redirect IdP\n\n</td><td>\n\nOption to enable automatic redirection of the users to the login page of the identity provider.\n\n</td></tr><tr><td>\n\nServiceNow Homepage\n\n</td><td>\n\nThe URL of the login page that is used for authentication. This field is automatically set to your instance URL. The format of the URL is `https://<yourinstance>.service-now.com/navpage.do`\n\n</td></tr><tr><td>\n\nShow as Login option\n\n</td><td>\n\nOption to display the OIDC IdP as a login option on the login page. In this case, the login option appears as the **Login with Facebook** button.\n\n</td></tr><tr><td>\n\nSSO Label\n\n</td><td>\n\nLabel of the OIDC IdP displayed on the login page. This field appears only when **Show as Login option** is enabled.\n\n</td></tr><tr><td>\n\nLogo URL\n\n</td><td>\n\nPublicly available URL that contains the logo of the OIDC IdP provider. This field appears only when **Show as Login option** is enabled.\n\n</td></tr></tbody>\n</table>    \\[Omitted image \"oidc-facebook.png\"\\] Alt text: OIDC Facebook\n\n4.  Open the **User Provisioning** tab, and fill in the fields.\n\n    **Note:** You must configure the OIDC-related information such as Client ID and Client Secret of your users from Facebook.\n\n<table id=\"table_bfv_frd_4z\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nAutomatically provision users\n\n</td><td>\n\nOption to enable automatic user provisioning. This property creates a user in the instance User \\[sys\\_user\\] table when the user exists on the IdP but doesn’t exist in the User table.**Note:** You can choose to enable automatic user provisioning during user login. When automatic user provisioning is enabled, a user record is automatically created in the ServiceNow instance if that user record doesn’t exist.\n\n</td></tr><tr><td>\n\nProvision using\n\n</td><td>\n\nThe data source to use to transform to a ServiceNow user. Choices are as follows:-   **An ID Token**\n-   **User Info endpoint**\n-   **Both ID Token and User Info**\n Use the Lookup list to select the pre-defined data source template, then open the record to configure the Transforms table mapping.\n\n</td></tr><tr><td>\n\nProvision data source\n\n</td><td>\n\nThe ID token data source that is used for user provisioning.\n\n</td></tr><tr><td>\n\nUser Info Datasource\n\n</td><td>\n\nThe user info endpoint data source used for user provisioning. This field appears only when **User Info** or **Both ID Token and User Info** is selected from the **Provision using** field.\n\n</td></tr><tr><td>\n\nUpdate User on next login\n\n</td><td>\n\nOption to enable user updates during the next login.\n\n</td></tr><tr><td>\n\nUpdate User Interval Time \\(Seconds\\)\n\n</td><td>\n\nMinimum time interval \\(in seconds\\) to update a user record between subsequent logins. This field is automatically set to 3600 seconds. For example, after a user logs in, the user record will be updated after 3,600 seconds until the next login. This field is available only when the **Update User on next login** field is enabled.\n\n</td></tr><tr><td>\n\nUser roles applied to provisioned users\n\n</td><td>\n\nList of roles applied to the newly provisioned users.\n\n</td></tr></tbody>\n</table>5.  In the **OIDC Entity** tab, view and modify the OIDC client configuration and OIDC connect flow using the entity record.\n\n    For more information related to OIDC-based configuration, see [Configure an OAuth OIDC provider for accepting third-party token](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/add-OIDC-entity.md)\n\n6.  In the **OIDC Provider Configuration** tab, view and modify the well-know configuration URL of the OIDC IdP.\n\n7.  Open the **Advanced** tab, and fill in the fields.\n\n    |Property|Description|\n    |--------|-----------|\n    |Single Sign-On Script|The script that executes during Single Sign-On.|\n    |Logout Script|The script that executes after the user logs out.|\n\n    **Note:** Scripts are run during single sign-on and logout.\n\n8.  To enable and test the configuration, click **Active**.\n\n9.  To update the record, click **Update**.\n\n    The Facebook-based login option is displayed on the login form.\n\n10. When logging in on the login form, do the following:\n\n    1.  Select the Facebook option.\n\n    2.  To log in to the ServiceNow instance, specify your Facebook credentials.\n\n\n"}}