Paris Feature: Google OpenID Connect (OIDC) Configuration for ServiceNow Single Sign On (SSO)

AbhishekGardade
Tera Sage
‎08-05-2020 01:07 PM

With Paris release, you can now create or update an OpenID Connect (OIDC) configuration using the Multi-Provider SSO plugin. If you have client ID, client secret, and well-known configuration URL of the identity providers like Google, Okta and you can directly import the OIDC configuration for SSO. After completing the configuration, users can log in to ServiceNow applications using Google.

In this blog post, I will explain how we can Login ServiceNow using Google sign in.

Prerequisites :

  • Need to have Client ID, Client Secret, and Well-known configuration URL from Google IdP. Please check out the attached document to get these details.
  • Activate Multi-Provider SSO plugin from Your Instance (ServiceNow Paris).

Once we have Client ID, Client Secret and Well-known configuration URL from Google, we can ready to configure our ServiceNow Instance.

I have provided you the step by step procedure to configure instance for enable for Sign in with google.

Steps to do :

  1. Install below mentioned ServiceNow Plugin from by Navigating to System Applications > All Available Applications > All
    • Multiple Provider Single Sign-On Installer (com.snc.integration.sso.multi.installer)
    • e-Signature plugin (com.glide.e_signature_approvals)
  2. Now configure Multi-Provider SSO properties:find_real_file.png
  3. In order to configure Identity provider(Google), Navigate to Multi-Provider SSO> Identity Providers-> click New > OpenID Connect.
  4. You need to fill below information.
  5. Once you click on Import, it will directly import an OIDC configuration available and you will be redirected to the new Identity Provider created.
  6. You will see below form. find_real_file.png
  7. Make sure you configure below things on OIDC above form
    • ServiceNow Homepage: This should be same as Authorized Redirect URLs which you have configured in Google developers console
    • Show as Login option: TRUE
    • SSO label: Google (this will be displayed on your login screen)
    • Logo URL: Provide URL in case you want to show Icon
  8. Make sure you have email available in ServiceNow user profile in order to login.
  9. Finally, we are ready to Sign in with Google.
  10. Once you provide your Credentials, you will be redirected to ServiceNow Instance Homepage.

       find_real_file.png              find_real_file.png

That's it for now!!!!  There are many things we can configure on it. For in-depth knowledge, please have a look at the release notes and ServiceNow Documentations.

Thanks for reading and do comment with your suggestion and improvements. If I've missed something, please let me know so I can get it added .

Hope you will find it as helpful. Feel free to bookmark this post or mark it helpful..
Cheers,
Abhishek Gardade

Google OpenID Connect (OIDC) Configuration.docx
Preview file
53 KB
Preview file
21 KB
Preview file
62 KB
Preview file
62 KB
Preview file
13 KB
Google OpenID Connect (OIDC) Configuration.docx
Comments
Tushar Bhakre
Tera Contributor
‎08-28-2020 12:35 AM
‎08-28-2020 12:35 AM

Hello Abhishek ,

I have configured the steps you mentioned. But I am getting below error after clicking on -

find_real_file.png

Do you know you you resolved it ?

AbhishekGardade
Tera Sage
‎08-28-2020 01:02 AM
‎08-28-2020 01:02 AM

Hello Tushar,

The issue is with your Authorized redirect URIs or ServiceNow Homepage URL from Google developer console. 

find_real_file.png        find_real_file.png

By default, When you are configuring Identity provider, your Servicenow Homepage URL is set to https://dev60969.service-now.com/navpage.do .

So either you can update the URL on ServiceNow Side or update the URL on Google Console. Make sure both URL should be same.

-Thank you

SW7
Tera Guru
‎01-12-2021 01:19 AM
‎01-12-2021 01:19 AM

Abhishek,

Great write up piece on using google SSO with OIDC. I setup as per the instructions and everything worked well on the first day, all users were able to use Google SSO, however a day later no one could use Google SSO, its actually reporting a 404 error (The requested url was not found on the server)

I have logged a ticket with ServiceNow, however I am wondering if this issue is because I am just a normal account user that has setup a project in Google Console and wondering if I need a super user/admin account on google console?

OR....does the domain need to be verified?

Have you come across this before?

Many thanks

Steve

 

 

 

 

AbhishekGardade
Tera Sage
‎02-07-2021 11:59 PM
‎02-07-2021 11:59 PM

Hello Steve,

I didn't observed such behavior and can still able to login with no errors. Its good to get domain verified.

I am not sure what causes it but you may check if URL was changed or not. You can check your Authorized redirect URIs or ServiceNow Homepage URL from Google developer console.

Thank you,

Abhishek Gardade

Aviv S_
Tera Contributor
‎07-01-2021 10:23 AM
‎07-01-2021 10:23 AM

Hi

I'm getting "Logout successful".

Where can I see how actually Snow trying to fetch the user from the sys_user from the IDP and the request details it sending back to the instance.

This is not Google IDP but same steps.

Can you advise?

Niharika Raj
Kilo Guru
‎10-07-2021 07:49 AM
‎10-07-2021 07:49 AM

Hi Abhishek,

I followed the same steps that you provided for a client's OIDC SSO setup (not Google) using the customer's client ID, client secret and the well-known URL. However, I am getting the below error:

find_real_file.png

What could be the possible issue here?

Regards,

Niharika