Mapping users from OIDC data source

cbonitz
Mega Expert

We are trying to set up SSO via our company's internal website as a method to login to SN. We followed the documentation about setting up an an OIDC identity provider as follows:

  1. Created a new Identity Provider
  2. Provided the well known configuration URL

That's about as far as I can get based on the current documentation. I'd like to match up users based on email, and I'm pretty sure that needs to happen through the "User Info Datasource" field. However, trying to configure this has shown me the documentation could use a little more specificity for people like me (easily confused).

So here's the steps I could attempt until I got stuck:

  1. Create the data source
    find_real_file.pngfind_real_file.png
  2. Now that it has been made, open the data source record.
  3. Create a new Transform Map
  4. Attempt to map fields, but there's no "source fields" to choose fromfind_real_file.png
  5. I've tried using source script and logging the source variable via gs.info, but that doesn't show up in the logs.
  6. I've also tried checking "run script" on the transform and logging the source variable there as well, but again nothing shows in the logs.

I've spent all day searching and can't seem to find how I can map users via a property from the OIDC connection.

I see there are "OAuth enttiy scopes" that show the properties that come in that are shown in the well-known config file, but how do I specify a mapping between one of those and a field on the sys_user table?find_real_file.png

2 REPLIES 2

cbonitz
Mega Expert

One additional piece of info, we have SSO via Microsoft on our instance as well (this is on Dev). I successfully get the log in screen via our internal site, and once I log in, I'm directed to the MS 'My Apps' page. There is a SN icon on this page, but it's the link to the production site, rather than dev.

Might this have something to do with it? To be honest, I'm not sure how I'm getting directed to an MS page, as I've set all the other identity providers on this instance to inactive.

Kyryl Petruk1
Tera Expert

Hi!

To specify which field should be used for mapping you should go to your Identity Provider record > OIDC Provider Configuration > User Field

Transform map you'll need if you want to create the users "on the fly" if they don't already exist in ServiceNow.

More info here: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0778342

Kind regards,
Kyryl