SAML Azure Redirect URL

[scottangehr]

Hey team

Looking for a little guidance. We just went live with SSO (Azure SAML) and a request was brought up to fix the redirect if a user has it bookmarked or goes to the URL directly.

So if a user goes directly to https://instance.service-now.com, it redirects to navpage.do and goes to the login screen. I've been reading through KB0786071 and need to know where to change to https://instance.service-now.com/login_with_sso.do?glide_sso_id=<sys_id of the sso configuration>?

We want it to redirect to the Azure login page.

Any help would be greatly appreciated!

TY,
Scott

[ersureshbe · Accepted solution]

Hi,

The following steps you should to enable the SSO in Service Now. 

Navigate to Multi-Provider SSO -> Identity providers

Click on ‘Generate Metadata’.

Share the generated metadata xml with Azure.

Configure Encryption and Signing (SAML) properties

Navigate to Multi-Provider SSO -> Identity providers -> Encryption And Signing

Set the properties as follows:

Signing/Encryption Key Alias: ‘saml2sp’

Signing/Encryption Key Password: ‘saml2sp’

Signing Signature Algorithm: ‘http://www.w3.org/2001/04/xmldsig-more#rsa-sha256’ // Check the Azure supporting algorithm.

Navigate to Multi-Provider SSO -> Identity providers -> User Provisioning

Enable property ‘Auto Provisioning User’

Enable property ‘Update User record upon Each Login’

Configure saml2 keystore in System properties

Navigate to System properties

Select ‘glide.authenticate.sso.saml2.keystore’

Update the value for this property with the ‘sys_id’ of the ‘SAML 2.0 Keystore_Key2048_SHA256_FIPS’ certificate  //Check Azure support 256 or different?

This step ensures proper SAML keystore is used for SAML communication in SSO.

Configure Landing page users based on role

To land the users to the right url, implement the following steps

Implement a ‘Script Include’ which redirects the request to appropriate url. It should provide 2 functionalities ‘getFirstPageUrl’ and ‘getLoginPageUrl’.

Configure the system property ‘glide.entry.first.page.script’ to call the functionality ‘getFirstPageUrl’ from the above Script Include.

Configure the system property ‘glide.entry.page.script’ to call the functionality ‘getLoginURL’ from the above Script Include.

You must check the highlighted field and configured with correct AZure URL or not.

Please mark as correct answer if it helped.

Regards,

Suresh.

[scottangehr]

Good day Suresh

Thank you for this guidance. Quick question. sysid for the Keystore...is that of the certificate that we are using or the OOB provided by SN?

Thanks again
Scott

[ersureshbe]

Yes you are correct. Regards, Suresh.