ServiceNow as OAuth Provider: How to get an ID Token

[Lucas Pereira1]

Hello folks!

I'm tring to use serviceNow as an ID Provider for my legacy systems but haven't found a way to generate an ID Token.

Use Case: A customer contact (CSM) tries to access a legacy system, gets redirected to ServiceNow login, authorizes the integrated login and gets redirected back to legacy system which process the ID Token to find out who is the users and so he gets logged in.  

We managed to use the OAuth authorization code grant flow to get Acess Token and Refresh Token. 

Access Token and Refresh token does not have any user info or ID. (OAuth)

ServiceNow implements a ID Token concept? How can we do this? (OpenID like)

Help @Chuck Tomasi 

Thanks!!

[Lucas Pereira1 · Accepted solution]

Hi folks! 

I was able to advance on this topic, let me share:

• OpenID Connect is more like a "superset" of OAuth
• ServiceNow does not implement OIDC as Identity Provider

Problem:

• Using OAuth authorization code grant flow  you can issue an Authorization Token, which means that bearer can act on servicenow on behalf of the user. This is not what we intend with SSO - possible security issue.

Solution (so far):

I created a set of tools to simulate an OpenID like flow.

• Script include: Base64url encryption, Token Generation, Token validation.
• Scripted Rest API: Act as profile endpoint for Service Application. 
• Portal Page and Widget: Contact redirect to this page, token is generated, appended to Service Application URL and user gets redirected

Flow:

1. User clicks on the 3rd party application link in the portal menu which points to csm_sso_redirect custom page
2. A custom widget on that page checks if contact is logged in, calls the script include to Generate a Base64url encoded token with format: {"iat":gdtNow.getNumericValue(),"token":session_id}
3. User gets redirected to the 3rd party application with token appended in the URL
4. Application retrieves the token and calls via backend the scripted rest api using its service credentials
5. Scripted REST Api calls the script include to validate token. Token is valid if:
6. 1. Format is valid
   2. Issued in less than 5 minutes
   3. Session ID exists in sp_log
   4. There is a record of csm_sso_redirect page visit (sp_log) for that particular session_id in less than 5 minutes ago.
7. If token is valid, REST API returns Profile Data (Full name, username and email)
8. 3rd party application uses the profile data to authenticate the user locally. 

Evolution:

• I think we can use ServiceNow JWT library to generate valid ID Tokens, something like was made here: JWT Token Signing - Live Coding Happy Hour for 2021-01-08  (thanks @Andrew Barnes - AJB !) 

Had the same problem? This helped? Mark helpful!! 🙂

[ServiceNow Tec2]

This has been resolved by ServiceNow Technical Support. Please refer to KB0778194 for more information.

[ServiceNow Tec2]

This has been resolved by ServiceNow Technical Support. Please refer to KB0693393 (HI login required) for more information.