SSO Configuration

[Navn1]

Hi Everyone,

Can somebody help me to understand the SAML parameters in the attached screenshot. Have gone through the snow wiki, but its too confusing.

Thanks in advance

[Rajesh Mushke]

Hey Kaur,

Tell me at what point you are getting confusion.

Might be helpful to you.

SAML SSO integration:

The Single Sign-On module provides a simplified user interface to set up SAML integration for the exchange of user authentication and authorization data. The information is exchanged among an identity provider (IdP), a service provider (SP), and a principal (user) on a web browser.

The identity provider can be any SSO service offering SAML authentication services. The service provider is an Express instance. When the user attempts to authenticate, the IdP and the SP exchange SAML protocol messages through the user's browser as described in the following process.

• The SP sends a SAML authentication request message to the IdP, asking to authenticate the user.
• The IdP typically asks the user for a user name and password, and if the password is correct, the IdP sends back a SAML authentication response stating that the user logged in successfully at the IdP.
• The authenticated user is logged in to the instance.

Login (AuthnRequest)

When you define your IdP, you specify the URLs to its protocol messages. The message flow is described in more detail in the following sections.

1. The principal requests a target resource at the service provider, such as https://instance.service-now.com/. The instance checks the request to see if the user has already validated with the IdP and, if so, remaining steps are skipped.
2. The instance constructs an AuthnRequest to send to the IdP. The instance also constructs and sends a RelayState URL parameter value, which is an opaque reference to state information maintained at the service provider. The integration encodes the authorization request and sends it to the SSO service.The SSO service processes the authorization request and performs a security check. If the user does not have a valid security context, the IdP identifies the user by prompting for login credentials. If the user is already logged in, the IdP responds appropriately.
3. After collecting the required login credentials, the SSO service validates the request and responds with an encoded XHTML form.
4. The instance decodes the form and compares the user information with records in the User table. The session ID is extracted so it can be used in the logout request.

Logout (SingleLogoutRequest)

When the user clicks the Logout button, the instance executes the logout script. The logout script posts the request to the logout request service at the IdP. The user logs out of the IdP, and the IdP redirects back to the instance login page.

IdP certificate

The IdP also provides a certificate that determines where the certificate metadata resides when creating the local IdP.

Troubleshooting SAML and SSO

There are two knowledge base articles published in HI that can help you troubleshoot setup issues.

• Troubleshooting SAML or SSO issues in ServiceNow
• Common SAML 2.0 errors and solutions

Please Refer:

https://express.servicenow.com/support/documentation/saml-integration-exp/

SAML 2.0

[christopher_cox]

Many of the settings in your screen shot will be populated as soon as you load the metadata from the identity provider.  

I suggest loading the meta then following up to this post with more specific questions.