Zscaler-ServiceNow integration issue: "User <user> is not found"

[GlenW]

I am using this Zscaler guide to integrate ZIA and ServiceNow:

https://help.zscaler.com/downloads/zscaler-technology-partners/data/zscaler-and-servicenow-deploymen...

On page 27, step 4, I was not able to perform

b. Select Set as Auto Redirect IdP.

because the "Set as Auto Redirect IdP" option does not appear in my ServiceNow instance (Tokyo).

So I did the steps in section "Configure Redirect on the Identity Provider" (pages 30-33).

When I go to the Identity Provider I created (see image "ServiceNow Zscaler Identity Provider.jpg") and clicked Test Connection I get an error that says:

User glen.winemiller@domain is not found
Ensure that the user you are trying the test connection with is present in the system.
Ensure that 'User Field' property value corresponds to the value set in the IDP returned through 'Subject NameID' in the response.

Azure AD is the IDP (identity provider) used by Zscaler for authentication.

My username in Azure AD is 'glen.winemiller@domain' (looks like an email address).
My username in ServiceNow is 'glen.winemiller' (does not look like an email address).

As can be seen in the identity provider image:

NameID Policy: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Advanced / User Field: email

The SAML attribute being sent by Azure ID is:

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":["glen.winemiller@domain"]

It seems the error "User glen.winemiller@domain is not found" might be due to ServiceNow not being able to correlate the SAML "name" attribute value (glen.winemiller@domain) with my ServiceNow username (glen.winemiller).

If this is true, how can I configure ServiceNow to use the SAML "name" attribute (which has been authenticated by Azure AD) as a surrogate for my ServiceNow username to allow access to ServiceNow?

Since my ServiceNow username (glen.winemiller) is different from my Azure AD username (glen.winemiller@domain), do I need to somehow map my ServiceNow username to my Azure AD username (or vice versa)?

[Ratnakar7]

Hi @GlenW ,

You need to ensure that ServiceNow can correlate the SAML attribute value from Azure AD with your ServiceNow username. Here are the steps you can follow:

1. Go to the Azure AD application configuration in ServiceNow.
2. In the "SAML 2.0 Identity Provider Configuration" section, locate the "Advanced -> User Field" property.
3. Change the value of this property to match the SAML attribute that contains the username from Azure AD. In your case, it should be "name" since the SAML attribute is "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name".
4. Save the changes.

Thanks,

Ratnakar

[GlenW]

Thank you for replying. I changed the User Field from "email" to "name," but unfortunately I still get the user not found error when I test connectivity. Please see the attached images. Note that, for my use case, the SNOW identity provider is Zscaler, which in turn is configured to use Azure AD to authenticate a user.