SSO OIDC - login - immediately logged out

[Detlef Biederma]

Hello

A very small number of users logged in by SSO into SN are logged out directly.

Hint: SSO Debug is enabled.

I have done a Test with PDI and SSO Circle:
- using "email" as "user_field" to identify the SSO user in SN
Test 1.
- add my SSO Circle User email to Abel.Tuter
- login using SSO (incognito Chrome)
- result:Abel.Tuter is logged in
Test 2.
- empty Abel.Tuters SN email
- login using SSO(incognito Chrome)
- result: redirect to "Logout successful"
syslog entry:
Error User: detlef.biedermann@capgemini.com not found SAML2"
Error *** Script: User: detlef.biedermann@capgemini.com not found: no thrown error com.glide.ui.ServletErrorListener

So I can see which Record for SN sys_user.email field was used.

On our Company environment we are usingOIDC
The Provider "user_field"is a new columnsys_user.u_guid(a unique number)

I have done the same 2 Tests like above:
Test 1:
- login using SSO(incognito Chrome)
- result:logged in
- syslog:I can see, what is send as"u_gid"
Test 2.
- change sys_user.u_guid(just one character)
- result:redirect to "Logout successful"
syslog entry:
Information guest userToLogin: failed_authentication *** MultiSSOv2
Information guest OIDC Request - No user found. *** Script
Information guest OIDC Request - getting login user using the Auth Code *** Script
Information guest User attempting to login using SSO ....OAuth Configuration *** MultiSSOv2

Problem: I do not see what is send as"u_gid"from SSO.What should I do to see what is send as "Auth Code"

I appreciate any help.

Sincerely Detlef Biedermann

[Ambuj Tripathi]

Hi @Detlef Biederma 

Good question — sounds like you're asking what user identifier the OIDC IdP sends to ServiceNow during login.

I've written a community article on debugging OIDC that covers exactly this — capturing the access token and ID token from the IdP's back-channel call.

Enable the debug properties per the article and follow the steps to print the tokens; that should answer your question directly:

https://www.servicenow.com/community/community-resources/debugging-oidc-single-sign-on-feature-in-se...

The user identifier from the IdP lives in the ID token — enable debug logs and add a log statement in OAuthUtil to print it.

Cheers!

[Vishal Jaswal]

Hello @Detlef Biederma 

Can you share:

1. Which OIDC provider you're using (Azure AD, Okta, Ping, Keycloak, custom)?
2. The name of the Script Include referenced in your OIDC IdP configuration?
3. Any existing entries you see in syslog related to "OIDC" during a login attempt?