question Re: SSO issue after adding X.509 Certificates in ITSM forum

SSO issue after adding X.509 Certificates

Alok Sahu — Wed, 23 Sep 2015 13:10:04 GMT

We are using ServiceNow Fuji version after adding JAVA Key Store certificate in X.509 Certificate our SSO fails .

Error :

----------------------------------------------------------------------------------------

There was a problem accessing the site. Try to browse to the site again.

If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

Reference number: 24441569-5894-48b0-8c2a-abfc2134b0f1

----------------------------------------------------------------------------------------

Is this a Bug or Know issue in Fuji ?

Any work around of fix this issue.

Please help.

Re: SSO issue after adding X.509 Certificates

Michael Fry1 — Thu, 24 Sep 2015 01:12:40 GMT

Make sure you only have 1 certificate active. More than 1 might cause problems.

Re: SSO issue after adding X.509 Certificates

Alok Sahu — Thu, 24 Sep 2015 05:25:03 GMT

We need certificate to authenticate third-party SSL integration.

How can ServiceNow restrict itself will only one active certificate ?

ServiceNow only supports one application/system integration via certificates ?

Re: SSO issue after adding X.509 Certificates

tony_barratt — Thu, 24 Sep 2015 05:32:18 GMT

Hi Alok,

As you suggest you can have multiple Certificates active.

However only one can have the name SAML 2.0

SAML 2.0 Setup - ServiceNow Wiki

3.5 Step 5. Install the IdP Certificate

Identity providers use a certificate to verify communications with the service provider. Locate the IdP's certificate within the IdP's metadata. You must install the same certificate on both the IdP and the instance.

Note: Certificates for single-sign on should always be in PEM format to work with SAML certificates.

To install the certificate on the ServiceNow instance:

Browse the IdP metadata to find the ds:X509Certificate element. The value of this element contains the IdP's certificate.
In the ServiceNow system, navigate to SAML 2 Single Sign-on > Certificate.
Do not change the Name entry. The name of the X.509 certificate must be SAML 2.0 in order for the integration to use it.

Best Regards

Tony

Re: SSO issue after adding X.509 Certificates

tony_barratt — Thu, 24 Sep 2015 05:57:28 GMT

Hi Alok,

The error message you are seeing:

"Error :

----------------------------------------------------------------------------------------

There was a problem accessing the site. Try to browse to the site again.

If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

Reference number: 24441569-5894-48b0-8c2a-abfc2134b0f1"

is unlikely to be caused by a ServiceNow bug.

The message is from the IDP indicating the IDP is seeing an issue with what the ServiceNow instance is sending.

Take a look here:

SAML 2.0 Troubleshooting - ServiceNow Wiki

And consider contacting your IDP administrator and providing the error message reference number.

Please update with how you get on.

Best Regards

Tony

Re: SSO issue after adding X.509 Certificates

Alok Sahu — Thu, 24 Sep 2015 06:17:23 GMT

Hi Tony,

I have gone though below links :

http://wiki.servicenow.com/index.php?title=Multiple_Provider_Single_Sign-On#gsc.tab=0

http://wiki.servicenow.com/index.php?title=SAML_2.0_Setup#Step_5._Install_the_IdP_Certificate

As per Wiki SAML 2.0 plugin is required for single sign-on integration.

I don't want to integrate multiple single sign-on. My purpose is to integrated external system using SSL certificate.

I have added a new certificate for third-party SSL authenticate atX.509 Certificates and using the same in SOAP Message function for outbound call. After activating the certificate I am successfully able to post message via SSL integration with the external system however it leads to SSO fails.

My question is why SSO is getting interrupted if I add one more certificate in ServiceNow for purpose of external integration ?

It seems like a bug .

Regards,

-Alok

Re: SSO issue after adding X.509 Certificates

tony_barratt — Thu, 24 Sep 2015 07:17:25 GMT

Hi Alok,

I think the best way forward is for you to raise an Incident with Technical Support via HI.

It seems that there is an issue here that needs detailed examination of the configuration.

Best Regards

Tony

Re: SSO issue after adding X.509 Certificates

Alok Sahu — Thu, 24 Sep 2015 07:36:45 GMT

Thanks Tony,

I have raised and Hi ticket it seems only after adding+activating a new certificate in X.509 Certificates the SSO fails without activating the certificate everything works fine.

Regards,

-Alok