question Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication) in ServiceNow AI Platform forum

ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

darreneverett — Tue, 08 Aug 2017 04:33:08 GMT

G'Day fantastic people.

So I have done a few implementations with customers establishing SSO via the customers ADFS and the ServiceNow SAML connection.

And what happens is:

1. If customer is on internal customer network, browsing to instance takes them straight to the instance, because their network email is the same as in SN;

2. If customer is remote (ie Not on network), then they are presented with the ADFS Sign in Page, where they select what they want to connect to, being name of instance, followed by their network credentials. Hit Ok and they are into their instance.

This is all great.

However, this time, no matter what I try, the customer will ALWAYS ends up at the ADFS login page. They can select instance, pop in some credentials (network), and they are in. But for users on the internal network, I want this to bypass the ADFS screen and assuming their emails match, let them in.

I have used the URL that allows me to hard code the service I want to go to, that's fine.... albeit it still asked me to login at the ADFS page even if I'm already logged into the network.

[Here is the URL for reference ... https://samportal.example.com/adfs/ls/idpinitiatedsignon.aspx?logintoRP=https://company.service-now.com (of course, with values changed)]

The only thing I can see different is that the customer is using ADFS 3.0, and the others ADFS 2.0.

Any ideas out there? Thanks in advance.

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

mohamadcharafed — Tue, 08 Aug 2017 06:27:32 GMT

Hi Darren,

Can you go to the following page and check the 2 settings mentioned and set them the same :

(Workaround) Support Kerberos authentication

Cheers

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

darreneverett — Tue, 08 Aug 2017 06:47:03 GMT

Sorry Mohamad

I should have mentioned, that I already have the Kerberos workaround in place as follows:

AuthnContextClassRef method is set to

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

Thanks for responding though.

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

corina — Tue, 08 Aug 2017 15:40:03 GMT

Hello Darren.

You tried with this one?

urn:federation:authentication:windows

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

darreneverett — Tue, 08 Aug 2017 23:42:15 GMT

Hi Corina

Yes, I have also tried that, bit as with both settings in the Kerberos workaround, neither of the make a difference.

Thanks for making the suggestion though.

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

mohamadcharafed — Thu, 10 Aug 2017 04:22:41 GMT

Hi Darren,

I assume its a new ADFS server. Did you check the Authentication Policy ? Image is attached :

If thats already set, you can force the Windows Auth by ticking the "Create an AuthnContextClass" property and setting "AuthnContextClassRef method" to "urn:federation:authentication:windows".

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

darreneverett — Thu, 10 Aug 2017 04:50:57 GMT

Hi Mohamad

Perfect. we found this issue this morning. They had nothing selected for Intranet. After checking Windows Authentication, all is now working.

Many thanks for confirming.

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

na93 — Tue, 31 Oct 2017 10:28:17 GMT

Can someone confirm what should exactly be ticked on the ADFS authentication policy side of things? We are currently trying to get SSO working with ADFS and are having issues, this is our current set up.

Should forms Authentication on Intranet and 'Enable Device Authentication' be both ticked?

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

mohamadcharafed — Tue, 31 Oct 2017 23:28:31 GMT

Hi Nabeel,

Yes you Tick this Box. You said your having issues, what issues are you seeing ?

Regards,

Mohamad

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

na93 — Tue, 31 Oct 2017 23:55:08 GMT

Thanks Mohamad appreciated.

Seeing a lot of weird and wonderful errors to be honest.. We are still trying to sort out ADFS issues before we look at SSO..

Currently if a user logs in via https://adfs.example.com/adfs/ls/idpinitiatedsignon.aspx?logintoRP=https://company.service-now.com it works fine, however if they use a link from an email (deeplinking) or 'external login' option on the SN homepage it takes you to our ADFS page but when you try and login it gives you 'Could not validate SAML response' and then redirects you to the logged out successfully page.

We are also seeing "MSIS7075: SAML authentication request for the WebSSO profile must not specify any SubjectConfirmations." in the adfs server event logs.

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

mohamadcharafed — Wed, 01 Nov 2017 00:31:20 GMT

Hi Nabeel,

look at : windows server 2012 r2 - SAML authentication fails with error MSIS7075 - Server Fault

for your ADFS issue

Or you can try going to :

https://<YOUR ADFS>/federationmetadata/2007-06/federationmetadata.xml

and re import this into Service Now Identity Provider settings.

Regards,

Mohamad

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

na93 — Wed, 01 Nov 2017 22:08:12 GMT

Thanks! Managed to get ADFS working, turns out 'Transforming an Incoming Claim' was misconfigured.

Can I just finally ask for ADFS SSO which installation exit should be enabled, is it 'SAML2SingleSignon_update1'?

Thanks again

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

darreneverett — Wed, 08 Nov 2017 05:05:39 GMT

Hi Nabeel

I could not find a good answer regarding installation exits, their configuration, and system properties.

If you find out, please post here. Thanks.

Darren

Re: ADFS SSO and Passthrough Authentication (SAML Multifactor Authentication)

mohamadcharafed — Wed, 08 Nov 2017 07:01:53 GMT

Hi Nabeel

This depends which SSO you are using. Do you have Multi Provider SSO plugin installed ?

To check please go to Activate Multi-Provider SSO plugin

I recommend using this plugin as it has all the latest updates.

You should see the installation exits below once you actually enable SSO under Multi-Provider SSO -> Administration -> Properties :

MultiSSO

MultiSSOLogin

MultiSSOLogout

Let me know if you see these.

Regards,

Mohamad