Configuring ADFS and ServiceNow - SAML Logout

[Steve Kelly]

I'm posting this article about how we got SAML logout working properly between ServiceNow and our ADFS, using the Multiple-Provider SSO plugin. For the longest time, we had ADFS SAML authentication working for ServiceNow, but SAML logout was never working properly. ServiceNow would appear to log out, however, that session and subsequent sessions were never terminated properly. As a result, we had to place ServiceNow in a separate access policy in our ADFS instance, which meant we could not take advantage of SSO between ServiceNow and our other ADFS services. ServiceNow's documentation on configuring SAML and ADFS is not 100% clear and straightforward, and so I'm hoping this information may help others who might be experiencing issues getting logout to work as it should.

With help from Microsoft support, we were finally able to get SAML logout working properly between ADFS and ServiceNow. Bear in mind that one organization's ServiceNow and/or ADFS configuration is going to be different from another organization, so these steps may not always apply. With that being said, here is what we did.

1. Microsoft recommended that the SAML logout requests be signed, as this is a requirement of SAML 2.0 specifications. Thus, we enabled the Sign LogoutRequest option under our ADFS identity provider in ServiceNow.
2. However, by default (at least on our instance, not sure if this has changed in newer versions of ServiceNow), the SAML logout requests were signed with SHA-1, which our ADFS would not accept as it was not secure enough. As a result, we had to enable the SAML 2.0 Keystore_Key2048_SHA256 SHA-256 keystore under x509 Certificate within the Multi-Provider SSO menu. 
3. We then set the system property glide.authenticate.sso.saml2.keystore to the sys_id of that SHA-256 keystore, to set it as the default keystore for signing identity provider SAML requests.
4. We set the Identity Provider's SingleLogoutRequest field to be https://<adfs.url.com>/adfs/ls where <adfs.url.com> is our ADFS server address, although this came in from our ADFS federated metadata. We had seen some posts where people said to set this to the WSFED logout URL, ending in ?wa=wsignout1.0, which is not correct for SAML.
5. You may need to set the credentials for the Signing/Encryption Key Alias and Signing/Encryption Key Alias on the ADFS identity provider in ServiceNow. I believe the default value for each is: saml2sp
6. We then set the Signing Signature Algorithm to be the SHA-256 specification which is http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 - note that ServiceNow documentation says to use SHA-1, however, we went with the more secure SHA-256 which still seems to work fine. You just need to double check that SHA-256 is also set on the Relaying Party Trust on the ADFS side.
7. Once all that is set, we then used the Generate Metadata button in ServiceNow for the identity provider, to generate the XML for importing into ADFS. 
8. On the ADFS side, once we imported the XML, confirmed SHA-256 was set, and confirmed that the Signature was populated with the SAML certificate from ServiceNow, everything started to work.
9. Another thing to confirm on the ServiceNow Relaying Party Trust in ADFS is that the SAML logout endpoint for your ServiceNow instance is https://<yourinstancename>.service-now.com/navpage.do - the SAML logout endpoint URL should be a URL pointing to ServiceNow, and it should not be an ADFS URL as one of the ServiceNow SAML documentation pages suggests. The page suggests the WSFED ADFS signout URL I mentioned above, which is not correct. I have also seen many other posts on the Internet about using the WSFED URL for SAML logout, which is incorrect.

We spent quite a lot of time trying to get this to work, so I hope this is helpful to anyone in a similar situation! I'm also not a SAML engineer so hopefully I got all my terminology correct 🙂

Cheers,

Steve

[Steve Kelly]

A further update on this. Unfortunately, ServiceNow does not support IDP initiated sign out under SAML 2.0. They have opened PRB1357568 for this issue, as IDP initiated sign out is part of the SAML 2.0 specifications and should work. This issue manifests itself when you log into ServiceNow, then open a new tab and navigate to another service provider on the same IDP. When you initiate a sign out from the second service provider, you get redirected back to your ServiceNow session in the second tab. This is because the IDP, ADFS in this case, attempts to send a SAML logout request to ServiceNow when the sign out is initiated from the second service provider, using Single Logout (SLO). Since ServiceNow does not know how to handle IDP initiated SAML logout requests, the sign out is not successful and the user is redirected to ServiceNow, still authenticated.

The SAML logout works when ServiceNow initiates it, which is great, but when other service providers are in the mix, which is the whole point of SSO, things get messy.

It is really unfortunate that ServiceNow has not implemented SAML properly by not processing IDP initiated sign out. If anyone is also experiencing this issue, please open a ticket on Hi and reference the above PRB record.

[chuckn]

Thank you for sharing all this great info!  We're working on setting up ADFS with ServiceNow ourselves.

[Teemu1]

Problem PRB1357568 seems to be still unresolved. I opened a ticket and HI support referenced it to that problem. I really hope they resolve that soon, otherwise we might get blocked out by big national Id provider covering all public services.

Please let us know if anyone figures out a workaround for this, while waiting for the official solution from ServiceNow.

[Steve Kelly]

Looks like ServiceNow addressed PRB1357568 in the Rome release apparently. I have not had a chance to test the fix, as I am now working at a different organization. But if anyone has successfully implemented IDP-initiated SAML logout then please update this post. @Teemu