How to: Implement Azure AD SSO with ServiceNow

[lasse3]

In this how to I will setup Single Sign-On (SSO) using Microsoft Azure AD without the use of a ServiceNow MID server. This article was done on the ServiceNow Jakarta release. If you are on a different release some of the screens may look different.

1. Azure setup

Before you continue make sure that you have the "Global Administrator" role as this is required.

1.1 Go to portal.azure.com and login with your credentials.

1.2 Click on Azure Active Directory in the menu to your left.

1.3 Click on "Enterprise applications" in the menu.

1.4 Click on "New application" at the top of the page.

1.5 Select "IT infrastructure" in the filter to the left.

1.6 Locate ServiceNow by searching for it and click the ServiceNow icon to create the Application.

1.7 Under "Quick start" click "Configure single sign-on (Required)"

1.8 Select "SAML-based Sign-on" and enter your instance URL in the "Sign on URL" and the "Identifier". Click on "Save".

1.9 In case the new certificate is in status "New" click the "Make new certificate active" checkbox and then click Save. If your certificate is already in status "Active" you can skip this step.

1.10 Scroll down a but and click the "Certificate (Base64)" link to download the certificate.

1.11 Scroll further down and click "Configure ServiceNow"

1.12 Check the checkbox "Manually configure single sign-on

1.13 Scroll down and locate the "Quick Reference". Copy the "Azure AD Single Sign-On Service URL", the "Azure AD Sign Out URL", and the "Azure AD SAML Entity ID". We will need this information later.

1.14 Go back to the "Quick start" and click on "Assign a user for testing (required)". Pick a user that you wish to test with and add it to the list. You can pick yourself if you like.

2. ServiceNow setup

To set things up in ServiceNow you need to have the role "admin".

2.1 Go to you serviceNow backend and login.

2.2 Click the "Plugins" link under "System Definition".

2.3 Find the "Integration - Multiple Provider Single Sign-On Installer and install it if it is not already installed.

2.4 Go to "Multi-Provider SSO -> Administration -> x509 Certificates"

2.5 Click the "New" icon at the top of the page.

2.6 Fill out the "Name" with something that makes sense to you. The field Format should be "PEM" and the Type "Trust Store Cert". In the "PEM certificate" paste the certificate that your downloaded from Azure earlier. You can do this by opening the file in a texteditor like notepad and copy the content out. Click "Submit" and the certificate is now stored in ServiceNow.

2.7 Click on "Multi-Provider SSO -> Identity Providers"

2.8 Click on the "New" button at the top.

2.9 Pick "SAML"

2.10 Click cancel on the dialogue box that appears.

2.11 Give your Identity Provider a name in the "Name" field. Make sure to check the "Default" check box. Fill out the fields with the following information:

Identity Provider URL: https://sts.windows.net/"unique id"/ - We copied this link in step 1.12

Identity Provider's AuthnRequest: https://login.microsoftonline.com/"unique id"/saml2 - We copied this link in step 1.12

Identity Provider's SingleLogoutRequest: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

ServiceNow Homepage: your instance (eg. https://yourcompany.serivce-now.com)

Entity ID / Issuer: your instance (eg. https://yourcompany.serivce-now.com)

Audience URI: your instance (eg. https://yourcompany.serivce-now.com)

NameID Policy: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

Click "Submit" to save the Identity Provider record.

2.12 Click the newly created record.

2.13 Right click at the top bar and click "Copy sys_id". Paste this ID somewhere as you may need it later.

2.14 Click the "Advanced tab" and enter the following values:

User Field: user_name

AuthnContextClassRef Method: http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password

Single Sign-On Script: MultiSSO_SAML2_Update1

Clock Skew: 60

Protocol Binding for the IDP's SingleLogoutRequest: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

2.15 Right click the grey bar at the top and select "Save".

2.16 Scroll to the bottom and located the related list "X.509 Certificates" and click the "Edit..." button.

2.17 In the slush bucket that appears select the certificate that you created in step 2.6 and move it to the right. Then click "Save".

2.18 Click the "Test Connection" button at the top of the page to test that everything is working. For the test connection you may want to ensure that you are in a private / incognito browser window.

2.19 Examine the test result and click "Activate". Notice that I was using myself as a test person and therefor the test skipped the logout test.

2.20 Go to "Multi-Provider SSO -> Administration -> Properties"

2.21 Mark the checkboxes "Enable multiple provider SSO" and "Enable Autoimporting of users from all intensity providers into the user table" to yes. The later is optional though as you can also create the users manually if you prefer. Click "save"

3. Automatic redirect

If your instance does not automatically redirect to SSO you may need to manually add or modify the "glide.authenticate.sso.redirect.idp" system property.

3.1 Enter "sys_properties.list" in the main menu to the left and hit "enter".

3.2 Search for "glide.authenticate.sso.redirect.idp".   If it does not exists create a new one, by clicking the new icon. Otherwise open the record.

3.3 Paste in the sys_id of your Identity Provider record, that we copied earlier in step 2.13.

Remember to make the property "Private" to ensure that it is not copied between instances as the sys_id of the IdP record will be different from system to system.

4. Deploy SSO to all users (Azure)

Once you have confirmed that everything works as expected you need to Deploy single sign-on to all the users that needs to access ServiceNow

4.1 Go back to your Azure portal and the "Quick start" guide of the enterprise application that you created in step 1.6. Click the link "Deploy single sign-on to users and groups (recommended).

How you want to add users depends on how you are organizing your directory in Azure AD.

I hope that you find this how to useful. Let me know if you have any improvement suggestions or comments. Please endorse if this works for you or like if you want to see more like this.

[markbu]

Hi Lasse,

Did you manage to get User Provisioning working?   Within Jakarta we have got Azure SSO and User Provisioning working but have a couple of issues:-

When we remove a user from the Azure AD group it doesn't deactivate them in ServiceNow

When we update a user in Azure AD it doesn't update the user in ServiceNow

It takes a long time (hours) to provision a user from Azure to ServiceNow

It is only bringing across the basic attributes (email, username) despite selecting the attributes in Azure to map

[lasse3]

Hi Mark,

I do not believe that this is the way forward in terms of user provisioning. Instead I am currently working on an article explaining how to setup a secure LDAP connection (LDAPS) between ServiceNow and Azure. This should also allow the import of groups. Do you think that this would solve your issue?

/Lasse

[markbu]

Hi Lassa

Thanks for the reply.

Using the LDAP connection would this be an overnight import as opposed to a dynamic update from Azure?   Would that also handle the deactivation of users in ServiceNow ?

Thanks

Mark

[lasse3]

Hi Mark,

The idea would be to set it up as an LDAP listener, so that any change would be effective immediately. But I have not had the chance to set this up just yet. I will let you know as soon as I have something to share on this 🙂

/Lasse

[markbu]

Excellent thank you

[Community Alums]

Hi Lasse,

We are trying to configure Azure SSO integration with ServiceNow. But while we click on Configure ServiceNow from Azure , it is not taking us to the Credentials page.. The page is keep on loading..(step 1.9 in your article)

Can you please suggest what might be the issue causing this..

Thanks,

Sangeetha

[lasse3]

Hi Sangeetha,

I am not sure what would cause that, but it could be a browser issue. Did you try using a different browser? I used Google Chrome when I did this guide.

Kind regards

Lasse

[lasse3]

Hi Sangeetha,

I stumpled on the same issue with another customer and have update step 1.9 to avoid this issue. In short you need to activate the certificate before you can progress to the configuration page.

I hope this helps!

Kind regards

Lasse

[he-man]

Hi. I'm not able to get this to work. The IDP is tested OK and activated, but when I click on the app from portal.office.com I just get to the normal login prompt at https://xyz.service-now.com/navpage.do

Is there any log I can check for troubleshooting? Any help is appreciated

[lasse3]

Hi Thomas,

When getting to the "normal" login, can you then click the link "use external login" under the username / password fields? If yes, and if this works, the issue is that you did not setup the redirect part of the guide (section 3).

I hope this helps!

Kind regards

Lasse

[johnsang]

Hi Lasse,

        Please advise where we could find you article for LDAPS connection between Azure and Service now....Do we need a MID server in that case?

        Thanks.

Regards,

John Sang

[lasse3]

Hi John,

I unfortunately have not had the time to do this article yet. The idea is to do it via a direct SSL connection between ServiceNow and Azure. Alternatively I am also looking into using Microsoft Graph API to accomplish the same thing. In either case there would be no need for a MID server.

I guess I am missing a customer willing to invest in this, but hope to find the time as the holiday season is approaching 🙂

/Lasse

[johnsang]

Hi Lasse,

      Just wonder if you could offer some help/advise.

        We follow the procedure provided and setup the SSO.

        However, user profile failed to create under ServiceNow....the Provisioning take forever and then timeout.

        Any suggestion is welcome.

        Thanks.

Regards,

John Sang

[Jan Sierens1]

We followed this guide to implement SSO on a test system. However the test connection does not work for us. Instead of the screenshot shown we get the Azur login page. When entering valid users credentials, the system just shows a window the user is logged out. There is no window with statuses or contents that resembles the screenshot with the statuses.

ogin.microsoftonline.com/login.srf?wa=wsignoutcleanup1.0&wreply=https%3a%2f%2flogin.microsoftonline....

[Oscar Lopez]

I didn't get the page result when clicking "Test Connection" I was able to ling successfully but the result page didn't appear instead I got Microsoft logout page, hence I can't activate.

To login I'm using one of the users account I created.

What can I do here?

[Jan Sierens1]

It seems we have the same issue.

[lasse3]

Hi Jan,

Did you create the user in both Azure and ServiceNow? Please make sure that the e-mail adresses match and that the username in ServiceNow is the user's e-mail address.

Try running your test in an incognito / private browser.

Also there is the option to disable the mandatory testing (which was introduced in Jakarta), by setting the sys_property "glide.authenticate.multisso.test.connection.mandatory" to false. This should enable you to proceed and activate it. Remember to have a "local ServiceNow admin", that you can login with using /login.do in case something goes wrong.

I hope this helps!

/Lasse

[lasse3]

Hi Oscar,

I think this might be Jakarta related. See my reply to Jan. I hope this helps.

/Lasse

[Jan Sierens1]

Hi Lasse,

Thanks for the reply. The email addresses do match and the username is the users email address. I did try running in an incognito window. But it has the same effect.

I also tried bypassing the test script. But SSO doesn't work. When I login using "use external login" I get the error message:

Error MessageRedirect failed, please contact your administrator.

Best regards,

Jan

[lasse3]

Hi Jan,

I cannot recreate the issue, so I am guessing here (sorry).

Try enabling the debug login (see step 2.21) and investigate in the ServiceNow log what is happening. Also open the app in Azure and check the login log there to see if this gives you any hints to what you are missing.

/Lasse

[Jan Sierens1]

Thanks anyway. Seems like we're having an issue finding the idp. I bypassed the mandatory test and I'm to be able to connect using /login_with_sso.do?glide_sso_id=<sys_id of the sso configuration>

[lasse3]

Hi Jan,

Sounds like you are close. Did you remember to check the "default" checkbox in step 2.11 before activating?

/Lasse

[Jan Sierens1]

It seems to work better now.

Some things I did:

- Disabled the Digested Token identity provider

- Flagged the Identity Provider as default

- Flagged Auto Redirect IdP

- Disabled and reenabled all flags on Customization Properties for Muliple Provider SSO

The test script on the identity providor page still fails.

If I open an incognito window and surf to the customers instance, I get the microsoft online login page. When I enter the users email address, I'm redirected to the customers login page and I can login.

[cfosund]

Hi

ServiceNow Azure AD SSO works as expected with regular username and password on Windows logon.

But I can't get it to work with "Windows Hello for Business" (PIN/Biometric logon) on Windows 10 Ent. (1709)

I get the following error message:

Additional technical information:

Correlation ID: 990ac0f6-9e97-4a63-b178-1759c5e2df27

Timestamp: 2017-12-03 18:55:21Z

AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'

Same issue on Google Chrome, Edge, Firefox and Internet Explorer.

Microsoft support is saying that it must be a misconfiguration in the ServiceNow tenant.
Anyone seen this issue yet?

How can i configure the ADAL setup to support SSO with "X509, Multifactor" and regular username passwords.

Thanks!

kG56mQ8g6y86!

[lasse3]

Hi Christian,

I believe that you need to change the field "AuthnContextClassRef Method" to: "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/x509" to let Azure know that you wish to authenticate this way.

I have not had the chance to verify that this works, but from what I can see this is the issue.

For a full list of authentication classes see this page:

https://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.authenticationmethods(v=vs.110)...

If you wish to support both methods at the same time you may need to have them created as two identity providers or perhaps you can use a more generic authentication class like "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/unspecified". Try it out and please let me know if it works for you 🙂

I hope this helps!

/Lasse

[Jan Sierens1]

Isn't it easier to let the IDP choose the authentication method by disabling the flag "Create AuthnContextClass"?

Which methods are supported? According to the doc this is only forms based authentication (password protected) or kerberos based authentication (windows): https://docs.servicenow.com/bundle/jakarta-servicenow-platform/page/integrate/saml/task/t_OptEnableP...

I followed this guide an thought I should check "Create AuthnContextClass" as a "AuthnContextClassRef method" was provided. I had to disable the "Create AuthnContextClass" option again to make in work correctly.

Best regards,

[Anders Pr_stega]

Just to backup Lasse about the "Test connection" that doesn't work in Jakarta.

Lasse's reply to Jan 23-11-2017 09:12 is relevant.

More info here.

/Anders Præstegaard

Consultant

Syspeople

[Anders Pr_stega]

Theres a an official kb about it actually:

Before activating an IdP record, you must Test the connection to the IdP

/Anders

[Pritam3]

Hi

is it possible to do this configuration if user data is not coming from Azure and it is coming from other source like scheduled data import.

Thanks,

Pritam

[lasse3]

Yes, that is not an issue.

[Pritam3]

Thanks for quick reply.

[georgimavrodiev]

Hello guys,

I've just configured an integration between Azure AD and ServiceNow, following the above steps.
I already started playing with the user and group provisioning, moving users from Azure AD to ServiceNow.

This is basically export of data from Azure AD to SNOW.
I am interesting to know if it is possible a pull from SNOW to Azure AD to be performed on demand / automatically.
Do you know if there are any instructions on this described anywhere?

Best Regards,
Georgi

[Pooja122]

Hi lasse,

I have followed the steps you have mentioned above for SSO. But when I am trying test connection at Identity Provider, it is asking me to enter user credentials (Created one user with same details on Azure and Servicenow). After entering credentials, it is going to servicenow site and automatically signing out immidiately.

Can you please help me to solve this?

[Pooja122]

Hi Jan, 

I am facing the same issue. Can you please help me to solve this?

[lasse3]

Hi Pooja,

Did you create the user in both Azure and ServiceNow? Please make sure that the e-mail adresses match and that the username in ServiceNow is the user's e-mail address.

Try running your test in an incognito / private browser.

Also there is the option to disable the mandatory testing (which was introduced in Jakarta), by setting the sys_property "glide.authenticate.multisso.test.connection.mandatory" to false. This should enable you to proceed and activate it. Remember to have a "local ServiceNow admin", that you can login with using /login.do in case something goes wrong.

I hope this helps!

/Lasse

[Pooja122]

Thanks.

Now, I am able to get users in servieNow. But the department and location data i.e reference fields data is not getting populated in servcieNow from Azure AD. 

Can you please help me on this?

Thanks in advance.

[Marques2]

Hello,

First I attempted to follow Microsoft's documentation in completing the configuration automatically vs. manually. However, after testing the connection I continued to receive the error: AADSTS50003: No signing key is configured

I then removed the IDP and Certificate that was auto-created from Azure and went with the manual setup you outlined in this article (thank you). Unfortunately, I still continue to receive the error: AADSTS50003: No signing key is configured

My first thought of 'signing key' is within the ServiceNow IDP Record 'Signing/Encryption Key Alias' which is blank. Based on the steps I followed it's supposed to be blank, although it appears a password was auto-generated at some point. Can you confirm this is what I'd expect?

Lastly, I confirmed that I have 'Azure Active Directory Premium Plan 1', so I'm not sure if the error I'm receiving is directly correlated to access.

I asked someone who is not 'assigned to a role' for the ServiceNow application. I believe this does not mean a ServiceNow role, but a role within Azure as I believe I'm currently the only one associated with ServiceNow Application in Azure. What I'm getting at is when this user tested the IDP connection (they are also an admin) they received the below error. Because it's different than mine, I'm thinking my account was initially authenticated, but then during a 'secondary authentication' I received the error I did.

Any thoughts?? Stumped currently

Your help is much appreciated!

-Marques

[Jan Sierens1]

Last thing I did was to disabled the "Create AuthnContextClass" option.

https://docs.servicenow.com/bundle/jakarta-platform-administration/page/integrate/saml/task/t_OptEnableProvidingAuthContxtClass.html

That did the trick for me.

[Marques2]

Ended up being a certificate issue. Problem has been resolved.

[georgimavrodiev]

Hello,



Please ignore my above question. It is not valid anymore. Thanks 🙂



Cheers, Georgi

[georgimavrodiev]

Hello Marques,




I've encountered the same problem while I was completing the integration couple of months ago.
After performing an investigation of my own + conducting tests -> I fixed it.
Based on what I did, I may say that if you try the SSO login of an already provisioned user from Azure to ServiceNow via the Access Pane, and you encounter one of these two errors: AADSTS50003: No signing key is configured / AADSTS165000: Invalid Request -> then, please ensure that you “attached” the respective certificate (ServiceNow > Multi-Provider SSO > Administration > x509 Certificate) to the respective identity provider record (ServiceNow > Multi-Provider SSO > Identity Providers);
If this does not hep -> then, issue a new Certificate in Azure Active Directory and perform a new connection with ServiceNow. 

Best Regards,
Georgi Mavrodiev

IT Consultant
Do IT Wise

You may visit us in our Web Site: www.doitwise.com

[georgimavrodiev]

Hello Iasse,

I am not absolutely sure I got your issue correctly. Yet, from how I imagine the situation in which you are currently in, I would advise you to use the credentials of an admin user of yours while you are completing the integration between the two platforms. Once it is completed -> perform a user provisioning from Azure AD to SNOW -> once the provisioning is completed, then try accessing SNOW Platform directly from the Azure Portal.


Please let me know if I did not get you correctly and provide me with more detailed information, if possible, in regards to the exact problem you have. Thank you!


Best Regards,
Georgi Mavrodiev

IT Consultant
Do IT Wise

You may visit us in our Web Site: www.doitwise.com

[hipavan]

NOT ABLE to make the SSO completely work on ServiceNow Mobile app with AZURE

Is there anyone out there able to successfully implement this Azure SSO on ServiceNow App.

Our integration with Azure SSO works fine on desktop browsers, it works fine on iOS browsers too.

But when it comes to ServiceNow app, it comes up and challenges for the one time user name password page of Azure. Once I enter it works fine going forward. We want to avoid this initial manual login.

Its been a nightmare to get this resolved and ServiceNow says its not possible. 

ANY Successful implementation?

Thanks in Advance.

[lasse3]

Great question!

I am also under the impression that it is not possible to bypass this initial login when using the app, but I am curious to see if anybody has found a way to overcome this? 🙂

/Lasse

[hipavan]

Great article though. hoping someone knows or done this before or gave up. We have tried many ways but still no luck.

We dont mind even if there is any company who can do this with custom code

[WilliamS]

Hi,

I have a question about logout.

If I login with Azure SSO and logout, I can still login back to ServiceNow, or any other MS app (Outlook, Onedrive...etc) without typing password.  The SSO session/token still valid after I "logout" from ServiceNow.  Did I miss something important?

Thanks.

[mattgr]

For Azure Guest accounts authentication, please follow this article:

https://community.servicenow.com/community?id=community_article&sys_id=febbb577db5d9c104819fb2439961...