Any option for Smartcard Based Certificate Login when External SSO/SAML options are not available?

[jodyadomatis]

Have the requirement to only allow users to log into ServiceNow using DoD CAC certificates.

I can get the DoD Root CA certs to use for trusted Roots

Have done many searches already however and dont see anyone talking about the possibility of having the browser prompt for which certificate to use, requesting PIN, and then using the SSL/TLS certificate info to 1st check against a certificate revocation list and then either associate the certificate with a known user or create a new user account using info from within the certificate info.

To the best of my knowledge there is not a viable external SSO authority to which I can connect for this purpose.

Any advise / direction would be much appreciated.

[ashthompson]

Were you ever able to figure this out?  We are deploying SN and require DoD CAC login as well and will not have an F5/proxy setup to handle SSO for our initial rollout.

[jodyadomatis]

Nope.  Still working on a solution.  We're trying to integrate with a SecureAuth appliance for SSO...  The trouble is that we don't really want to do SSO.  We aren't trying to validate ServiceNow login based on an external user directory.  So we're going to have to start putting everyone into an external LDAP directory to make it work that way.

As a side project, on my own time... I'm looking at creating a simple web page with a php script that uses the LightSAML library.  The web server (apache) can be set to force the collection of the CAC certs and validate them against DISA OCSP.  It can then pass that info on to the PHP script that will process the SAML request and generate the appropriate SAML response based on the OCSP response and certificate UPN.  Because that's really all we want... is to validate a user is who they say they are based on their certificate and the fact that we could access the certificate because they knew their PIN.

Wish I had better news...  Since ServiceNow sits on a Tomcat shell, it shouldn't be this hard.  Tomcat has the same certificate collection and OCSP verification abilities as Apache.  I'm just not familiar with the mechanics of how the ServiceNow applet interacts with the Tomcat shell... to potentially even try to write something myself like a customer portal login widget that would make use of it.

[wmwinn]

I'm in a similar situation as jodyadomatis....  Very interested in possible solution paths for SmartCard based Certificate logins (CAC) for ServiceNow.  Any advice would be helpful!

[Carl2]

We also have this problem. All the documentation seems to say this is not supported. Are there any other ways to get a SAML token from a CAC?