Single sign-on (SSO) integration

If you intend to use ServiceNow CPQ for a headless use case (such as exposing ServiceNow CPQ on a website or eCommerce platform), please fill out and submit an SSO Setup Request Form that details the identity provider (IdP) you are using for single sign-on (SSO).

This process involves:

• Creating an app for ServiceNow CPQ in your IdP tool of choice. See the steps and links below.
• Sharing parameters and users from the app with the ServiceNow CPQ team. The team will complete the provisioning process using the parameters that you send.
• Testing and confirming that the SSO redirect works as expected.

Note the following considerations:

• ServiceNow CPQ can now support SSO with any IdP that supports OAuth2 with OpenID Connect (OIDC).
• ServiceNow CPQ is not compatible with SAML.
• Your IdP client must be up to date.
• Users who have been added to ServiceNow CPQ before SSO was implemented may need to be added again.
• These steps are not required if you are using ServiceNow CPQ with Salesforce.

Configuring Google SSO

ServiceNow CPQ supports Google for both personal and business single sign-on. If you use Google IdP for identity verification, all we need are the names and email addresses of your users.

Configuring Okta SSO

To set up an application that supports the Authorization code flow for ServiceNow CPQ, start by following the Okta Developer instructions: Implement authorization by grant type: set up your app

For the redirect URL, specify your ServiceNow CPQ URL, append /login/oauth2/code/, and then append your -okta subdomain. So if your URL is example.test.cpq, your redirect URL would be https://example.test.cpq/login/oauth2/code/example-okta.

Note your client ID, client secret, redirect URL, and Okta domain.

Note:

To confirm that your Okta domain is accurate, you can confirm that the OpenID connection metadata is visible by visiting https://{oktaDomain}/.well-known/openid-configuration. You should see a JSON file with information about the authorization server endpoints.

Provide these values together with any user details, such as name and email, for users that you want to test with. The ServiceNow CPQ team will schedule a brief call with you to obtain your client secret. The team will complete the provisioning process from there.

Note:

Users' email addresses will be used for authentication. These are case sensitive, so make sure that the email addresses you provide are accurate.

When your ServiceNow CPQ point of contact has confirmed that setup is complete, try to visit your tenant-specific ServiceNow CPQ URL. You should see a redirect flow that brings you to an Okta consent screen to allow access to your ServiceNow CPQ app.

Configuring Entra ID SSO

Register an app by following the instructions on the following Microsoft Entra documentation website:

Register an application in Microsoft Entra ID

In the Redirect URI section of the Microsoft Entra registration page, in the Select a platform menu, select Web. For the redirect URI, enter your tenant-specific URL, append /login/oauth2/code/, and then append <your subdomain>-entra. For example, if your URL is example.test.cpq, your redirect URI is https://example.test.cpq/login/oauth2/code/example-entra.

Make sure to select ID tokens on the Authentication tab of your app. For more information about OIDC, see the following Microsoft Entra documentation website: OpenID Connect on the Microsoft identity platform.

Note your client ID, client secret, and your Authority URL.

Note:

Make sure you note the client secret at this time. It won't be available to you later.

For information about how to validate your Authority URL, see "Find your app's OpenID configuration document URI" at the Microsoft Entra documentation website: OpenID Connect on the Microsoft identity platform. To get the correct issuer in the metadata, make sure to include /v2.0 at the end. You should be able to see the metadata and validate your issuer URL by visiting it in a browser with /.well-known/openid-configuration appended to it. For example: https://login.microsoftonline.com/c7dd9346-1cfc-4bd8-a34c-a066c8bc0477/v2.0/.well-known/openid-configuration.

Note:

It may be possible to directly associate your users with the application via the Manager > Users and groups > Add user/group option in your application.

Optionally, add an app role for the users whom you wish to test with. For more information, see "Add a user account to your directory, and add that account to an appRole" on the following Microsoft Entra documentation website: Add sign-in with Microsoft Entra account to a Spring web app

On the SSO Setup Request Form, provide the client ID, Authority URL, and redirect URl together with user details (email, name) for the users you wish to test with. The ServiceNow CPQ team will schedule a brief call with you to obtain your client secret.

By default, each user’s emails will act as their identifiers, but it may be possible to use a different identifier in a user profile. The fields that can be used as identifiers are limited by what’s available at the user_info endpoint defined in the well-known/openid-configuration URL described above. For more information about the user_info endpoint, see the following Microsoft Entra documentation website: Microsoft identity platform UserInfo endpoint.

Once your ServiceNow CPQ point of contact has confirmed that setup is complete, try to visit your tenant-specific ServiceNow CPQ URL. You should see a redirect flow that brings you to an Entra ID consent screen to allow access to your ServiceNow CPQ app.

Table 1. Troubleshooting

Issue	Resolution
The issuer does not match the expected value. For example, the issue is sts.microsoft.net instead of login.microsoftonline.com.	Make sure that your issuer URL includes /v2.0 after the tenant ID. Update the application manifest to set the accessTokenAcceptedVersion to 2.
Admin is redirected to http://cpq.ai, despite being set up correctly.	In your manifest, set the acceptMappedClaims parameter to true in your manifest.

Configuring another IdP

ServiceNow CPQ can now support SSO with any IdP that supports OAuth2 with OpenID Connect (OIDC). In the SSO Setup Request Form, provide details about your preferred IdP tool and our team will connect with you to ensure it is properly integrated with ServiceNow CPQ.