Configure Private Key JWT for OIDC based SSO

  • Release version: Yokohama
  • Updated January 30, 2025
  • 1 minute to read

    • Configure Private Key JWT for OIDC based SSO integrations.

    Before you begin

    Role required: admin

    You must perform the following tasks before choosing Private Key JWT for OIDC based SSO.

    • Upload Java Key Store certificate: Attach a JKS certificate to your instance to use to enable the JWT client authentication.
    • Configure a JWT signing key: Create a JWT signing key to assign to your Java KeyStore (JKS) certificate.
      Note:
      If you want to add X.509 Certificate SHA-1 Thumbprint int (x5t) to the header as part of the JWT Key, you must configure the form and add the X.509 Certificate SHA-1 Thumbprint int (x5t) field.
    • Create a JWT provider with a JWT signing key: Add a JWT provider to your ServiceNow instance.

    To include a JWT Key for OIDC based Identity Provider, you must:

    Procedure

    1. Navigate to All > System OAuth > Application Registry.
    2. Select the OIDC Identity Provider that you had created.
    3. On top of the form, select Configure > Form Design.
      Note:
      You must add Send Credentials and JWT Provider fields to the form to use the Private Key JWT for OIDC based Identity Provider authentication requests.
    4. Choose the As Private Key JWT for Send Credentials.
    5. Select the JWT Provider.
      OAuth OIDC Entity form

      When the user authenticates, the authentication page has options to login through Okta.