The Okta/ServiceNow SAML integration currently supports the following features:
For more information on the listed features, see the Okta Glossary.
Install Multi-provider SSO Plugin in ServiceNow
Install Enhanced UI in ServiceNow
Enable Multi-Provider SSO in ServiceNow
Follow the steps below to complete the installation of the prerequisites:
Login to ServiceNow as the system administrator.
Search for plugins in the Filter navigator (top left input field).
Search for com.snc.integration.sso.multi on the plugins page.
Click Install for the following plugins:
Multiple Provider Single Sign-On Enhanced UI
Multiple Provider Single Sign-On
Search for Multi-Provider SSO in the Filter navigator (top left input field). Click Properties, then select Yes for Enable Multiple provider SSO.
Click Save.
You've successfully completed all the pre-requisites, and can now proceed with configuring SAML by following the steps in the next section.
Login to ServiceNow as a system administrator.
Search for Multi-Provider SSO in the Filter navigator (top left input field), and then elect Identity Providers.
Click New.
You're asked what kind of SSO you are trying to create. Select SAML.
An Import Identity Provider Metadata pop-up dialog appears.
Copy and paste the following Metadata URL:
Sign in to the Okta Admin Console to generate this value.
Click Import.
A page opens with auto-populated SAML settings.
Check Default (if you want this SAML configuration to be the default).
Refer to Multiple IdP section if you have multiple IdPs enabled (this affects the SP-initiated flow).
Scroll down and select the Encryption and Signing tab.
Signing/Encryption Key Alias: Set to saml2sp (by default, the integration looks for the alias saml2sp).
Note: If you created a different alias name for the SAML 2.0 keystore, enter that; otherwise, use saml2sp.
Signing/Encryption Key Password: Enter the password to your SAML 2.0 Keystore. By default, the password is the same as the default alias name.
Select the User Provisioning tab and uncheck Auto Provisioning User and Update User Record Upon Each Login.
Select the Advanced tab.
In the user field, specify the ServiceNow user attributes that you will be matching against Okta with SAML. By default, this is user_name, but can be configured to match other attributes such as email, depending on your use-case.
Note: You can select which field from the user profile on the SNOW side they want to match to, as the NAME id in SAML. It ca be email, username, or any other field on the user record.
Check Create AuthnContextClass.
If you want to turn on advanced features such as Single Logout and/or Force Authentication, follow the steps outlined in the Advanced Settings section.
Test the SAML connection. Scroll up and click Test Connection on the top right. Fix any misconfigured values and ensure all the tests pass.
Once the SAML tests pass, click Activate to activate the Identity Provider you just set up.
Done!
Force Authentication
Single Log out
SP-initiated SAML
Go to the Advanced tab and check Force AuthnRequest.
In Okta, make sure you have unchecked the Disable Force Authentication option on the Sign On tab.
Click Update.
Done!
Enter the following Identity Provider's SingleLogoutRequest URL:
Sign in to the Okta Admin Console to generate this variable.
Scroll down and select the Encryption and Signing tab.
Check Sign Logout Request.
Select the Advanced tab and change the Protocol Binding for the IDP's SingleLogoutRequest to the following:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
Click Generate Metadata.
The new metadata tab appears.
Save the X509Certificate value.
Create a file in a text editor in the following format:
-----BEGIN CERTIFICATE----- [your x509 certificate value] -----END CERTIFICATE-----
Save the text file as servicenow_slo.cert.
Close the metadata tab.
In Okta, select the Sign On tab for the ServiceNow app, then click Edit.
Check the Enable Single Logout box.
Upload the servicenow_slo.cert file you saved earlier (step 11, above).
Click Save.
Determine which use case:
At this point, SAML single sign-on is configured for IdP-initiated flows from Okta into ServiceNow. To allow users to leverage Single Sign-On from the SP-Initiated flow (when they go directly to ServiceNow to log in), use the following instructions.
Note: SP-Initiated SAML can be enabled for an individual user or an entire company of users in ServiceNow. However, it can't be enabled for specific groups of users.
Go to Multi-Provider SSO > Identity Providers.
Right-click an identity provider record and select Copy sys_id.
Save the sys_id value. You'll need to use this value for the SP-initiated flow.
If want to enable SP-Initiated SAML on a user by user basis instead of for all users within a given company, do the following:
Go to the Users page from the Filter navigator at the top left of the page.
Select any given user to go the user details page – the specific user you choose doesn't matter.
From menu icon, select Configure, then Form Design.
From the Fields sidebar on the left, select and drag the SSO Source field to the User [sys_user] table in the middle of the page as the last attribute in the list.
Click Save.
To enable SP-Initiated SAML for a specific user, go back to the Users page from the Filter Navigator.
Select your specific user to navigate to the user details page.
In the SSO Source field, type sso: and then paste the sys_id from the Identity Provider you created with the Multi-Provider SSO plugin. Choose Update to finish.
If you want to enable SP-Initiated SAML for all users within a given company instead of on a user-by-user basis, do the following:
Go to the My Company page from the Filter Navigator at the top left of the page.
From the menu icon, select Configure, then Form Design for the Company.
From the Fields sidebar on the left, select and drag the SSO Source field to the Company [core_company] table in the middle of the page as the last attribute in the list.
Click Save.
To apply SP-Initiated SAML to all users in a specific company, go back to the My Company page from the Filter Navigator.
In the SSO Source field, type sso:. Paste the sys_id from the Identity Provider you created with the Multi-Provider SSO plugin. Choose Update to finish.
Your users can now begin using SP-Initiated SAML with ServiceNow in two different ways.
First, when they navigate to the default ServiceNow login page, they can choose Use external login and then enter in their ServiceNow username in order to be redirected to Okta for SSO.
Alternatively, your users can go directly to the following url: https://[yourServiceNowDomain]/login_with_sso.do?glide_sso_id=[sys_id value]