SAML SSO eliminates password fatigue for your users and gives your security team centralized control over ServiceNow access. This guide walks you through the full configuration from metadata exchange to production testing.
Why manual ServiceNow authentication creates problems
Before SAML SSO, users juggle yet another password, IT teams field constant reset requests, and security teams have no centralized way to provision or deprovision ServiceNow access. When someone leaves the company, their ServiceNow account often lingers because it's not integrated with your identity management workflow. Meanwhile, users either create weak passwords or reuse passwords from other systems, creating security exposure your CISO won't appreciate.
How SAML SSO works in ServiceNow
SAML SSO works through a trust relationship between ServiceNow (Service Provider) and your identity system (Identity Provider). You export ServiceNow's metadata file and import it into your IdP, then import your IdP's metadata into ServiceNow. The critical piece is attribute mapping — ServiceNow needs to know which SAML attribute contains the user's email address so it can match to existing user records. Start with email-to-user_name mapping, test with a few users, then expand the rollout.
Taking SSO to production quality
Basic SAML gets users logged in, but production SSO requires just-in-time user provisioning, group membership mapping, and session management tuning. You'll want to configure automatic user creation for new hires, map your IdP groups to ServiceNow roles, and set appropriate session timeouts. Most importantly, establish your break-glass procedures now — when your IdP goes down, you need a reliable way for admins to access ServiceNow directly.
Before you start
- •admin role in ServiceNow
- •SAML metadata file from your identity provider
- •Ability to configure your IdP with ServiceNow metadata
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Enable SAML 2.0 plugin
Navigate to System Definition > Plugins and search for 'SAML 2.0 Single Sign-On'. Click Install if not already active. This plugin adds the SAML configuration tables and SSO processing logic. The installation takes about 2-3 minutes and requires no instance restart.
The plugin appears as 'Integration - Single Sign-On SAML 2.0' in older instances.
Create identity provider record
Go to System Security > SSO > Identity Providers and click New. Set Name to your organization's IdP name for clarity. Leave Import IdP Metadata blank for now — you'll populate this in the next step. Set User Provisioning to 'Create users that do not exist' if you want automatic user creation, otherwise leave as 'Reject sign-on'.
Don't enable 'Create users that do not exist' until you've tested with existing users first.
Export ServiceNow metadata
In your new Identity Provider record, scroll to Related Links and click 'Download SP Metadata'. Save this XML file — you'll import it into your IdP configuration. The metadata contains ServiceNow's entity ID, assertion consumer service URL, and signing certificate. Don't modify this file manually.
The SP metadata URL is also available at https://yourinstance.service-now.com/navpage.do if you need to provide a direct link to your IdP team.
Configure your identity provider
In your IdP system, create a new SAML application using the ServiceNow metadata you just downloaded. Configure attribute mapping to send the user's email address in a SAML attribute — note the exact attribute name your IdP uses. Common names are 'email', 'mail', or 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'. Export the IdP metadata when configuration is complete.
Import IdP metadata
Back in ServiceNow, edit your Identity Provider record and paste your IdP's metadata XML into the Import IdP Metadata field. Click Import at the bottom of the field. ServiceNow extracts the SSO URL, signing certificate, and entity ID automatically. Verify the SSO URL field populated correctly.
If import fails, check that your IdP metadata is valid XML and includes signing certificate information.
Map SAML attributes
Scroll to the User Field Mapping section and create a new mapping. Set SAML Attribute to the attribute name from your IdP (like 'email'), User Field to 'user_name', and check Create user if not found if you want automatic provisioning. This mapping tells ServiceNow how to match incoming SAML assertions to user records. Save the Identity Provider record.
Test SSO login
Open an incognito browser window and navigate to your ServiceNow instance. You should be redirected to your IdP for authentication. After successful IdP login, you'll return to ServiceNow logged in as that user. If you see authentication errors, check the SSO log at System Logs > SSO for specific failure details.
Never test SSO in the same browser where you're already logged in — ServiceNow will skip the SSO flow entirely.
Enable SSO enforcement
Navigate to System Properties > Authentication and find the 'Enable single sign-on' property. Set this to true to enforce SSO for all users. Users will no longer see the ServiceNow login form and will be redirected immediately to your IdP. Save the property change.
Keep the emergency bypass URL handy: https://yourinstance.service-now.com/login.do?user_sso_optional=true
Best practices
Always map to user_name field using email addresses — mapping to sys_id breaks during instance cloning and user imports.
Test the emergency bypass URL (/login.do?user_sso_optional=true) before enforcing SSO — when your IdP goes down, this is your only way back in.
Set up SSO logging at System Logs > SSO before going live — SAML failures are cryptic without detailed logs.
Create a dedicated service account in your IdP for ServiceNow integration testing — don't rely on personal accounts for troubleshooting.
Configure session timeout in ServiceNow to match your IdP settings — mismatched timeouts create confusing user experiences.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue