ServiceNow Ping Identity Integration Guide

Architecture Overview

Implementation Steps

// Custom user provisioning script example
(function(user_sys_id, saml_response) {
    var user = new GlideRecord('sys_user');
    if (user.get(user_sys_id)) {
        // Custom provisioning logic
        var department = saml_response.getAttribute('department');
        if (department) {
            user.department = department;
            user.update();
        }
        
        // Assign role based on SAML attribute
        var userRole = saml_response.getAttribute('role');
        if (userRole && userRole == 'admin') {
            var gr = new GlideRecord('sys_user_has_role');
            gr.initialize();
            gr.user = user_sys_id;
            gr.role = 'admin';
            gr.insert();
        }
    }
})(user_sys_id, saml_response);

// Script to test SAML attribute retrieval in ServiceNow
(function() {
    var gr = new GlideRecord('sys_user');
    gr.addQuery('user_name', 'test.user@company.com');
    gr.query();
    
    if (gr.next()) {
        gs.info('User found: ' + gr.name + ', Email: ' + gr.email);
        gs.info('Last login: ' + gr.last_login_time);
        gs.info('SSO Source: ' + gr.source);
        
        // Check user roles
        var roles = new GlideRecord('sys_user_has_role');
        roles.addQuery('user', gr.sys_id);
        roles.query();
        while (roles.next()) {
            gs.info('Role: ' + roles.role.getDisplayValue());
        }
    }
})();

Common Use Cases

Troubleshooting

Pro Tips

• →Configure SAML assertion encryption in PingFederate for sensitive environments by enabling assertion encryption in the SP connection settings and ensuring ServiceNow's private key is properly configured for decryption. This adds an extra layer of security for SAML attribute transmission and is often required for compliance in healthcare or financial services organizations.
• →Implement custom user provisioning scripts in ServiceNow to handle complex business logic like automatic group assignments, approval workflows for new user creation, or integration with HR systems for employee validation. Use the User Provisioning Script field on the Identity Provider record to execute custom GlideScript logic during the JIT provisioning process.
• →Set up SAML attribute-based access controls by creating User Criteria records that automatically assign roles and restrict application access based on attributes passed in SAML assertions. This enables dynamic privilege management where user permissions automatically adjust based on changes in the authoritative identity source without manual intervention.
• →Configure multiple Identity Provider records in ServiceNow for different user populations or testing scenarios, using the 'Domain' field to segregate users and the login URL parameters to direct specific user groups to appropriate PingFederate connections. This approach supports complex enterprise scenarios with multiple business units or testing requirements.
• →Enable detailed SAML debugging by setting the 'glide.authenticate.sso.debug' system property to true temporarily during troubleshooting, which provides verbose logging of SAML processing including assertion contents and attribute mapping results. Remember to disable debug logging in production environments to avoid performance impact and sensitive data exposure in logs.
• →Implement SAML assertion caching strategies by configuring appropriate session timeouts and considering PingFederate's assertion lifetime settings to balance security requirements with user experience. Shorter assertion lifetimes increase security but may require more frequent re-authentication, while longer lifetimes improve usability but extend the window for potential security issues.

Known Limitations

• —ServiceNow's Multi-Provider SSO plugin doesn't support SAML 2.0 artifact binding, only POST and Redirect bindings, which may limit integration options with some PingFederate configurations that require artifact resolution. Organizations requiring artifact binding must implement custom SAML processing or consider alternative integration approaches.
• —The native SAML integration doesn't provide real-time user deprovisioning capabilities, meaning user accounts disabled in PingFederate or upstream identity sources won't be automatically deactivated in ServiceNow. Organizations must implement separate user lifecycle management processes or custom scheduled jobs to synchronize user status changes.
• —ServiceNow's attribute mapping capabilities are limited to simple one-to-one field mappings and don't support complex attribute transformation, concatenation, or conditional logic without custom scripting. Advanced attribute processing requirements often necessitate custom User Provisioning Scripts or Business Rules to achieve desired user profile management.
• —SAML assertion processing performance can be impacted in high-volume environments with large attribute sets or complex user provisioning scripts, potentially causing authentication delays during peak usage periods. Organizations should monitor authentication response times and optimize attribute mappings and provisioning logic accordingly.
• —The integration doesn't support dynamic service provider metadata updates, requiring manual reconfiguration in both ServiceNow and PingFederate when instance URLs, certificates, or endpoints change. This can complicate disaster recovery scenarios or instance migrations that involve URL changes.

Frequently Asked Questions