ServiceNow SAML SSO Setup Guide

Architecture Overview

Implementation Steps

// Business Rule to handle custom SAML attribute mapping
(function executeRule(current, previous /*null when async*/) {
    // Custom logic for SAML user provisioning
    if (current.active && current.source == 'saml') {
        // Map custom SAML attributes
        var samlAttrs = current.saml_attributes || '{}';
        var attributes = JSON.parse(samlAttrs);
        
        // Set department based on SAML attribute
        if (attributes.department) {
            var deptGR = new GlideRecord('cmn_department');
            deptGR.addQuery('name', attributes.department);
            deptGR.query();
            if (deptGR.next()) {
                current.department = deptGR.getUniqueValue();
            }
        }
    }
})(current, previous);

// Debug script for SAML assertion troubleshooting
var samlUtil = new SamlUtil();
var assertion = 'paste_base64_assertion_here';

// Decode and parse SAML assertion
var decodedAssertion = GlideStringUtil.base64Decode(assertion);
gs.print('Decoded SAML Assertion: ' + decodedAssertion);

// Check attribute extraction
var attributes = samlUtil.extractAttributes(decodedAssertion);
for (var attr in attributes) {
    gs.print('Attribute: ' + attr + ' = ' + attributes[attr]);
}

// Validate signature
var isValid = samlUtil.validateSignature(decodedAssertion, 'certificate_sys_id');
gs.print('Signature valid: ' + isValid);

// Script Include for custom SAML session validation
var SAMLSessionValidator = Class.create();
SAMLSessionValidator.prototype = {
    initialize: function() {
        this.maxSessionAge = gs.getProperty('glide.ui.session_timeout', '120') * 60000; // Convert to milliseconds
    },
    
    validateSAMLSession: function(sessionID) {
        var session = gs.getSession();
        var samlLoginTime = session.getProperty('saml_login_time');
        
        if (!samlLoginTime) {
            return false;
        }
        
        var currentTime = new Date().getTime();
        var loginTime = parseInt(samlLoginTime);
        
        return (currentTime - loginTime) < this.maxSessionAge;
    },
    
    type: 'SAMLSessionValidator'
};

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom Business Rules on the sys_user table with condition 'source=saml' to handle complex attribute mapping scenarios that exceed standard field mappings, such as parsing composite SAML attributes or performing lookup operations against external systems during user provisioning. Use GlideRecord queries within these rules to populate reference fields with proper sys_id values rather than display values, ensuring data integrity and proper relationship establishment.
• →Configure SAML assertion encryption in addition to signing for highly sensitive environments by generating encryption certificates in ServiceNow and providing the public key to your IdP for assertion encryption. This provides defense-in-depth protection for sensitive user attributes transmitted in SAML assertions, particularly important for healthcare, financial, or government implementations where additional data protection is required beyond standard TLS transport encryption.
• →Establish automated certificate monitoring by creating scheduled jobs that check SAML certificate expiration dates and send notifications to administrators 30-60 days before expiration. Create custom notifications that include certificate details and renewal procedures to prevent authentication outages caused by expired certificates, and maintain a certificate renewal runbook that includes both ServiceNow and IdP certificate update procedures.
• →Implement Just-In-Time (JIT) role provisioning by creating custom scripts that evaluate SAML attributes like group memberships or clearance levels to dynamically assign ServiceNow roles during authentication. This approach ensures users receive appropriate access permissions based on current IdP group memberships without requiring manual role management, particularly valuable for organizations with frequent role changes or project-based access requirements.
• →Use ServiceNow's REST API endpoints to programmatically validate SAML configuration and test authentication flows as part of continuous integration pipelines. Create automated tests that verify IdP metadata accessibility, certificate validity, and sample assertion processing to catch configuration drift or environmental issues before they impact production authentication, integrating these tests with your organization's monitoring and alerting infrastructure.
• →Configure multiple authentication methods as fallback options by maintaining local administrator accounts and enabling emergency access procedures that bypass SAML authentication during IdP outages. Document emergency authentication procedures and test failover scenarios regularly to ensure business continuity during identity provider maintenance windows or unexpected service disruptions, while maintaining proper security controls for emergency access usage.

Known Limitations

• —ServiceNow's native SAML implementation supports only SAML 2.0 protocol and requires IdPs to sign assertions (not just responses), which may necessitate additional IdP configuration or prevent integration with legacy identity providers that only support SAML 1.1 or response-only signing capabilities. Organizations using older IdP versions may need to upgrade or implement additional federation components to achieve compatibility.
• —Attribute mapping is limited to direct field assignments and cannot perform complex transformations or lookups during the authentication process without custom Business Rules, making it challenging to handle composite attributes or perform real-time data enrichment from external systems. Advanced scenarios like mapping SAML groups to ServiceNow roles based on complex business logic require custom development and may impact authentication performance.
• —ServiceNow does not support SAML artifact binding or SAML metadata auto-refresh, requiring manual certificate and configuration updates when IdP settings change, which can create maintenance overhead for large organizations with frequent certificate rotation policies. Certificate expiration or metadata changes require coordinated updates between ServiceNow and IdP administrators to prevent authentication disruptions.
• —Session management between ServiceNow and IdP is not fully synchronized, potentially leading to scenarios where users remain authenticated to one system after logging out of the other, requiring careful configuration of session timeouts and logout URLs to achieve consistent behavior. Organizations with strict security requirements may need to implement additional session monitoring and forced re-authentication mechanisms.
• —Multi-IdP configurations require the com.glide.authenticate.multisso plugin and cannot automatically route users to appropriate IdPs based on email domains or other attributes without custom development, limiting flexibility for organizations with complex identity provider architectures or acquisition scenarios where different user populations use different IdPs.

Frequently Asked Questions