Summary

This document will guide you through the steps to enable multi-factor authentication and Single-Sign On for the online multi-tool ServiceNow (https://www.servicenow.com/) using SAML2.

This will enable usage of logins and approvals with different eIDs, such as Swedish BankID, SITHS and eIDAS.

System Requirements

• PhenixID Authentication Server 3.0 or higher
• ServiceNow instance administration rights
• The users to be federated must be present in ServiceNow (account syncronization is also possible using PhenixID Identity Provisioning).

Instruction

Overview

This document will guide you through the steps to enable multi-factor authentication and Single-Sign on for ServiceNow.

PhenixID Authentication Services acting as SAML IdP

1. Login to Configuration Manager.
2. Setup PhenixID Authentication Services as a SAML IdP using one of the Federation scenarios described here. (If the desired authentication method is not provided by a scenario, use the documentation for the SAML authenticator here)Set these properties during configuration.
   Change YOUR_PHENIXID_IDP_DOMAIN to the domain name of your PhenixID Authentication Services instance.
   – EntityID = https://YOUR_PHENIXID_IDP_DOMAIN/saml/idp/sn
   – Post SSO URL = https://YOUR_PHENIXID_IDP_DOMAIN/saml/authenticate/sn
3. Fetch the user mail value (corresponding to the ServiceNow userID) from the user store configured.
4. Use mail as Name ID attribute.
5. Save changes.
6. Click General->View SAML Metadata.
7. Save the IDP Signing Certificate as a file (follow this instruction)
8. Set Post SLO URL = https://YOUR_PHENIXID_IDP_DOMAIN/saml/authenticate/logout/
9. Save the changes
10. Copy these values from the IdP:
    1. EntityID
    2. Post SSO URL
    3. Post SLO URL

Configure ServiceNow

1. Login as a ServiceNow admin to your ServiceNow instance
2. In the left-hand menu, select System Applications->All Available Applications->All
3. Search for “Integration – Multiple Provider Single Sign-On Installer”
4. Click Install and then Activate

The next step of the ServiceNow configuration can be carried out either using a XML file downloaded from ServiceNow PhenixID MFA project (recommended) or manually.

Configure using  project XML file

1. Download XML file from the PhenixID MFA project on ServiceNow share.
2. Select System Update Sets -> Retrieved Update Sets
3. Click Import Update Set from XML
4. Click Browse and select the downloaded XML file.
5. Click Upload
6. Select SAML 2 Single sign-on->Properties.
7. 
8. Click Enable external authentication -> Yes.
9. Change YOUR_PHENIXID_IDP_DOMAIN (multiple fields) to the domain name of your PhenixID Authentication Services instance.
10. Below Service Provider properties, change the ServiceNow instance domain name to your domain.
11. Save
12. Select SAML 2 Single Sign-on -> Certificate.
13. Click SAML 2.0-PhenixID-Sign
14. Open the IDP Signing Certificate file created in previous step above. Copy all of the content.
15. Paste the content into the PEM Certificate field.
16. Click Update.

Configure manually

Once installed, a new option will appear in the left-hand menu, SAML 2 Single sign-on.

1. Select SAML 2 Single sign-on->Properties.
   
2. Change these properties:
   

   

3. Click Save.
4. Select SAML 2 Single Sign-on -> Certificate.
5. Click New
6. Open the IDP Signing Certificate file created in previous step above. Copy all of the content.
7. Paste the content into the PEM Certificate field.
8. Enter a name for the certificate, for example SAML 2.0-PhenixID-Sign.
9. Click save to create the certificate

Fetch ServiceNow SAML SP Metadata

1. Select SAML 2 Single Sign-on -> Metadata.
2. Copy all of the metadata content.
3. Create a new text file.
4. Add the header “<?xml version=”1.0″ encoding=”UTF-8”?> “
5. Paste the copied metadata. Save the file as sp_meta_sn.xml.
   Example content:

   <?xml version="1.0" encoding="UTF-8"?> 
   
   <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://dev87883.service-now.com">
   
   <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
   
   <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev87883.service-now.com/navpage.do"/>
   
   <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
   
   <AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev87883.service-now.com/navpage.do" />
   
   <AssertionConsumerService isDefault="false" index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev87883.service-now.com/consumer.do" />
   
   </SPSSODescriptor>
   
   </EntityDescriptor>

Add trust to ServiceNow on PhenixID Authentication Services

1. Login to configuration manager
2. Open Scenarios->Federation->SAML Metadata upload
3. Click the plus sign
4. Add ServiceNow SAML SP Metadata by uploading the file (sp_meta_sn.xml) created in previous step.

Login to ServiceNow instance as an admin after MFA activation

Use the URL https://<your_instance_sn>.service-now.com/side_door.do to login with your ServiceNow admin account.

Test

1. Browse to your ServiceNow instance domain.
2. This should result in a redirect to PhenixID Authentication Server
3. Authenticate
4. If authentication was successful, a redirect to ServiceNow should occur (with SAML assertion)
5. The user should now be logged in.