Shibboleth & Evergreen ServiceNow

[Cantor, Scott]

On 7/30/13 10:37 AM, "James A. Jokl" <jaj at virginia.edu> wrote:

>On the "references/pointers" question, I had been after something
>from them saying that they support SAML/Shib and have sites in
>production.  The people we were talking to made SAML/Shib sound
>new/probably-doable/maybe-OK as opposed to that they had
>documentation done and sites in production.

I can't speak for anybody but us, but we've used it for a while. I can say
now that they had numerous security issues in their implementation, and I
spent time talking to them about it to get it fixed, which they did
reasonably quickly.

It left me keenly aware that any time I deal with a vendor rolling their
own code I should assume it's broken and insist on auditing it.

>If anyone has pointers to their documentation, I'd love to show it
>to them.

http://wiki.servicenow.com/index.php?title=SAML_2.0_Web_Browser_SSO_Profile

That appears to be much more extensive than when I used it, so I can't say
what it all says at this point.

-- Scott