ServiceNow Multi-Provider SSO integration follow-up

[Paul B. Henson]

On Thu, Jul 10, 2014 at 06:06:58PM -0700, Nate Klingenstein wrote:
>    How on Earth did you trip over that rock?  I would like to help some
>    others trip over it too.

It's kind of funny; as I mentioned, I had initially implemented the
previously documented custom nameid kludge, and the ServiceNow side was
complaining it couldn't find a user matching what I was submitting. I
don't think the consulting group our management contracted to set this
up for us is that familiar with SAML/shibboleth (definitely not with the
new Multi-SSO module), and it seems while they were tweaking various
things they accidentally turned on the option to have it look for an
attribute rather than use the nameid, and since we were not passing any
attributes it was failing.                                                                        
The guy working on our configuration got back to me and told me why it
hadn't been working and that he had switched back to just use the
nameid. At which point I said something along the lines of "What? You
can use attributes? Put it back! Use this one!" :).                                                        
And that ended up working, which made me less unhappy about the whole
project, as we ended up only needing to kludge the relying-party
configuration file, instead of it and both attribute configuration
files. If they wouldn't have accidentally fiddled with that option they
didn't understand, the nameid piece would've worked from the beginning,
and I would never have found out about this functionality.                                                                  
Anyway, I followed up with the consultant, and he told me:                      

"There are a couple of pre-requisites for this. They must be on the
Eureka release of ServiceNow and they must have the multi-provider SSO
plugin activated.                                                                      
Then in ServiceNow, goto Multi-Provider SSO > Single Sign-On Properties
and open the appropriate property record. There's a field on the form
called NameID Attribute. If thats empty the process will look for the
NameID value in the Subject. If that field has a value in it the process
will look for an AttributeStatement with a name (or friendly name)
matching whats in the field." 


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.csupomona.edu/~henson/
Operating Systems and Network Analyst  |  henson at csupomona.edu
California State Polytechnic University  |  Pomona CA 91768