ServiceNow "Multi-Provider SSO"

[Paul B. Henson]

So evidently our ServiceNow environment has been updated to the release including the new multi-provider SSO functionality as pioneered by CMU. I was assuming this functionality would make things nice and simple like many of our other shibboleth integrations for service providers supporting InCommon; I was expecting that they would give me the entityid of their SP in the incommon metadata, and I would release the unique identifier attribute we want to use to join to the ServiceNow database.

However, the consultants they hired to do the ServiceNow side have been spinning in circles and made no progress at getting it to work. I started to dig through the documentation myself:

http://wiki.servicenow.com/index.php?title=Multiple_Provider_Single_Sign-On

On that page, to actually configure an SSO instance, it points you to:

http://wiki.servicenow.com/index.php?title=SAML_2.0_Web_Browser_SSO_Profile#SAML_2.0_Setup

Which seems to be the same hardcoded crap and kludgy custom nameid attribute generation that we were looking at before the multi-provider SSO implementation?

Unless there are some other early adopters out there, I'm guessing there's only one person on this list who actually has this working ;). Michael, could I trouble you to clarify how this is supposed to work :)? Do we still need to hardcode ServiceNow metadata on the idp side and provide them a custom nameid attribute? Going back to look at your original email mentioning it, I see you said "Getting them to publish into InCommon MD was a secondary concern", does that mean that the new implementation should automatically know about our idp metadata from the incommon feed, but we still need to maintain theirs in an ad hoc fashion?

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.csupomona.edu/~henson/
Operating Systems and Network Analyst  |  henson at csupomona.edu
California State Polytechnic University  |  Pomona CA 91768