Issues Setting up SAML2 with ServiceNow

Sacilowski, Tadeusz ts2878 at tc.columbia.edu
Tue Mar 10 21:22:58 EDT 2015 

Hi All,

Teachers College is in the process of implementing ServiceNow using
Shibboleth and CAS as our authentication provider. We've been successfully
using Shibboleth with a handful of other services (25Live, Gartner/SSOFed,
Tableau), but setting up ServiceNow has proven to be a bit more daunting.

I've gotten part of the process to work (i.e. it successfully redirects to
our login page) but something is failing along the way. Here are pieces of
my relying-party.xml:

I have "signResponses" and "signAssertions" set to "true" all across the
board

<!-- ServiceNow (TCDEV) Metadata -->
<metadata:MetadataProvider xsi:type="metadata:FilesystemMetadataProvider"
                id="FileMD_ServiceNow_TCDEV"

metadataFile="/opt/luminis/shibboleth/shib-home/metadata/servicenow-tcdev-metadata.xml">
</metadata:MetadataProvider>

This is the metadata generated by ServiceNow (referenced above):

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="
https://tcdev.service-now.com">
    <SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true"

protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>
                        [REDACTED]
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                             Location="
https://tcdev.service-now.com/navpage.do" />


<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <AssertionConsumerService isDefault="true" index="0"

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                  Location="
https://tcdev.service-now.com/navpage.do" />

        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                  Location="
https://tcdev.service-now.com/consumer.do"/>
    </SPSSODescriptor>
</EntityDescriptor>


Here are idp-process.log entries:

Loading metadata:

10:35:04.506 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:253]
- Beginning refresh of metadata from
'/opt/luminis/shibboleth/shib-home/metadata/servicenow-tcdev-metadata.xml'
10:35:04.506 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:257]
- Metadata from
'/opt/luminis/shibboleth/shib-home/metadata/servicenow-tcdev-metadata.xml'
has not changed since last refresh
10:35:04.507 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:322]
- Computing new expiration time for cached metadata from
'/opt/luminis/shibboleth/shib-home/metadata/servicenow-tcdev-metadata.xml
10:35:04.507 - INFO
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:271]
- Next refresh cycle for metadata provider
'/opt/luminis/shibboleth/shib-home/metadata/servicenow-tcdev-metadata.xml'
will occur on '2015-03-10T17:35:04.506Z' ('2015-03-10T13:35:04.506-04:00'
local time)

Beginning of auth process:

12:25:16.112 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] -
Returning control to authentication engine
12:25:16.121 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] -
Processing incoming request
12:25:16.121 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] -
Completing user authentication process
12:25:16.122 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] -
Validating authentication was performed successfully
12:25:16.125 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] -
Updating session information for principal ts2878
12:25:16.125 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700] -
Creating shibboleth session for principal ts2878
12:25:16.129 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:815] -
Adding IdP session cookie to HTTP response
12:25:16.131 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:715] -
Recording authentication and service information in Shibboleth session for
principal: ts2878
12:25:16.134 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560] -
User ts2878 authenticated with method
urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
12:25:16.135 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] -
Returning control to profile handler
12:25:16.135 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:177] -
Redirecting user to profile handler at
https://shib.tc.columbia.edu:443/idp/profile/SAML2/Redirect/SSO
<https://shib.tc.columbia.edu/idp/profile/SAML2/Redirect/SSO>
12:25:16.143 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request path:
/SAML2/Redirect/SSO
12:25:16.143 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following type
for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
12:25:16.144 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:588] -
Unbinding LoginContext
12:25:16.144 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:614] -
Expiring LoginContext cookie
12:25:16.145 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:625] -
Removed LoginContext, with key
790a93a251d28542b262e70a9acf9a4ab5a1ed1a6f7cd43bff5dc03705e64d3d, from
StorageService partition loginContexts
12:25:16.145 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:172]
- Incoming request contains a login context and indicates principal was
authenticated, processing second leg of request
12:25:16.145 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.146 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.146 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] -
Metadata document does not contain an EntityDescriptor with the ID
https://tcdev.service-now.com

Why is Shibboleth not finding the entityID in the metadata... I've verified
that there are no typos in the entityID

12:25:16.321 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:572]
- Determining if SAML assertion to relying party '
https://tcdev.service-now.com' should be signed
12:25:16.322 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:653]
- IdP relying party configuration 'default' indicates to sign assertions:
true
12:25:16.322 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:583]
- Determining signing credntial for assertion to relying party '
https://tcdev.service-now.com'
12:25:16.322 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:599]
- Signing assertion to relying party https://tcdev.service-now.com
12:25:16.327 - DEBUG [org.opensaml.common.SAMLObjectHelper:56] - Examing
signed object for content references with exclusive canonicalization
transform
12:25:16.328 - DEBUG [org.opensaml.common.SAMLObjectHelper:70] - Saw
exclusive transform, declaring non-visible namespaces on signed object
12:25:16.332 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request path:
/Metadata/SAML
12:25:16.333 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following type
for the request path:
edu.internet2.middleware.shibboleth.idp.profile.SAMLMetadataProfileHandler
12:25:16.334 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:100] - Starting to
marshall {http://www.w3.org/2000/09/xmldsig#}Signature
12:25:16.335 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:103] - Creating
XMLSignature object
12:25:16.336 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:113] - Adding content
to XMLSignature.
12:25:16.336 - DEBUG
[org.opensaml.common.impl.SAMLObjectContentReference:173] - Adding list of
inclusive namespaces for signature exclusive canonicalization transform
12:25:16.338 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:118] - Creating
Signature DOM element
12:25:16.344 - DEBUG [org.opensaml.xml.signature.Signer:76] - Computing
signature over XMLSignature object
12:25:16.372 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:274]
- Attempting to encrypt assertion to relying party '
https://tcdev.service-now.com'
12:25:16.376 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:279]
- Assertion to be encrypted is:



12:25:16.379 - DEBUG [org.opensaml.security.MetadataCredentialResolver:167]
- Forcing on-demand metadata provider refresh if necessary
12:25:16.380 - DEBUG [org.opensaml.security.MetadataCredentialResolver:215]
- Attempting to retrieve credentials from cache using index: [
https://tcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
12:25:16.381 - DEBUG [org.opensaml.security.MetadataCredentialResolver:232]
- Unable to retrieve credentials from cache using index: [
https://tcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
12:25:16.381 - DEBUG [org.opensaml.security.MetadataCredentialResolver:252]
- Attempting to retrieve credentials from metadata for entity:
https://tcdev.service-now.com
12:25:16.381 - DEBUG [org.opensaml.security.MetadataCredentialResolver:324]
- Retrieving metadata for entity 'https://tcdev.service-now.com' in role
'{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol
'urn:oasis:names:tc:SAML:2.0:protocol'
12:25:16.381 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.382 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.382 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://tcdev.service-now.com
12:25:16.383 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://tcdev.service-now.com
12:25:16.383 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entityhttps://tcdev.service-now.com
12:25:16.383 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.384 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.384 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://tcdev.service-now.com
12:25:16.385 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://tcdev.service-now.com
12:25:16.385 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entityhttps://tcdev.service-now.com
12:25:16.385 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.386 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.387 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://tcdev.service-now.com
12:25:16.387 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://tcdev.service-now.com
12:25:16.388 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entityhttps://tcdev.service-now.com
12:25:16.388 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.388 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.389 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://tcdev.service-now.com
12:25:16.389 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://tcdev.service-now.com
12:25:16.390 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entityhttps://tcdev.service-now.com
12:25:16.390 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.390 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.391 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://tcdev.service-now.com
12:25:16.391 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://tcdev.service-now.com
12:25:16.392 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entityhttps://tcdev.service-now.com
12:25:16.392 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] -
Checking child metadata provider for entity descriptor with entity ID:
https://tcdev.service-now.com
12:25:16.392 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of
https://tcdev.service-now.com
12:25:16.393 - DEBUG [org.opensaml.security.MetadataCredentialResolver:357]
- Added new credential collection to cache with key: [
https://tcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
12:25:16.393 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria
for criteria class org.opensaml.xml.security.criteria.UsageCriteria
12:25:16.394 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria
for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria
12:25:16.394 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:105]
- Registry could not locate evaluable criteria for criteria class
org.opensaml.security.MetadataCriteria
12:25:16.395 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria
for criteria class org.opensaml.xml.security.criteria.KeyAlgorithmCriteria
12:25:16.395 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
- Could not resolve a key encryption credential for peer entity:
https://tcdev.service-now.com
12:25:16.408 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
- Unable to construct encrypter

Not sure where else to look in order to troubleshoot. Any suggestions would
be greatly appreciated.

-- 
*Tadeusz Sacilowski*
*Manager, Portal & Mobile Development*
Teachers College, Columbia University
sacilowski at tc.columbia.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150310/dce879f4/attachment-0001.html

More information about the users mailing list