Working with Service Now

[Ian Bobbitt]

I'm trying to get my IdP (running 3.2.1) talking with Service Now. Their docs indicate that they only look at the
NameID, not any regular attributes like I'm used to with the Shibboleth SP. Is anyone who's worked with Service Now
willing to share what worked for them?

The login dies on my IdP, after logging in and before redirecting back. This is all I get in my logs with normal logging
levels:

2016-06-02 19:24:07,102 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing
the request: ContextCheckDenied

I believe what I have below is my relevant config bits. I do have logs from turning everything to DEBUG that I can post,
but it's quite large. If there's a better set to debug than "everything", that would help.

attribute-filter.xml:
        <AttributeFilterPolicy id="ServiceNow">
                <PolicyRequirementRule xsi:type="OR">
                        <Rule xsi:type="Requester" value="https://dev25187.service-now.com" />
                        <Rule xsi:type="Requester" value="https://indianau.service-now.com" />
                        <Rule xsi:type="Requester" value="https://indianaudev.service-now.com" />
                        <Rule xsi:type="Requester" value="https://indianautest.service-now.com" />
                </PolicyRequirementRule>
                <AttributeRule attributeID="eduPersonPrincipalName">
                        <PermitValueRule xsi:type="ANY" />
                </AttributeRule>
        </AttributeFilterPolicy>

relying-party.xml:
    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://indianau.service-now.com',
'https://indianaudev.service-now.com', 'https://indianautest.service-now.com', 'https://dev25187.service-now.com'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:postAuthenticationFlows="context-check"
                                             p:encryptAssertions="false"
                                             p:includeAttributeStatement="false"
                                             p:signAssertions="false"
                                             p:encryptNameIDs="false"

p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}" />
                </list>
            </property>
        </bean>
    </util:list>

saml-nameid.xml:
    <util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }" />
    </util:list>

metadata:
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://dev25187.service-now.com">
     <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://dev25187.service-now.com/navpage.do" />
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dev25187.service-now.com/navpage.do" />
        <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dev25187.service-now.com/consumer.do"/>
    </SPSSODescriptor>
</EntityDescriptor>

-- 
Ian