How to configure single sign-on (SSO) for ServiceNow

ManageEngine ADSelfService Plus supports AD-based SSO for ServiceNow and other SAML-enabled applications. After enabling ServiceNow SSO in ADSelfService Plus, users only need to log in to their Windows machines with their AD domain credentials to run it. Once logged in, users can securely access ServiceNow in one click without having to enter their usernames and passwords again.

Benefits of enterprise SSO

ADSelfService Plus' ServiceNow SSO capabilities

ADSelfService Plus supports both Identity Provider and Service Provider-initiated SSO for ServiceNow.

Identity provider-initiated SSO for ServiceNow: Users need to log in to the ADSelfService Plus' end-user portal, and then click on the ServiceNow icon on the Applications dashboard to access ServiceNow.

Service provider-initiated SSO for ServiceNow: Users can access their ServiceNow domain via an URL or a bookmark. They will automatically be redirected to the ADSelfService Plus portal for login. Once the users are signed in, they'll be automatically redirected and logged in to the ServiceNow portal.

Step-by-step guide for ServiceNow SSO configuration

Before you begin

Download and install ADSelfService Plus if you haven’t already.

Configuring your Active Directory domain in ADSelfService Plus

With ADSelfService Plus, you can use the existing AD domain credentials of users for authentication during single sign-on. First you need to configure the AD domains in ADSelfService Plus to enable SSO for ServiceNow.

ADSelfService Plus will try to automatically add all the domains that it can discover in your network. If your domains are automatically added, skip to Step 9; otherwise, follow Steps 1-8 to add them manually.

1. Launch the ADSelfService Plus web console and log in using admin credentials.
2. Click the Domain Settings link available on the top-right corner of the application.
3. Click the Add New Domain link.

   

4. In the Add New Domain window, enter the name of the domain you want to add in the Domain Name field.
5. In the Add Domain Controllers field, click Discover. ADSelfService Plus will try to automatically discover the domain controllers associated with the domain.
6. If the domains are not auto-discovered, then enter the domain controller name in the field provided, and click Add.
7. You can leave the authentication fields empty if you're not going to use the end user self-service features of ADSelfService Plus.

   

8. Back in the Add New Domain window, click Save to complete adding the Active Directory domain in ADSelfService Plus.

Getting the SAML details from ADSelfService Plus

9. Go to Configuration →Password Sync/Single Sign On → Add Applications, and select ServiceNow from the applications displayed.
10. Click IdP Details in the top-right corner of the screen.

    

11. In the pop-up that appears, click Download IdP Metadata file and save the XML file. Open the file in a text editor and copy its content.

ServiceNow SAML configuration

12. Log in to ServiceNow with administrator credentials.
13. Click the Start Building icon.

    

14. Copy the instance URL and login to your ServiceNow instance.



15. In the left pane, navigate to Multi-Provider SSO → Identity Providers and then click New.
    Note: If Multi-Provider SSO plugin is not activated in your instance, please follow these steps.

    

16. In the What kind of SSO are you trying to create? section, select SAML.

    

17. In the Import Identity Provider Metadata pop up that appears, select XML and paste the XML file content you had copied in Step 11.

    

18. Click Import.

    

19. All the required fields will be auto-filled. Scroll down and click the Advanced tab. Make sure in the User Field, that the value “email” is entered.

    

20. Click Test Connection. You will be asked to log into ADSelfService Plus.
21. Once the connection is successful, click Activate.
22. Now click on the Additional Actions icon from the identity provider title menu, select Copy sys_id. Paste the value in a note and keep it safe.

    

23. In the left pane, navigate to Multi-Provider SSO → Administration → Properties.
24. Make sure that Enable multiple provider SSO in enabled.
25. In the field for user identification, change "user_name" to email as the value.

    

26. Click Save.
27. In the left pane, navigate to User Administration → Users.

    

28. Select a user for whom you want to enable SSO and click his/her username.
29. Now click the Additional Actions icon and select Configure → Form Design.

    

30. Drag and drop the SSO source field from the left pane into the user’s form and click Save.
31. In the SSO source field, paste the sys_id you had copied in step 22. Append “sso:” before the sys_id value. For example, if the sys_id copied is "23dc968f0a0a3c1900534f399927740e", after appending sso the new value to be updated in SSO source field will be "sso:23dc968f0a0a3c1900534f399927740e".

    

32. Click Update.
33. Repeat steps 28-33 for other users to whom you want to enable SSO.

Adding your ServiceNow domain in ADSelfService Plus and enabling single sign-on.

34. Now switch back to ADSelfService Plus.
35. Go to the ServiceNow SSO configuration page.
36. In the SAML Redirect URL field, enter the instance URL from step 14.
37. In the Instance Name field, enter the domain name for which you enabled SSO. For example, if you use johndoe@thinktodaytech.com to log in to ServiceNow, then thinktodaytech.com is the domain name.
38. In the Application Name field, provide an appropriate display name.
39. In the Assign Policies field, click the drop-down box and select the policies for which you wish to enable SSO. The policies you select will determine which SSO features users will have enabled.
40. Click Add Application.

    

Your users can now log into their ServiceNow accounts automatically using single sign-on.