Configure ServiceNow for UserLock Single Sign-On (SSO)

This guide explains how to integrate ServiceNow with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, ServiceNow logins are authenticated by UserLock against Active Directory. This provides a seamless login experience and allows administrators to apply UserLock access policies (MFA, time, machine, or location restrictions) on SSO sessions.

🚩️ Before starting:

• You need a ServiceNow administrator account.

• UserLock SSO must already be installed and configured.

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

2. In the list of applications, select ServiceNow.

3. Fill in the fields with the following values:
   

   Settings	Values
   Application Domain	https://<yourInstance>.service-now.com (the domain of your ServiceNow instance)
   Email domain	Domain used by users to authenticate (e.g. contoso.com)

4. Save the profile.

1. Ensure the Multi-Provider SSO plugin is installed:

   • In the ServiceNow search box, type Multi-Provider SSO.

   • If it’s not listed, go to System Definition ▸Plugins.

   • Search for Integration - Multiple Provider Single Sign-On Installer and install or activate it.

2. Log in to ServiceNow with an administrator account.

3. Navigate to Multi-Provider SSO ▸Identity Providers, then click New.

4. When prompted for the SSO type, select SAML.

5. In the Import Identity Provider Metadata dialog box, choose URL and enter:
   https://<SSO_domain>/metadata
   
   

   

   
   

6. Click Import.

   • If an error occurs during import:

     1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

     2. Click on Download ▸ Metadata file

     3. Open the downloaded file with a text editor (e.g. Notepad) and copy its contents.

     4. Return to the ServiceNow console, select XML in the import dialog, and paste the content.

7. Once imported, verify that all fields are populated correctly.
   

   

   
   

8. Click Test Connection.

   • If the test is successful, click Activate.

   • If activation fails:

     1. Clear the SingleLogoutRequest field in the Identity Provider settings.

     2. Run the Test Connection and Activate process again.

     3. Once successful, you can re-enter the SingleLogoutRequest URL:
        https://<SSO_domain>/connect/endsession

     
     

     Note

     The SingleLogoutRequest field is optional. Keeping it blank during setup helps display more detailed error messages.

9. In the Identity Provider record, under Related Links, click Set as Auto Redirect IDP to redirect to UserLock SSO the users accessing your instance homepage.

10. Activate the SSO

    1. Navigate to Multi-Provider SSO ▸Administration ▸Properties.

    2. Click Enable multi provider SSO.

For common issues, see Troubleshooting SSO.
If the problem persists, please contact IS Decisions Support.

• To disable SSO temporarily:

  1. Open the Identity Provider configuration in ServiceNow.

  2. Click Deactivate.

• To bypass SSO and log in with standard credentials:

  1. Go to https://<yourInstance>.service-now.com/side_door.do

  2. You’ll be redirected to the default ServiceNow login page where you can sign in using ServiceNow credentials.

• The user account may not exist in ServiceNow.

• Alternatively, the SAML certificate may be outdated.

This can occur when testing with a non-existent user.
To update a configuration after a successful test:

1. Deactivate the identity provider.

2. Update the configuration.

3. Run Test Connection.

4. Click Activate again.

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

• Apply MFA on SaaS connections to require stronger authentication.

• Hour restrictions: define when users are allowed to connect.

• Geolocation rules: enforce access policies based on user location.

• Session limits: allow or deny SaaS logins entirely for specific users.