John James Andersen http://www.john-james-andersen.com The Personal & Professional Website Tue, 15 May 2012 17:21:26 +0000 en hourly 1 http://wordpress.org/?v=3.3.2 Using the ServiceNow JDBCProbe http://www.john-james-andersen.com/blog/service-now/using-the-servicenow-jdbcprobe.html http://www.john-james-andersen.com/blog/service-now/using-the-servicenow-jdbcprobe.html#comments Tue, 15 May 2012 17:21:26 +0000 John Andersen http://www.john-james-andersen.com/?p=1461

There is a lesser known JDBC integration interface to ServiceNow than is generally published to the outside world, but it can make JDBC integrations go much smoother that traditionally supported in the ServiceNow product.

A typical JDBC integration in ServiceNow is usually a data pull from a third party into ServiceNow through a one-time or scheduled JDBC pull using a Data Source record. This works great for bringing bulk data from an external source into ServiceNow.

What if, however, you want a more transactional data pull…or even to set data in the external database using JDBC? There is a way to do this by creating XML payloads on the ECC queue. There is some pretty good ECC Queue – JDBC Probe documentation on the wiki. This can be cumbersome, however to build ECC Queue records with XML documents for the queries you wish to make. There is a much easier way!

Unfortunately, what I am about to demonstrate does not come with a vanilla instance, but requires the “Integration – JDBC” plugin. Just request the plugin for your instance via HI, or through your account representative. It is a small plugin that can be enabled in a matter of seconds by ServiceNow.

The plugin will create, among other things, a Script Include called “JDBCProbe”. This script include creates an API for generating the XML payloads on the ECC Queue so that you don’t have to worry about how to represent SQL statements in XML.

JDBCProbe API Basics

Every JDBCProbe API call will require some initial parameters and values.

MID Server: The JDBCProbe requires a MID Server for execution. Specify the name of the MID Server as it it shown in the MID Server list.

Here is what my MID Server list looks like:

I am going to use my MID Server, “DEB1″ for these examples.

Driver: You need to specific the JDBC Driver that will be used to make the JDBC call. This is specific to the type of Database you are calling into. For this example, I am using a MySQL database. Thus, the driver string is: “com.mysql.jdbc.Driver”. Other valid OOB driver classes are:

Oracle: oracle.jdbc.OracleDriver
Microsoft SQL Server: com.microsoft.sqlserver.jdbc.SQLServerDriver
MySQL: com.mysql.jdbc.Driver
Sybase: com.sybase.jdbc3.jdbc.SybDriver
IBM DB2 Universal: com.ibm.db2.jcc.DB2Driver

Connection String: The JDBC protocol uses a connection string to establish the authentication and other parameters to establish a connection between the client and the Database. Each Database has its own connection string format. Here is a list taken from the ServiceNow JDBCProbe wiki for setting up your connection string:

Oracle: [jdbc:oracle:thin:@]
Microsoft SQL Server: [jdbc:sqlserver://localhost;user=MyUserName;password=*****;]
MySQL: [jdbc:mysql://localhost/database?user=username%26password=passwd]
Sybase: [jdbc:sybase:Tds:10.10.11.162:4100/NCOMS?user=yyy%26password=xxx]
DB2 Universal: [jdbc:db2://sysmvs1.stl.ibm.com:5021/san_jose:user=db2adm;password=db2adm]

Function: This tells the JDBCProbe what type of query you intend to do with the database. Supported functions are: “insert”, “select”, “update”, “delete”.

JDBCProbe API Functions

The following is a list of the functions available by the JDBCProbe Script Include:

JDBCProbe( string MIDServer ) //Constructor
Constructor for the JDBCProbe class. The MIDServer parameter is the name of the MID Server which will be issuing the database commands.

1
var j = new JDBCProbe("DEB1");

setDriver( string Driver )
Sets the driver class corresponding to the brand of database with which you are connecting.

1
2
var j = new JDBCProbe("DEB1");
j.setDriver("com.mysql.jdbc.Driver");

setConnectionString( string connectionString )
Sets the connection string appropriate for the brand of database with which you are connecting.

1
2
var j = new JDBCProbe("DEB1");
j.setConnectionString("jdbc:mysql://mysqlserver.org/snctestdb?user=MyUsername&password=MyPassword");

setTable( string tablename )
Indicates which table we will query against.

1
2
var j = new JDBCProbe("DEB1");
j.setTable("incident");

setFunction( string function )
Sets the query function being used. Supported functions are “select”, “insert”, “update”, “delete”.

1
2
var j = new JDBCProbe("DEB1");
j.setFunction("insert");

addField( string fieldName, string fieldValue )
Adds a field on the insert query. You should provide both the fieldName as well as the value.

1
2
3
4
5
6
7
var j = new JDBCProbe("DEB1");
j.setDriver("com.mysql.jdbc.Driver");
j.setConnectionString("jdbc:mysql://mysqlserver.org/snctestdb?user=MyUsername&password=MyPassword");
j.setTable("incident");
j.setFunction("insert");
j.addField("priority", "1");
j.create();

addNumberField( string fieldName, string fieldValue )
Adds a field formatted for numbers on the insert query. You should provide both the fieldName as well as the value.

1
2
3
4
5
6
7
var j = new JDBCProbe("DEB1");
j.setDriver("com.mysql.jdbc.Driver");
j.setConnectionString("jdbc:mysql://mysqlserver.org/snctestdb?user=MyUsername&password=MyPassword");
j.setTable("incident");
j.setFunction("insert");
j.addNumberField("priority", 1);
j.create();

create( )
Creates the JDBCProbe entry on the ECC Queue table for processing.

1
2
3
4
5
6
7
var j = new JDBCProbe("DEB1");
j.setDriver("com.mysql.jdbc.Driver");
j.setConnectionString("jdbc:mysql://mysqlserver.org/snctestdb?user=MyUsername&password=MyPassword");
j.setTable("incident");
j.setFunction("insert");
j.addField("priority", "1");
j.create();

setWhereClause( string whereClause)
Allows you to set a string representing the “Where” clause for a select, update, or delete query.

1
2
3
4
5
6
7
var j = new JDBCProbe("DEB1");
j.setDriver("com.mysql.jdbc.Driver");
j.setConnectionString("jdbc:mysql://mysqlserver.org/snctestdb?user=MyUsername&password=MyPassword");
j.setTable("incident");
j.setFunction("select");
j.setWhereClause("priority='1'");
j.create();

setDataSource( string dataSourceSysId )
This allows you to have all JDBC settings and query information come from a datasource rather than your script. You will need to pass in the sys_id to the data source record containing this information.

1
2
3
var j = new JDBCProbe("DEB1");
j.setDataSource("11e091bf0a258102005ba7a71b145a8a");
j.create();

ECC Queue Records

Once you execute your script and end it with the create() function, an “output” record will be placed on the ECC Queue. This output record will contain all of the data set through the script.

Once the MID Server grabs the output record, it will execute the query and then return the JDBC response message back via an “input” record on the ECC Queue corresponding to the original ECC Queue entry.

INSERT example

The following code will insert a row in a table called “incident” on a MySQL server that I have:

1
2
3
4
5
6
7
8
9
10
var j = new JDBCProbe('DEB1');
j.setDriver('com.mysql.jdbc.Driver');
j.setConnectionString('jdbc:mysql://mySqlServer.org/snctest?user=MyUser&password=MyPassword');
j.setTable("incident");
j.setFunction("insert");
j.addField("summary", "My chair will not roll smoothly");
j.addNumberField("priority", 1);
j.addField("urgency", "2");
j.addField("impact", "1");
j.create();

This code creates an output record on the ECC Queue that has the following Payload:

1
2
3
4
5
6
7
8
9
10
11
12
<parameters>
  <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
  <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&password=sncrocks"/>
  <parameter name="work">
    <insert table="incident">
      <summary>My chair will not roll smoothly</summary>
      <impact>1</impact>
      <urgency>2</urgency>
      <priority quoted="false">1</priority>
    </insert>
  </parameter>
</parameters>

The result is created by the MID Server on the ECC Queue. Here is the Payload of the result:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
<?xml version="1.0" encoding="UTF-8"?>
<results probe_time="6449">
  <result>
    <insertResult>1 rows inserted</insertResult>
  </result>
  <result/>
  <parameters>
    <parameter name="topic" value="JDBCProbe"/>
    <parameter name="work" value="&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;work&gt;&lt;insert table=&quot;incident&quot;&gt;&lt;summary&gt;My chair will not roll smoothly&lt;/summary&gt;&lt;impact&gt;1&lt;/impact&gt;&lt;urgency&gt;2&lt;/urgency&gt;&lt;priority quoted=&quot;false&quot;&gt;1&lt;/priority&gt;&lt;/insert&gt;&lt;/work&gt;"/>
    <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
    <parameter name="queue" value="output"/>
    <parameter name="error" value=""/>
    <parameter name="from_sys_id" value=""/>
    <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
    <parameter name="sys_id" value="80d4367b507da0006d49b2e21aafd57a"/>
    <parameter name="state" value="ready"/>
    <parameter name="from_host" value=""/>
    <parameter name="agent" value="mid.server.DEB1"/>
    <parameter name="processed" value=""/>
    <parameter name="ecc_queue" value="80d4367b507da0006d49b2e21aafd57a"/>
    <parameter name="response_to" value=""/>
    <parameter name="source" value=""/>
    <parameter name="sequence" value="1373db366fe0000001"/>
    <parameter name="name" value="JDBCProbe"/>
    <parameter name="table_name" value="ecc_queue"/>
    <parameter name="agent_correlator" value=""/>
  </parameters>
</results>

UPDATE example

The following code will update all incidents in my database that have a priority of 1. It will set the urgency field to 4.

1
2
3
4
5
6
7
8
var j = new JDBCProbe('DEB1');
j.setDriver('com.mysql.jdbc.Driver');
j.setConnectionString('jdbc:mysql://mySqlServer.org/snctest?user=MyUser&password=MyPassword');
j.setTable("incident");
j.setFunction("update");
j.addField("urgency", "4");
j.setWhereClause("priority='1'");
j.create();

It creates an output record in the ECC queue with the following Payload:

1
2
3
4
5
6
7
8
9
10
<?xml version="1.0" encoding="UTF-8"?>
<parameters>
  <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
  <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
  <parameter name="work">
    <update table="incident" where="priority='1'">
      <urgency>4</urgency>
    </update>
  </parameter>
</parameters>

The result is created by the MID Server on the ECC Queue. Here is the Payload of the result:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0" encoding="UTF-8"?>
<results probe_time="102">
  <result>
    <updateResult>4 rows updated</updateResult>
  </result>
  <result/>
  <parameters>
    <parameter name="topic" value="JDBCProbe"/>
    <parameter name="work" value="&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;work&gt;&lt;update table=&quot;incident&quot; where=&quot;priority='1'&quot;&gt;&lt;urgency&gt;4&lt;/urgency&gt;&lt;/update&gt;&lt;/work&gt;"/>
    <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
    <parameter name="queue" value="output"/>
    <parameter name="error" value=""/>
    <parameter name="from_sys_id" value=""/>
    <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
    <parameter name="sys_id" value="d2d6367b507da0006d49b2e21aafd5ad"/>
    <parameter name="state" value="ready"/>
    <parameter name="from_host" value=""/>
    <parameter name="agent" value="mid.server.DEB1"/>
    <parameter name="processed" value=""/>
    <parameter name="ecc_queue" value="d2d6367b507da0006d49b2e21aafd5ad"/>
    <parameter name="response_to" value=""/>
    <parameter name="source" value=""/>
    <parameter name="sequence" value="1373db889dd0000001"/>
    <parameter name="name" value="JDBCProbe"/>
    <parameter name="table_name" value="ecc_queue"/>
    <parameter name="agent_correlator" value=""/>
  </parameters>
</results>

SELECT example

The following code will select all incidents in my database that have a priority of 1.

1
2
3
4
5
6
7
var j = new JDBCProbe('DEB1');
j.setDriver('com.mysql.jdbc.Driver');
j.setConnectionString('jdbc:mysql://mySqlServer.org/snctest?user=MyUser&password=MyPassword');
j.setTable("incident");
j.setFunction("select");
j.setWhereClause("priority='1'");
j.create();

It creates an output record in the ECC queue with the following Payload:

1
2
3
4
5
6
7
8
<?xml version="1.0" encoding="UTF-8"?>
<parameters>
  <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
  <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
  <parameter name="work">
    <select table="incident" where="priority='1'"/>
  </parameter>
</parameters>

The result is created by the MID Server on the ECC Queue. The “Name” field contains the number of rows returned. Here is the Payload of the result:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
<?xml version="1.0" encoding="UTF-8"?>
<results probe_time="236">
  <result query="SELECT * FROM incident WHERE priority='1'">
    <row id="1">
      <summary class="java.lang.String" length="255" type="12">My chair will not roll smoothly</summary>
      <id class="java.lang.Long" length="20" type="-5">1</id>
      <external_id class="java.lang.String" length="255" type="12"/>
      <priority class="java.lang.Integer" length="11" type="4">1</priority>
      <external_system class="java.lang.String" length="255" type="12"/>
      <impact class="java.lang.Integer" length="11" type="4">1</impact>
      <urgency class="java.lang.Integer" length="11" type="4">4</urgency>
    </row>
    <row id="2">
      <summary class="java.lang.String" length="255" type="12">My chair will not roll smoothly</summary>
      <id class="java.lang.Long" length="20" type="-5">2</id>
      <external_id class="java.lang.String" length="255" type="12"/>
      <priority class="java.lang.Integer" length="11" type="4">1</priority>
      <external_system class="java.lang.String" length="255" type="12"/>
      <impact class="java.lang.Integer" length="11" type="4">1</impact>
      <urgency class="java.lang.Integer" length="11" type="4">4</urgency>
    </row>
    <row id="3">
      <summary class="java.lang.String" length="255" type="12">My chair will not roll smoothly</summary>
      <id class="java.lang.Long" length="20" type="-5">3</id>
      <external_id class="java.lang.String" length="255" type="12"/>
      <priority class="java.lang.Integer" length="11" type="4">1</priority>
      <external_system class="java.lang.String" length="255" type="12"/>
      <impact class="java.lang.Integer" length="11" type="4">1</impact>
      <urgency class="java.lang.Integer" length="11" type="4">4</urgency>
    </row>
    <row id="4">
      <summary class="java.lang.String" length="255" type="12">My chair will not roll smoothly</summary>
      <id class="java.lang.Long" length="20" type="-5">4</id>
      <external_id class="java.lang.String" length="255" type="12"/>
      <priority class="java.lang.Integer" length="11" type="4">1</priority>
      <external_system class="java.lang.String" length="255" type="12"/>
      <impact class="java.lang.Integer" length="11" type="4">1</impact>
      <urgency class="java.lang.Integer" length="11" type="4">4</urgency>
    </row>
  </result>
  <parameters>
    <parameter name="topic" value="JDBCProbe"/>
    <parameter name="work" value="&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;work&gt;&lt;select table=&quot;incident&quot; where=&quot;priority='1'&quot;/&gt;&lt;/work&gt;"/>
    <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
    <parameter name="queue" value="output"/>
    <parameter name="error" value=""/>
    <parameter name="from_sys_id" value=""/>
    <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
    <parameter name="sys_id" value="23d7367b507da0006d49b2e21aafd5ae"/>
    <parameter name="state" value="ready"/>
    <parameter name="from_host" value=""/>
    <parameter name="agent" value="mid.server.DEB1"/>
    <parameter name="processed" value=""/>
    <parameter name="ecc_queue" value="23d7367b507da0006d49b2e21aafd5ae"/>
    <parameter name="response_to" value=""/>
    <parameter name="source" value=""/>
    <parameter name="sequence" value="1373dbca0140000001"/>
    <parameter name="name" value="JDBCProbe"/>
    <parameter name="table_name" value="ecc_queue"/>
    <parameter name="agent_correlator" value=""/>
  </parameters>
</results>

DELETE example

The following code will delete all incidents in my database that have a priority of 1.

1
2
3
4
5
6
7
var j = new JDBCProbe('DEB1');
j.setDriver('com.mysql.jdbc.Driver');
j.setConnectionString('jdbc:mysql://mySqlServer.org/snctest?user=MyUser&password=MyPassword');
j.setTable("incident");
j.setFunction("delete");
j.setWhereClause("priority='1'");
j.create();

It creates an output record in the ECC queue with the following Payload:

1
2
3
4
5
6
7
8
<?xml version="1.0" encoding="UTF-8"?>
<parameters>
  <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
  <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
  <parameter name="work">
    <delete table="incident" where="priority='1'"/>
  </parameter>
</parameters>

The result is created by the MID Server on the ECC Queue. The “Name” field contains the number of rows returned. Here is the Payload of the result:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
<?xml version="1.0" encoding="UTF-8"?>
<results probe_time="67">
  <result>
    <deleteResult>4 rows deleted</deleteResult>
  </result>
  <result/>
  <parameters>
    <parameter name="topic" value="JDBCProbe"/>
    <parameter name="work" value="&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;work&gt;&lt;delete table=&quot;incident&quot; where=&quot;priority='1'&quot;/&gt;&lt;/work&gt;"/>
    <parameter name="connection_string" value="jdbc:mysql://mysql.ht4.org/snctest?user=snctest&amp;password=sncrocks"/>
    <parameter name="queue" value="output"/>
    <parameter name="error" value=""/>
    <parameter name="from_sys_id" value=""/>
    <parameter name="jdbc_driver" value="com.mysql.jdbc.Driver"/>
    <parameter name="sys_id" value="31e8b6bb507da0006d49b2e21aafd57f"/>
    <parameter name="state" value="ready"/>
    <parameter name="from_host" value=""/>
    <parameter name="agent" value="mid.server.DEB1"/>
    <parameter name="processed" value=""/>
    <parameter name="ecc_queue" value="31e8b6bb507da0006d49b2e21aafd57f"/>
    <parameter name="response_to" value=""/>
    <parameter name="source" value=""/>
    <parameter name="sequence" value="1373dc001800000001"/>
    <parameter name="name" value="JDBCProbe"/>
    <parameter name="table_name" value="ecc_queue"/>
    <parameter name="agent_correlator" value=""/>
  </parameters>
</results>
]]> http://www.john-james-andersen.com/blog/service-now/using-the-servicenow-jdbcprobe.html/feed 1 Understanding ServiceNow SAML 2.0 Logs http://www.john-james-andersen.com/blog/service-now/understanding-servicenow-saml-2-0-logs.html http://www.john-james-andersen.com/blog/service-now/understanding-servicenow-saml-2-0-logs.html#comments Mon, 14 May 2012 14:33:25 +0000 John Andersen http://www.john-james-andersen.com/?p=1449

The documentation for ServiceNow’s SAML setup is the best that it has ever been. More and more customers are able to set up SAML correctly without having to engage outside help. That being said, what happens when you set up SAML and things just aren’t working out correctly?

When debugging SAML issues in ServiceNow, there are two things I recommend:
1. Use the Debug Log statements in ServiceNow
2. Use a network tracer such as those built into Chrome & Firefox, or Fiddler for Windows users.

This article covers the first recommended action, following the Debug Log statements inside ServiceNow.

Enabling and Viewing Debug Logging


First, you will need to make sure you have Debug Logging enabled for your SAML plugin. This can be done by browsing to the properties page and checked the Debug Logging checkbox.

SAML Debug Logging Property

This will ensure that the SAML debug statements will be logged to your instance’s System Log.

Now, to browse your System Log, simply go to “System Logs -> All”. I like to sort my logs on creation date where the create time on the filter for the log is after the last statement before I attempt to do a SAML login.

Filtering the System Log

Typical Log Statements

The following is typical log output for a successful SAML authentication:

This line just shows the SAML processing URL (the one that the IdP will send the Response to when it is done) and also the calculated base URL of the instance for use later on in the script.

1
Stripping down the serviceURL: https://myinstance.service-now.com/navpage.do to a base URL of: https://myinstance.service-now.com

Now, in the case of this example, we were using deep linking. This means that we clicked on a non-home page link an after authentication we want to be redirected to that specific page. In order for SAML to trigger on that, the url needs to use “nav_to.do”. This is what link we were using in this example:

https://myinstance.service-now.com/nav_to.do?uri=incident.do?sys_id=46e482d9a9fe198101d3e3f3e2a14459

In this next log statement, we analyze the destination URL to see if there is deep linking. The request URI is the page that is being accessed, and the “Query String” statement is the parameters on that URL.

Based on the URI an Query String, the script will attempt to use Deep Linking since it found query string parameters.

1
2
3
4
5
6
7
requestURI: /nav_to.do

Query String (qs): uri=incident.do?sys_id=46e482d9a9fe198101d3e3f3e2a14459

URI Parameter: incident.do?sys_id=46e482d9a9fe198101d3e3f3e2a14459

There may be Deep Linking involved with this SAML request

If we were not deep linking, then most of those statements above would be empty, or show a “null” value.

Next SAML will try to generate a Relay State parameter. This is sent to the IdP. Once authentication is complete on the Identity Provider’s side, it will redirect back to ServiceNow and it will post this Relay State with the SAML Response. This lets ServiceNow know where to redirect the browser once the login is completed.

The SAML plugin will URL encode the Relay State value since this is going on the URL that we send to the IdP. We don’t want any special URL characters to interfere with the base URL redirection that we are doing.

If there is no relay state, then a default relay state is generated. Out of the box, this relay state will be the main page of your instance.

1
Generating a Relay State of: https://myinstance.service-now.com/nav_to.do?uri=incident.do%3fsys_id%3d46e482d9a9fe198101d3e3f3e2a14459

Once the Relay State is generated, the system will generate an AuthnRequest XML document. This document will then be DEFLATED, base64 encoded, and URL Encoded and added to the URL as a “SAMLRequest” parameter. The log will show both the XML document for the request, and the full URL with SAMLRequest and RelayState that we will use for redirection to the IdP.

1
2
3
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://myinstance.service-now.com/navpage.do" ForceAuthn="false" ID="SNC04bc590a4d03b653d77fb07a88a345eb" IsPassive="false" IssueInstant="2012-05-09T15:21:52.974Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="https://myinstance.service-now.com/navpage.do" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://myinstance.service-now.com</saml2:Issuer><saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" SPNameQualifier="https://myinstance.service-now.com/navpage.do"/><saml2p:RequestedAuthnContext Comparison="exact"><saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2p:RequestedAuthnContext></saml2p:AuthnRequest>

Redirecting to: https://idp.ssocircle.com:443/sso/SSORedirect/metaAlias/ssocircle?SAMLRequest=nVPBcpswEP0VRneDwKa2NcYzlEynnklTYtwechPSYmsGJKoVjvP3BeIkPjTuJNfdp9333j6tkDd11LK0cwe9hT8doPNOTa2RPXcS0lnNDEeFTPMGkDnBivTHLYt8ylprnBGmJl6KCNYpozOjsWvAFmCPSsCv7W1CDs61LAi4LY0uzZN%2FMA1Ijb6xexYuKI0CzY8t34MvDfG%2BGStgJJSQitcIxNvcJKS4y%2BisFPGS8pmk0%2FJLPJXzeVXSOV8s%2BHQWQ9kDMeeI6ghvTxE72Gh0XLuERDSMJjSe0OUujFkUsjjyl%2FPZA%2FHys5SvSkul99d1l88gZN93u3yS%2Fyx244CjkmDvevRHJf8Gi713PT%2BfkvVqtJ6NzO3lNa6T4i8nIOv%2Fbl8FlzvOG1s2cN%2Fc5KZW4slL69o8Zha46%2FU428F4moa792mEfjhWlJxUI5RBw1WdSmkBkXhFPmy473itKgX2gzYFrzzPSQU5xqSPnIOT8zLTtNwqHIyEExfu1cpLWFb3Rm2h%2BpSxV2GCiWF2Xx5C%2BGisHEIFoue5s1xja6x7Mf5fjNbn5jv63tqXv3X9Fw%3D%3D&RelayState=https://myinstance.service-now.com/nav_to.do?uri=incident.do%3fsys_id%3d46e482d9a9fe198101d3e3f3e2a14459

Here, the user’s browser is redirected to the IdP for authentication. Logging is now the responsibility of the IdP. We will not receive any more log messages in the SAML process until the IdP processed the authentication and redirects the user back to ServiceNow with the SAML response document and relay state.

Logging resumes as we get the response back from the IdP. Before we act on the response, we first do a number of validation and security checks to ensure we can trust this SAML response.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
Response object created

Issue Instant: 2012-05-09T15:22:01.000Z

Signature Reference ID: s2e460726688ab83e1875101549b1ad03d4af8837a

certificate Issuer DN: CN=CA, O=SSOCircle, C=DE

Public key created

Signature not in response, attempting to get signature from assertion

Got signature

<?xml version="1.0" encoding="UTF-8"?><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#s255bdf815a7493479752d610386841f58ac677211">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>gtpu2XT1bLHTMkpQeTpiunMO1Yo=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
mCvayhe1KJaLy/o1D9kIpL1t99rTRdedpLw7KQIy9T/siDytBOgo42yr91sfcG2dc7AX/JuQpQh8
HGL63H0ZgadVEp0DlErc8jetkje3o6DgKd/Cw0HAMuJujhh83cFthkQDgX8xg9L7LUqgptqHds/5
ssLyVvCok3dJYyImPX8=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIICjDCCAXSgAwIBAgIFAJRvxcMwDQYJKoZIhvcNAQEEBQAwLjELMAkGA1UEBhMCREUxEjAQBgNV
BAoTCVNTT0NpcmNsZTELMAkGA1UEAxMCQ0EwHhcNMTEwNTE3MTk1NzIxWhcNMTYwODE3MTk1NzIx
WjBLMQswCQYDVQQGEwJERTESMBAGA1UEChMJU1NPQ2lyY2xlMQwwCgYDVQQLEwNpZHAxGjAYBgNV
BAMTEWlkcC5zc29jaXJjbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbzDRkudC/
aC2gMqRVVaLdPJJEwpFB4o71fR5bnNd2ocnnNzJ/W9CoCargzKx+EJ4Nm3vWmX/IZRCFvrvy9C78
fP1cmt6Sa091K9luaMAyWn7oC8h/YBXH7rB42tdvWLY4Kl9VJy6UCclvasyrfKx+SR4KU6zCsM62
2Kvp5wW67QIDAQABoxgwFjAUBglghkgBhvhCAQEBAf8EBAMCBHAwDQYJKoZIhvcNAQEEBQADggEB
AJ0heua7mFO3QszdGu1NblGaTDXtf6Txte0zpYIt+8YUcza2SaZXXvCLb9DvGxW1TJWaZpPGpHz5
tLXJbdYQn7xTAnL4yQOKN6uNqUA/aTVgyyUJkWZt2giwEsWUvG0UBMSPS1tp2pV2c6/olIcbdYU6
ZecUz6N24sSS7itEBC6nwCVBoHOL8u6MsfxMLDzJIPBI68UZjz3IMKTDUDv6U9DtYmXLc8iMVZBn
cYJn9NgNi3ghl9fYPpHcc6QbXeDUjhdzXXUqG+hB6FabGqdTdkIZwoi4gNpyr3kacKRVWJssDgak
eL2MoDNqJyQ0fXC6Ze3f79CKy/WjeU5FLwDZR0Q=
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>

Signature is valid.

After the SAML response is validated and trusted by the system, we will process it and attempt to login using the nameId token passed back to use from the IdP.

The log will display the NameID token received from the IdP. We will match this up with a real user in our system and establish a valid ServiceNow session.

1
2
3
4
5
NameID:john.user@service-now.com

SAML2 NameID: john.user@service-now.com

SAML2 SessionIndex: s2edd20d41d9a7f3fcdb02360877e9d8cfa313ac11

At this point, we redirect the user’s browser to the page indicated by the RelayState that was passed back to us from the IdP. This should be the same relay state that we sent to the IdP to hold on for us.

1
We will be redirecting user to the RelayState: https://myinstance.service-now.com/nav_to.do?uri=incident.do?sys_id=46e482d9a9fe198101d3e3f3e2a14459

The user is then authenticated and redirected to the relay state’s URL.

]]> http://www.john-james-andersen.com/blog/service-now/understanding-servicenow-saml-2-0-logs.html/feed 0 Sending out ServiceNow Attachments via SOAP http://www.john-james-andersen.com/blog/service-now/sending-out-servicenow-attachments-via-soap.html http://www.john-james-andersen.com/blog/service-now/sending-out-servicenow-attachments-via-soap.html#comments Thu, 10 May 2012 12:47:36 +0000 John Andersen http://www.john-james-andersen.com/?p=1441

I have had a few people ask me lately how to send record attachments within ServiceNow to other third party services in an integration. My answer has always been descriptive, but I have never really provided any solid examples of performing this type of activity.

I have decided to take an example of InstanceA sending a new attachment on an incident record to a third party system via SOAP Web Services. In my example, we only send out the attachment if the incident record has an existing “Correlation ID” set on the record. We assume, for the purposes of the example, that the correlation ID corresponds to a unique record in a third party system.

General Architecture

In order to do this, I created a business rule on the “Sys_attachment” table. The business rule is set to trigger when a new attachment is created. I’ve set it to run asynchronously so that it doesn’t affect the performance of the attachment feature in the product (eg. you don’t have to wait for us to send the attachment to the third party system for the UI to process the newly attached record). For every attachment, we will check the parent record’s correlation ID. If it is not empty, then we attempt to send the attachment to the third party.

Business Rule Settings & Code

Name: Send Correlation Attachments SOAP
When: async
Insert: checked
Table: Attachment [sys_attachment]
Condition: gs.isInteractive()
Script:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
gs.log("Entering Business Rule to Send Attachment via SOAP", "Test");

//Checking to get any correlation ID set on the record
var correlationId = getCorrelation(current.table_name, current.table_sys_id);

//We only send attachments if the record correlates to another system
if(correlationId != ""){
  //Load some common Packages from Java
  //typically we don't like to do this, but these are commonly used ones
  //so we should be safe
  var sa = new Packages.com.glide.ui.SysAttachment();
  var StringUtil = Packages.com.glide.util.StringUtil;

  //Get the base64 encoding of the attachment
  var binData =  sa.getBytes(current);
  var encData =  StringUtil.base64Encode(binData);
   
  //Send it via SOAP to the third party - using the third party's
  //format.  This example uses another SN instance, so the SOAP
  //body uses the format required by ServiceNow
  var s = new SOAPMessage('Demo10 ECC Queue', 'insert attachment');
  s.setParameter('filename', current.file_name);
  s.setParameter('mimetype', current.content_type);
  s.setParameter('destTable', current.table_name);
  s.setParameter('destSysId', correlationId);
  s.setParameter('payload', encData);
  s.post(true);
 
} else {
  gs.log("The record ("+current.table_name+":"+current.table_sys_id+") did not have necessary correlation...will not send attachment");
}

/*
 * Checks to see if the record has a correlation ID
 *
 * Params:
 * tablename - name of the table in the system where the record belongs
 * sysid - the sys_id of the record in the table
 *
 * Returns:
 * Either a correlation_id value or empty string
 */
function getCorrelation(tablename, sysid){
  var gr = new GlideRecord(tablename);
  gr.get(sysid);
  if( gr.correlation_id != ""){
    return gr.correlation_id;
  }
  return "";
};

A note about the SOAP Message

In this example, the code from the business rule builds out a SOAPMessage object that consumes another ServiceNow instance’s SOAP Attachment Web Service. Typically, you would not be integrating with another ServiceNow instance. You would create a SOAPMessage record that consumes the third party’s SOAP web service that supports attachments. You will use that SOAPMessage object to post the base64 encoded file and its meta data in the format required by the third party.

Other Documentation

AttachmentCreator SOAP Web Service – Official ServiceNow documentation on the inbound AttachmentCreator SOAP web service. It does not cover an outbound scenario that we demonstrate here. But it does show the format that ServiceNow uses to accept attachments via SOAP.

]]> http://www.john-james-andersen.com/blog/service-now/sending-out-servicenow-attachments-via-soap.html/feed 0 Fixing SAML 2.0 Frame-in-Frame Timeout issues in ServiceNow http://www.john-james-andersen.com/blog/service-now/fixing-saml-2-0-frame-in-frame-timeout-issues-in-servicenow.html http://www.john-james-andersen.com/blog/service-now/fixing-saml-2-0-frame-in-frame-timeout-issues-in-servicenow.html#comments Tue, 24 Apr 2012 13:15:59 +0000 John Andersen http://www.john-james-andersen.com/?p=1411 Frame in Frame issue with SAML 2.0 timeout in ServiceNow

Because ServiceNow was built on a framework of various Frames to built out its standard UI, there are some scenarios where a user will see framing issues in the application.

One common scenario where this happens is with SAML 2.0. If a user lets their session expire, and then then click on a link inside the browser, they will be directed to their IdP. After authentication is verified, the IdP redirects them back to ServiceNow. The problem here is that it does so in the right hand frame, rather than in the top window. This yields a result of a frame in frame rendering. If the user were to hit the refresh button, the app would be displayed properly. However, it is a bit ugly and most users wouldn’t think to hit the refresh button to fix the problem.

I often recommend to customers to modify their IdP login page to have frame busting javascript on the page so that it busts out of the ServiceNow frames. However, customers don’t always have that option, or they use Kerberos, which doesn’t display a form for authentication.

In order to get around that limitation, I have come up with a workaround that should work for most customers.

Create a UI Page that sets the SAML service URL as the top URL

I created a UI page that does a sys_property query and finds the SAML 2.0 Service URL that is used by the IdP to redirect us back to ServiceNow. The UI page then sets that URL as the top URL for the browser window (eliminating extra frames).

Here are the values I used for the UI page:

Name:
frame_bust

HTML:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<?xml version="1.0" encoding="utf-8" ?>
<j:jelly trim="false" xmlns:j="jelly:core" xmlns:g="glide" xmlns:j2="null" xmlns:g2="null">

<g:evaluate var="jvar_service_url">
  var prop = new GlideRecord("sys_properties");
  prop.addQuery("name", "glide.authenticate.sso.saml2.service_url");
  prop.query();
  prop.next();  
  prop.value;
</g:evaluate>

<script type="text/javascript">
  if("${jvar_service_url}"){
    top.location.replace("${jvar_service_url}");
  }
</script>

</j:jelly>

Modify the SAML Login Script

By default, if a user is not deep linking, meaning they are going to a Service-Now URL that is not a “nav_to.do” page, then we set the RelayState to navpage.do, which does not break us out of frames as it is a framed page. We need to modify the default of navpage.do to be our new frame_bust.do page.

To change this, we need to browse to the SAML 2.0 Login Script.

Once you are there, search for the following snippet of code:

1
2
3
4
5
6
7
8
9
10
11
12
13
    if(!uriparam){
      //No deep linking
      this.logDebug("No Deep Linking for this SAML request");
      relayState = this.serviceURL;
    } else {
      //Deep Linking
      this.logDebug("There may be Deep Linking involved with this SAML request");
      var destinationURI = "";
      if(uriparam){
        destinationURI += "?uri=" + encodeURIComponent(uriparam);
      }
      relayState = baseURL + "/nav_to.do" + destinationURI;
    }

Just above that code, enter the following snippet:

1
2
3
4
    //Added to handle frame-in-frame situation
    if(!uriparam){
      uriparam = "frame_bust.do";
    }

Hence, that section of code should now look like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
    //Added to handle frame-in-frame situation
    if(!uriparam){
      uriparam = "frame_bust.do";
    }
    if(!uriparam){
      //No deep linking
      this.logDebug("No Deep Linking for this SAML request");
      relayState = this.serviceURL;
    } else {
      //Deep Linking
      this.logDebug("There may be Deep Linking involved with this SAML request");
      var destinationURI = "";
      if(uriparam){
        destinationURI += "?uri=" + encodeURIComponent(uriparam);
      }
      relayState = baseURL + "/nav_to.do" + destinationURI;
    }

The Result

Now when we reach ServiceNow without a valid session, and we are not deep linking, instead of sending a default relay state of: https://yourinstance.service-now.com/navpage.do, we send the relay state as https://yourinstance.service-now.com/frame_bust.do.

After the SAML authentication takes place, the user is redirected back to service-now with the frame_bust.do page still in the relay state. After Service-Now authenticates the user according to the SAML response, it will then redirect you to frame_bust.do. For a second or so while the page is rendering, you will see a frame-in-frame look, but as soon as the page renders, it will break out of the frame and redirect you to the home page (navpage.do).

]]> http://www.john-james-andersen.com/blog/service-now/fixing-saml-2-0-frame-in-frame-timeout-issues-in-servicenow.html/feed 0 Deep Link Generator http://www.john-james-andersen.com/blog/service-now/deep-link-generator.html http://www.john-james-andersen.com/blog/service-now/deep-link-generator.html#comments Thu, 19 Apr 2012 20:40:49 +0000 John Andersen http://www.john-james-andersen.com/?p=1406 In order for deep linking to work in ServiceNow (especially with SSO configurations such as SAML), you will need to format your URL properly for the deep linking to be preserved through login.

ServiceNow uses a page called “nav_to.do” to process deep links. The relative SN url is placed in a “uri” parameter.

For example, if I want to deep link to 


https://demo.service-now.com/incident.do

I would need to go format my deep link url to be like the following:


https://demo.service-now.com/nav_to.do?uri=incident.do

This can get tedious, especially if your ‘uri’ parameter will contain other special URL characters.

The following is a tool that will allow you to paste the ServiceNow link you wish to use with Deep Linking. Click the Submit button and the url will be formatted for you automatically.

]]> http://www.john-james-andersen.com/blog/service-now/deep-link-generator.html/feed 0 Certified ServiceNow System Administrator http://www.john-james-andersen.com/career/awards/certified-servicenow-system-administrator.html http://www.john-james-andersen.com/career/awards/certified-servicenow-system-administrator.html#comments Mon, 02 Apr 2012 17:33:57 +0000 John Andersen http://www.john-james-andersen.com/?p=1401 John Andersen - Certified ServiceNow System Administrator

After years of working with ServiceNow, John Andersen made it official by taking the Certified System Administrator exam. He was relieved that his experience paid off as he passed the exam and received the certification.

]]> http://www.john-james-andersen.com/career/awards/certified-servicenow-system-administrator.html/feed 0 Command Line Execution with ServiceNow MID Servers http://www.john-james-andersen.com/blog/service-now/command-line-execution-with-servicenow-mid-servers.html http://www.john-james-andersen.com/blog/service-now/command-line-execution-with-servicenow-mid-servers.html#comments Wed, 28 Mar 2012 17:58:52 +0000 John Andersen http://www.john-james-andersen.com/?p=1390 Shell Dialog

A little known fact about ServiceNow and MID Servers is that ServiceNow can be configured such that it can execute shell commands on a computer that hosts a MID Server. Of course, it will only execute commands that it has rights to execute as the user running the MID Server process, but this can be very handy with command line integrations.

In order to have a MID Server execute a shell command, simply create a record on the ECC Queue that has the following information:

Agent: YOUR MID SERVER
Topic: Command
Name (optional): THE COMMAND YOU WISH TO EXECUTE
Queue: Output
Payload (optional): An XML document defining a command to execute.

There are two ways to do this: the name method and the payload method. With the “Name” method, you place your command in the “Name” field fo the ECC Queue record in the format that you normally would on a Shell prompt. With the “Payload” method, you encapsulate the command in an XML document for the MID Server to process.

The advantage of the “Name” method is that it is easy to enter and very readable. The advantage of the “Payload” method is that you may need longer command strings than the name field can support (eg. 120 characters). The Payload field can handle a much larger command.

The Name Method

The following record will execute a directory listing with the “-l” option for the working directory of the MID Server:

ECC Queue Command Example

Once this executes, a corresponding Input record will be generated:

Command Line Result Record in ECC Queue

If you open that record and read the Payload field, you will find the results to me “ls -l” query:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
<?xml version="1.0" encoding="UTF-8"?>
<results probe_time="2165">
  <result command="ls -l">
    <stdout>total 52
drwxr-xr-x 2 john john 4096 Mar 28 11:11 bin
drwxr-xr-x 2 john john 4096 Mar  6 11:25 conf
-rwxr-xr-x 1 john john 5715 Mar 28 11:11 config.xml
drwxr-xr-x 2 john john 4096 Mar  6 11:25 etc
drwxr-xr-x 2 john john 4096 Mar  6 11:32 extlib
drwxr-xr-x 8 john john 4096 Mar  6 11:25 jre6
drwxr-xr-x 2 john john 4096 Mar  6 11:25 lib
drwxr-xr-x 2 john john 4096 Mar  6 11:33 logs
drwxr-xr-x 2 john john 4096 Mar  6 11:25 properties
-rwxr-xr-x 1 john john   16 Jan 16 14:38 start.sh
-rwxr-xr-x 1 john john   15 Jan 16 14:38 stop.sh
drwxr-xr-x 4 john john 4096 Mar  6 11:33 work</stdout>
    <stderr/>
  </result>
  <parameters>
    <parameter name="topic" value="Command"/>
    <parameter name="queue" value="output"/>
    <parameter name="error" value=""/>
    <parameter name="from_sys_id" value=""/>
    <parameter name="sys_id" value="bc7e5b29508520006d4913147419ba01"/>
    <parameter name="state" value="ready"/>
    <parameter name="from_host" value=""/>
    <parameter name="agent" value="mid.server.DEB1"/>
    <parameter name="processed" value=""/>
    <parameter name="ecc_queue" value="bc7e5b29508520006d4913147419ba01"/>
    <parameter name="response_to" value=""/>
    <parameter name="source" value=""/>
    <parameter name="sequence" value="1365a5ab1950000001"/>
    <parameter name="name" value="ls -l"/>
    <parameter name="table_name" value="ecc_queue"/>
    <parameter name="agent_correlator" value=""/>
  </parameters>
</results>

The “Payload” Method

The payload method will yield the same results as the “Name” method, but the difference is in the creation of the initial output ecc queue record.

Instead of placing the command in the “Name” field of the ECC Queue record we make up a small XML Document and place it in the Payload field.

In this example, we want to see what files within the MID Server installation have changed today:

find /home/john/mid/deb1 -type f -mtime -1 -exec ls -al {} \;

To do this using the Payload method, we create an ECC Queue record that looks like:

The payload as shown in the screenshot is:

1
2
3
<parameters>
  <parameter name="name" value="find /home/john/mid/deb1 -type f -mtime -1 -exec ls -al {} \;"/>
</parameters>

The resulting record will be in the same format as using the Name method, so I won’t display it here.

]]> http://www.john-james-andersen.com/blog/service-now/command-line-execution-with-servicenow-mid-servers.html/feed 0 ServiceNow: SCCM Integration Demo http://www.john-james-andersen.com/videos/service-now-training-videos/servicenow-sccm-integration-demo.html http://www.john-james-andersen.com/videos/service-now-training-videos/servicenow-sccm-integration-demo.html#comments Mon, 19 Mar 2012 15:50:42 +0000 John Andersen http://www.john-james-andersen.com/?p=1388

]]> http://www.john-james-andersen.com/videos/service-now-training-videos/servicenow-sccm-integration-demo.html/feed 0 ServiceNow/Microsoft SCCM Integration Demo http://www.john-james-andersen.com/blog/service-now/servicenowmicrosoft-sccm-integration-demo.html http://www.john-james-andersen.com/blog/service-now/servicenowmicrosoft-sccm-integration-demo.html#comments Mon, 19 Mar 2012 15:24:48 +0000 John Andersen http://www.john-james-andersen.com/?p=1364 ServiceNow integration to Microsoft SCCM

Within the past year, ServiceNow released a new version of their Microsoft SCCM integration plugin. There are now two existing version available for ServiceNow customers. I created the following demo video to explain the differences between the two plugins, outline when you may choose one version over the other, and provided a small demo explaining how to set each plugin up within ServiceNow.

ServiceNow/SCCM Integration Demo Video

Disclaimer: During the creation of this tutorial video, I discovered some mistakes in the original ServiceNow documentation for the integration. The video may contains a few of those mistakes, but the wiki has since been corrected. Please watch the video for a good understanding of the plugin, but use the appropriate ServiceNow wiki pages as your guide when you do your actual set up.

Known Changes from the Demo

  • “Use last run datetime” should be enabled for the “SCCM Computer Info” data source and NOT for the “SCCM Software” datasource. The original documentation (and hence this video) has it reversed.
]]> http://www.john-james-andersen.com/blog/service-now/servicenowmicrosoft-sccm-integration-demo.html/feed 0 SAML 2.0 Configuration – Oracle OIF with ServiceNow http://www.john-james-andersen.com/blog/service-now/saml-2-0-configuration-oracle-oif-with-servicenow.html http://www.john-james-andersen.com/blog/service-now/saml-2-0-configuration-oracle-oif-with-servicenow.html#comments Mon, 12 Mar 2012 14:40:50 +0000 John Andersen http://www.john-james-andersen.com/?p=1333

Last week I worked with Principle Sales Consultant, and all around Oracle Guru, Warren Strange, author of “Strange Brew”. Together we took a couple of hours to set up a SAML 2.0 setup between a ServiceNow instance and and Oracle Identity Federation server.

While, you don’t have to customize either product to get this working, there are a few potential gotchas that we ran into. In order to help make this an easier process for everyone, we decided to write up our experience.

The ServiceNow Side

The first step we took was to configure ServiceNow as the Service Provider in this relationship. In order to do this, we had to do the following:

1) Enable the SAML 2.0 Plugin
You would typically call support, or talk to your account manager to get this activated on your instance.

2) Obtain the OIF Identity Provider Metadata
To obtain the metadata from the OIF server, we browsed to: http://yourserver.com/fed/idp/metadata

3) Configure the SAML 2.0 Properties in ServiceNow

For Label (1) in the above screenshot, we used the “Location” attribute in the IdP Metadata element that looked like:

1
2
3
<SingleSignOnService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
    Location="GET_THIS_VALUE_HERE"/>

For Label (2) in the above screenshot, we used the “Location” attribute in the IdP Metada element that looked like:

1
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="GET_THIS_VALUE_HERE"/>

Change properties labeled (3) and (4) in the screenshot to be the ServiceNow instance URL that you are configuring. They will both need to be the same URL in this configuration. (Some instances have property (3) appended with “/navpage.do”. Do not include that for this configuration).

4) Import the OIF Certificate into ServiceNow

From the Oracle IDP Metadata, look for the X509Certificate under the <md:KeyDescriptor use=”signing”> section.

Copy that string and place it between the —–BEGIN CERTIFICATE—– and —-END CERTIFICATE—- strings in the SAML 2.0 Certificate in your ServiceNow Instance as seen below:

5) Build a ServiceNow SP Metadata document

This is the most complicated part of the process, but rest assured it is not that difficult. ServiceNow does not currently build the domain certificate into their SP metadata that they generate. However, Oracle requires the certificate to be in the metadata. We could not find a way to add the certificate manually. It doesn’t mean it can’t be done on the Oracle side, we just weren’t aware of how to do it. So, the easiest way to move forward is to modify the generated metadata from ServiceNow to include the public certificate PEM in the metadata.

You can get the PEM certificate metadata from your client browser when browsing to your ServiceNow instance. Use your browser’s certificate application to export the “*.service-now.com” certificate to PEM format. You should be fine just using the text we used below. If ServiceNow ever changes the certificate, then you will likely have to use the browser to get it on your own during this configuration.

In your ServiceNow instance, click on the “Metadata” link and copy the metadata to a text editor.

Add the following section to your meta data between the element and the element:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
    <KeyDescriptor use="signing" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyName>*.service-now.com</ds:KeyName>
        <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:X509Certificate xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
MIID6TCCAtGgAwIBAgIQaWG5DFrv6VYEv/tPlqZYbDANBgkqhkiG9w0BAQUFADA8
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMRYwFAYDVQQDEw1U
aGF3dGUgU1NMIENBMB4XDTExMDcwNDAwMDAwMFoXDTEzMTAwMjIzNTk1OVowgYEx
CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHFAlTYW4g
RGllZ28xGDAWBgNVBAoUD1NlcnZpY2Utbm93LmNvbTETMBEGA1UECxQKT3BlcmF0
aW9uczEaMBgGA1UEAxQRKi5zZXJ2aWNlLW5vdy5jb20wggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDACla2WcmR3wo3wxJZw/LJJJ9T5hMHmtCD+7Fgnfqy
+cnTeJ0QK7TbjVkkIR6VoDqurZ/vmul0d8RlqaAhdvErEf7zHd5Iv55IIpZVBmr0
iZ7nC0nHi8Zpu+GNxBptAQSmTldB/aiImb8VHItQTcq3qQM+mBGi+WqR31cPugDF
I2+03f+V5xob0nkE3y00I9dqCpjzrRNrIIZUMJGy4pkpXZDzNWyjPN/Bg7FIRjyo
XyLYHMI1ChOIkzq7yFrEgsI0qOo7j5jYX7DZOIAmX2TTvatYCoWqm1C3QrwRHUvI
2bSLdS+iEQp/fkue336btB1N8+VP5Q/Ri9KvHdJCiN1LAgMBAAGjgaAwgZ0wDAYD
VR0TAQH/BAIwADA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vc3ZyLW92LWNybC50
aGF3dGUuY29tL1RoYXd0ZU9WLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
BQUHAwIwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC50
aGF3dGUuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQB9zifSRfQLsQIbFcfrBg9E1R0o
Nx5sco6WHQ3f8v4RrGO4ZAMGnqDlsAjEG88LzQfeVkqcAmsTWxCyCHW0iGWvUbfN
cAHvLdr9VlLmUnz3wg69VgnW+fwppPAyD1L1ZEafESw5eoivkjcQ5DIedjjKwYiI
FjkLngEOORkBhKmyGLlV7nXWG0VmJkDt5xHH5i3rVq1G8sEV743kSLtK/Dugn7Hf
HSYbiyDpHv8EJmFBYtFFYIPUyKOPowaTu2zj9qJz83X5oLulBd6eLZfaAgsjZ/Rb
1MTfRzgI2mur/IiTx9KL7Ymg+NJm7y7/wb1Fy438OwBANG6VrJUJqjxyYR/a
          </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </KeyDescriptor>

Your resulting metadata document would look something like this:

Save the meta data as a file and use it in one of the following steps for the OIF Server below.

Oracle Identity Federation Configuration Steps

1) Add the ServiceNow SP Metadata into OIF

Navigate to -> Administration -> Federation

Click on the “+ Add” button

Load the meta data file that you created and saved from ServiceNow service provider instance.

This will create Relying Party Provider for OIF.

2) Configure the new Relying Party Record in OIF

Select the newly created provider and click on the “Edit” button to manually edit the provider settings:

On the “Oracle Identity Federation Settings Tab” make sure you have the following settings:

Under “Attribute Mappings and Filters” check “Email Address” and “Transient One Time Identifier”

Under “Assertion Settings” enable “Send Signed Assertion”

Under “Protocol Settings” enable:
“Include Signing Certificate in XML Signatures”

Under “Messages to Send/Require Signed” enable “Send Signed” for Request – HTTP Redirect

Testing the Integration

For this setup, we used email address as the token that the IdP would share with ServiceNow for the identity once successful authentication takes place. In order for this scenario to work, you must have a user created in the ServiceNow users list that has an email address that is the same as the user in OIF that you will be testing with.

To initiate SSO go to your service-now domain. It it configured to use SP initiated SSO. You should see that you are re-directed to OIF for authentication. Once authenticated you will be redirected back again to Service-Now were you will be logged in.

Credits

Many thanks to Warren Strange for reaching out to me to set up this configuration. Also thanks to the engineers on the Oracle side for answering our questions. Finally, many thanks to ServiceNow for provisioning a demo instance for us to work with to prove out SAML 2.0 functionality between OIF and ServiceNow.

]]> http://www.john-james-andersen.com/blog/service-now/saml-2-0-configuration-oracle-oif-with-servicenow.html/feed 4