SAML SP-Initiated Login

A few months ago I worked with a client to get AD FS 2.0 working with SAML 2.0 in a situation where ServiceNow is the Service Provider. However, at the time, we were unable to get an SP-initiated authentication scenario to work between SeviceNow and AD FS.

I recently came across some articles which keyed me into a probable cause of the SP-Initiated Authentication failures.

When someone tries to get to their ServiceNow instance in an unauthenticated state by going to their instance url (eg. https://myinstance.service-now.com), they would be redirected to the IdP login page. During that redirection, ServiceNow sends a SAML AuthnRequest so that the IdP will know how to process the login.

In the request, ServiceNow was sending the following NameID format element:

1
2
3
<saml2p:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
SPNameQualifier="https://myinstance.service-now.com/navpage.do" />

AD FS, however was responding that ServiceNow was sending an invalid NameIDPolicy.

After reading the SAML 2.0 Assertion Specification document, I came across the following text on lines 424-432:

NameQualifier [Optional]
The security or administrative domain that qualifies the identifier. This attribute provides a means to federate identifiers from disparate user stores without collision.
SPNameQualifier [Optional]
Further qualifies an identifier with the name of a service provider or affiliation of providers. This attribute provides an additional means to federate identifiers on the basis of the relying party or parties.

The NameQualifier and SPNameQualifier attributes SHOULD be omitted unless the identifier’s type definition explicitly defines their use and semantics.

This led me to believe that maybe the SPNameQualifier attribute could be causing errors with AD FS since we are not explicitly defining the use and semantics.

The Solution

New Update: If you download the update set that provides Additional SAML 2.0 Configuration Options then you will not need to modify the SAML scripts as outlined below. You only need to change the properties on the SAML Properties page.

To fix this issue, I visited the “SAML2” Script Include and commented out two lines of code where we set the SPNameQualifier in the SAMLRequest.

In the “createNameID” function I commented out the following line:

//nid.setSPNameQualifier(serviceURL);

In the “createNameIDPolicy” function I commented out the following:

//nameIdPolicy.setSPNameQualifier(serviceURLStr);

Once I had saved this library I was able to perform an SP-initiated SAML authentication between ServiceNow and AD FS 2.0.