How to implement Multiple Provider Single Sign-On including an Edge Encryption Proxy URL login - Support and Troubleshooting

How to implement Multiple Provider Single Sign-On including an Edge Encryption Proxy URL login Description This article describes how to direct some users to log in to an instance via the Edge Encryption Proxy URL and others to log in via the regular instance hostname URL. It assumes that you have implemented Edge Encryption and the Multiple Provider Single Sign-On plugin.

Procedure Navigate to Multi-Provider SSO > Identity Providers and create two IdP records.

Although the Identity Provider URL setting for both IdP records has to be the same, by default, a unique constraint prevents duplication of this value. To allow duplication of Identity Provider URL in multiple IdP records:

Log in to the instance with a user with an admin role.

Go to sys_dictionary_list.do.

Create the following filter and then click Run:

[Table] [is] [saml2_update1_properties] AND [Column name] [is] [idp]

Add the Unique column to the List view, then change the value from true to false and save.

Create the two Identity Providers.

For the Edge Proxy login, use the following values: Identity Provider URL : ServiceNow Homepage : https:// : /navpage.do Entity ID / Issuer : https:// : Audience URI : https:// :

For the regular instance hostname: Identity Provider URL :

ServiceNow Homepage : https:// .service-now.com/navpage.do Entity ID / Issuer : https:// .service-now.com Audience URI : https:// .service-now.com

The other properties for both IdP records are imported from the IdP metadata.

This requires two separate Relying Party Trusts at the IdP and two separate IdP records in the instance (as covered in step 1), as well as a login page presented to the users to choose to log in using the Edge Encryption route or the non-Edge Encryption route. This is set up on the IdP provider side.

Provide two login URLs, one for the Edge Proxy and one not using the Edge Proxy.

Log in via Edge Proxy : https:// : /login_with_sso.do?glide_sso_id= Login via instance name : https:// .service-now.com/login_with_sso.do?glide_sso_id= The user logging in will need to use the appropriate URL to log in, either using the Edge Proxy or not using the Edge Proxy.

Modify the MultiSSO Installation Exit.

Due to using the same Identity Provider URL value in two different IdP records (not a usual configuration), the IdP identity cannot be pulled from the SAML Response because the Identity Provider URL in both IdPs is the same and the wrong one might be pulled.

Change the value from:

var samlResponseTxt = request.getParameter("SAMLResponse"); if (!GlideSession.get().isLoggedIn() && GlideStringUtil.notNil(samlResponseTxt)) { var idpRecord = this.getIdPRecord(request); if (idpRecord) { SSO_Helper.debug("IdP found based on SAML response: " + idpRecord.getUniqueValue()); return new SSO_Helper(idpRecord.getUniqueValue(), false, null, true); } } To:

var samlResponseTxt = request.getParameter("SAMLResponse"); if (!GlideSession.get().isLoggedIn() && GlideStringUtil.notNil(samlResponseTxt)) { /* // You have two profiles that use the same idp entity id it cannot use // the idp issuer / entity id from the response otherwise it may result in the // wrong idp profile. idp initiated login will not work var idpRecord = this.getIdPRecord(request); if (idpRecord) { SSO_Helper.debug("IdP found based on SAML response: " + idpRecord.getUniqueValue()); return new SSO_Helper(idpRecord.getUniqueValue(), false, null, true); }*/ return new SSO_Helper(null, true); } Note: If you are using MultiSSO V2 you have to make below KB specified change in Installation Exit MultiSSOV2 when Edge Encryption is configured: KB0831608 - Multi-provider SSO V2 with Edge Encryption Proxy Note: Note the comments and that IdP initiated login will not work in this configuration. Starting with Jakarta, there is a requirement to have the IdP pass the "Test Connection" before you are able to activate the IdP. In this configuration the "Test Connection" will most likely fail, making it impossible to activate the IdPs. In order to allow the IdPs to be activated create and set this system property and then activate the IdP records:

Name = glide.authenticate.multisso.test.connection.mandatory Type = true|false Value = false