Single Sign-On (SSO) - Understanding User Field and NameID Attribute - Support and Troubleshooting

Single Sign-On (SSO) - Understanding User Field and NameID Attribute Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } What is a NameID? In SAML 2.0, the NameID is a required element within the block of the SAML Response. It is sent by the Identity Provider (IdP) and serves as the primary identifier for the authenticating user. The NameID is always present in a valid SAML assertion and is the default value ServiceNow uses to look up a matching user record during SSO login.

Using the SAML Response below as a reference, the NameID value is "abel.tuter@example.com":

abel.tuter@example.com

What are SAML Attributes? SAML Attributes are optional key-value pairs included in the block of the SAML Response. They carry additional information about the user and can be mapped to fields on [sys_user] table for SSO User Provisioning and in this case Authentication.

Using the SAML Response below, the attributes provided by the IdP are "firstName, "lastName", "email" and "employeeNumber":

Abel Tuter abel.tuter@example.com EMP007 User Field vs NameID Attribute User Field

Specifies which field on the [sys_user] table the instance should query against when attempting to find a matching user record. In the provided SAML Response XML above where the NameID value is "abel.tuter@example.com", we would likely set the "User Field" to "email" to as the matching field on [sys_user] table.

NameID Attribute Overrides the default NameID value by telling the instance to use a specific attribute from the as the identifier, instead of the NameID value. This means that if the attribute is not found or contains a blank value , then instance will be unable to find a user hence SSO authentication fails.

In the provided SAML Response XML above where we have various attributes (first name, last name, email address, employee number) and a few scenarios to explore:

Scenario #1 - Using "email" NameID Attribute The attribute with the name "email" contains the email address of the user, so we can use this attribute value to match against the "email" field on [sys_user] table.

... abel.tuter@example.com ...

Scenario #2 - Using "employeeNumber" NameID Attribute The attribute with the name "employeeNumber" contains the Employee Number of the user, so we can use this attribute value to match against the "Employee number" field on [sys_user] table.

... EMP007