[PRM & ASM] MCP clients that do strict issuer validation cannot connect to the ServiceNow MCP Server - Known Error

[PRM & ASM] MCP clients that do strict issuer validation cannot connect to the ServiceNow MCP Server Description Due to an issue in which the protected resource metadata for the MCP includes the resource path in the authorization server URL, there is an issuer mismatch in which glide is the authorization server. Further, Glide does not advertise any metadata at the base metadata path (https:// .service-now.com/well-known/oauth-authorization-server/).

Steps to Reproduce

1. Attempt to connect codex via cli to any ServiceNow MCP: codex mcp login

2. Error: Authorization server issuer mismatch: expected https:// .service-now.com/sncapps/mcp-server/mcp/ , received https:// .service-now.com

Workaround On versions where the fix is available (AP8+ and BP2+) This fix was set on zBoot but was not automatically applied on upgrade.

To enable the fix on an upgraded instance, manually create and set the following system properties: glide.oauth.metadata.base_asm_route.enabled=true glide.oauth.metadata.prm_issuer_resolution.enabled=true

After completing these steps, re-confirm all MCP clients to the instance. Some clients may rely on the previous metadata behavior.

Pre AP8/BP2 This issue can be bypassed by providing metadata on the base instance URL and then advertising the instance as its own authorization server.

1. Install and commit the attached update set (oidc_metadata_update_set.xml):

Remove this update set in the Brazil release when a feature that emits the OIDC metadata endpoint for an instance becomes available.

2. Create a new record in the oidc_provider_configuration table:

Name=Self

User Claim=sub

User Field=Sys ID

JTI Claim=jti

The 'OIDC Metadata URL' must be set to the path to the OIDC metadata endpoint on this same instance (https:// .service-now.com/.well-known/openid-configuration).

3. Create a 'OAuth Protected Resource Idp Mappings' record that maps the given MCP server to the oidc_provider_configuration record.

The result is that in the protected resource metadata, the instance url with no resource path will be advertised and the MCP client will be able to use the OIDC metadata endpoint to identify this base URL as an authorization server. Clients must be on at least the 2025-11-25 MCP spec to use the OIDC metadata.