[PRM & ASM] MCP clients that do strict issuer validation cannot connect to the ServiceNow MCP Server - Known Error

[PRM & ASM] MCP clients that do strict issuer validation cannot connect to the ServiceNow MCP Server Description Due to an issue in which the protected resource metadata for the MCP includes the resource path in the authorization server URL, there is an issuer mismatch in which glide is the authorization server. Further, Glide does not advertise any metadata at the base metadata path (https:// .service-now.com/well-known/oauth-authorization-server/).

Steps to Reproduce

1. Attempt to connect codex via cli to any ServiceNow MCP: codex mcp login

2. Error: Authorization server issuer mismatch: expected https:// .service-now.com/sncapps/mcp-server/mcp/ , received https:// .service-now.com

Workaround This can be bypassed by providing metadata on the base instance URL and then advertising the instance as its own authorization server.

1. Install and commit the attached update set ( oidc_metadata_update_set.xml ):

> NOTE: Customers who install this update set will want to back it out in the Brazil release when a feature which emits the OIDC metadata endpoint for an instance goes live

2. Create a new record in the oidc_provider_configuration table:

Name=Self

User Claim=sub

User Field=Sys ID

JTI Claim=jti

The 'OIDC Metadata URL' must be set to the path to the OIDC metadata endpoint on this same instance (https:// .service-now.com/.well-known/openid-configuration).

3. Create a 'OAuth Protected Resource Idp Mappings' record that maps the given MCP server to the oidc_provider_configuration record.

The result is that in the protected resource metadata, the instance url with no resource path will be advertised and the MCP client will be able to use the OIDC metadata endpoint to identify this base URL as an authorization server. Clients must be on at least the 2025-11-25 MCP spec to use the OIDC metadata.