Notifications

28 views

Details

E-signatures approval is dependent on login either local or SSO

  • On a local login, it uses the local authentication on an e-signature approval.
  • For the user logged in via SSO, the e-signature approval get authenticated in IDP.

Difference of SAML request with normal login and e-signature:

  • On Login request, AssertionConsumerServiceURL attribute ends with navpage.do
  • On SAML Response, AssertionConsumerServiceURL attribute will have consumer.do and it was generated by a Processor(sys_processor) - eSigSaml2AssertionConsumer

Sample SAML Request and Response for E-signature:

SAML Request xml: 

<saml2p:AuthnRequest
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://example.service-now.com/consumer.do"
ForceAuthn="true" ID="SNC36b2fa3aca663141897276ca8e0f1bbe"
IsPassive="false"
IssueInstant="2020-01-27T19:13:57.250Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
ProviderName="https://example.service-now.com/navpage.do" Version="2.0">
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://example.service-now.com
</saml2:Issuer>
<saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</saml2p:AuthnRequest>

SAML Response xml: 

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="https://example.service-now.com/consumer.do" ID="id5381307154065787623310946" IssueInstant="2020-01-27T19:13:57.836Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.IDP.com/exktestnkqB90o1C0h7
</saml2:Issuer>
<ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#id5381307154065787623310946">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>eU/omPLsEutesttestUEQP2G8=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>

----- Signture -----

</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>

---- Certificate ----

</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion ID="id53813071541381921267742236" IssueInstant="2020-01-27T19:13:57.836Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://www.IDP.com/exkfetest120o1C0h7</saml2:Issuer>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">342464</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData NotOnOrAfter="2020-01-27T19:18:57.836Z" Recipient="https://example.service-now.com/consumer.do"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2020-01-27T19:08:57.836Z" NotOnOrAfter="2020-01-27T19:18:57.836Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://example.service-now.com</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2020-01-27T19:13:57.836Z" SessionIndex="id1580152437835.1924273305">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</saml2p:Response>

Article Information

Last Updated:2020-09-30 06:46:01
Published:2020-09-30