ServiceNow

Protocol: OIDC (preferred) or SAML (see note) Native feature: Multi-Provider SSO Estimated time: 20-30 minutes Reference docs: ServiceNow - OIDC as a SSO identity provider (opens in a new tab) (verified against the Yokohama release, 2026)

SAML note

If your ServiceNow instance is already configured with a SAML identity provider, or your organisation's security policy requires SAML for ITSM tools, skip to the Generic SAML Setup page instead. OIDC and SAML achieve the same result; this guide covers OIDC.

Prerequisites

• ServiceNow Washington DC or later (OIDC support varies by release - check your release notes)
• admin or security_admin role in ServiceNow
• Application registered with LuxID with redirect URI: https://your-instance.service-now.com/navpage.do
• Client ID and Client Secret from your LuxID registration

Step 1 - open multi-provider SSO

In ServiceNow, navigate to Multi-Provider SSO > Identity Providers and click New.

Select OpenID Connect as the provider type.

Step 2 - field mapping

ServiceNow field	Value to enter
Name	LuxID
Default	As required by your organisation
Client ID	Your Client ID from your LuxID registration
Client Secret	Your Client Secret from your LuxID registration
Well Known Configuration URL	https://login.luxid.lu/.well-known/openid-configuration
User Field	email
User Claim	email
Send Authorization Request	POST
Include State	Ticked

After saving, ServiceNow will attempt to retrieve the well-known configuration and auto-populate the endpoint fields. Verify:

Auto-populated field	Expected value
Authorization URL	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Token URL	https://login.luxid.lu/mga/sps/oauth/oauth20/token
User Info URL	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
JWKS URL	https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID

If auto-population fails, enter the values manually from the table above.

User field mapping

In the User Provisioning tab:

ServiceNow attribute	LuxID claim
User ID (sys_id lookup)	email
First name	given_name
Last name	family_name
Email	email

Step 3 - test login

1. Set the Well Known Configuration URL to https://login-uat.luxid.lu/.well-known/openid-configuration temporarily
2. Use an incognito browser window to avoid cached sessions
3. Navigate to your ServiceNow instance login page and select LuxID from the provider list
4. Complete authentication on login-uat.luxid.lu
5. Verify the ServiceNow user record is created or matched correctly

Step 4 - production checklist and common errors

Production checklist

• Restore the Well Known Configuration URL to login.luxid.lu
• Verify user provisioning rules match your ServiceNow user lifecycle policy
• Test with a real LuxID Account
• Confirm fallback authentication (local admin account) is maintained for break-glass access

Common errors

Error	Cause	Fix
AADSTS50011 / redirect mismatch	Callback URL not whitelisted	Ask LuxID to whitelist the exact ServiceNow callback URL
User not found / not created	User provisioning not enabled	Enable auto-provisioning in the User Provisioning tab
Clock skew error	ServiceNow server time out of sync	Synchronise NTP on the ServiceNow MID server
Well Known URL fetch fails	Network restriction	Ensure ServiceNow can reach login.luxid.lu on port 443