{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40656,"path":"platform-security/authentication/t_CreateUpdateIdentityProvider.md","title":"Create an external identity provider","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create an external identity provider\n\nAfter you have configured the multi-provider SSO properties, you can update or create new SAML 2.0 or digest token identity provider.\n\n## Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n## Procedure\n\n1.  Navigate to **All** > **Multi-Provider SSO** > **Identity Providers**.\n\n2.  To edit an identity provider record, click the record.\n\n    -   For digest token configurations, manually update the properties.\n    -   For SAML2 Update 1 configurations, automatically update the identity provider metadata with the **Import Identity Provider Metadata** related link or update the properties manually.\n    -   For OpenID Connect configurations, manually update the properties.\n3.  To create a new identity provider, click **New**.\n\n    -   For digest token configurations: Click **Digest SSO** and enter the digest properties for multi-provider single sign-on.\n    -   For SAML2 configurations: Click **MultiSSOV2\\_SAML2\\_custom** and import the identity provider metadata from a URL, as XML, or manually enter the identity provider information.\n\n        \\[Omitted image \"Import\\_metadata.png\"\\] Alt text: Importing identity provider metadata\n\n    -   For OpenID Connect: Click **OpenID Connect** and enter client ID, client secret, and well known configuration URL.\n4.  To make the IdP the failover IdP that is used when the default IdP is not available, select the **Default** check box.\n\n    If you have SAML 2 Update 1 active and you upgrade to the Fuji release, the SAML 2 Update 1 IdP is selected as the default failover. No default failover IdP is selected for new instances or if you are upgrading from a release on which SAML 2 Update 1 is not active.\n\n    **Note:** The metadata import process automatically creates a certificate record for the identity provider. Navigate to the **x509 Certificate** module to see the certificate.\n\n    **Note:** Certificates for single-sign on should always be in PEM format to work with SAML certificates.\n\n5.  If E-Signature is active, configure the Identity Provider form and add the **Assertion Consumer URL for eSignature authentication** field.\n\n    In most cases, this URL is: `https://YOURINSTANCE.service-now.com/consumer.do`. However, if you employ a customized method of handling the SAML authentication for E-Signature, you can set up your own consumer URL. If you are only using SAML 2.0 Update 1 and not using Multi-Provider Single Sign-on, configure the assertion consumer URL with [E-signature SAML properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/c_AddingSupportForESignature.md).\n\n\n"}}