---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Multi-Provider SSO (SAML) IdP authentication flow

# Multi-Provider SSO (SAML) IdP authentication flow {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Describes the different entities that can authenticate a user through the SAML
multi-SSO.  
You can follow the authentication flow to understand when an entity authenticates a user using Multi-SSO.  

Local DB
:   If Multi-SSO is not enabled, authentication directs to a local DB.

SAML SSO Cookie IdP
:   If a SAML SSO cookie exists, the IdP which is specified with this cookie authenticates the
    user.

Auto-redirect IdP
:   If the auto-redirect IdP is enabled, this IdP authenticates the user.

Federated IdP
:   If the user browser is redirected to the external authorization (login_locate_sso.do) login
    screen, and the user exists in the user table with the IdP set in the SSO Source field as federation: xxx, then the federated IdP authenticates the
    user.

Associated IdP
:   If the user browser is redirected to the external authorization (login_locate_sso.do) login
    screen, and the user exists in the user table with the IdP set in the SSO Source field as sso: xxx, then the associated IdP authenticates the user.

Auto-provisioning IdP
:   If the user browser is redirected to the external authorization (login_locate_sso.do) login
    screen, and the user does not exist in the user table, but auto-provisioning is enabled, then
    the auto-provisioning IdP authenticates the user.  
    Hinweis:  
    If there is more than one auto-provisioning IdP enabled, the user can choose the auto-provisioning IdP they can use.

Default IdP
:   If the user browser is redirected to the external authorization (login_locate_sso.do) login
    screen, and the user either:

    * Does not exist in the user table, auto-provisioning is not enabled, and there is an active default IdP
    * Exists in the user table, an IdP is not specified on the SSO source user or company record, and there is an active default IdP
    {#idpauthflow__ul_evt_tdy_4y}then the default IdP authenticates the user.