Microsoft Active Directory Authentication via API

SigningHub supports Active Directory (AD) authentication using a two-step token exchange process. The client application first authenticates the user through Kerberos to obtain a subject token, which is then exchanged for SigningHub authentication tokens.

---

Step 1: Authenticate the User via Kerberos

Call the Kerberos authentication endpoint to authenticate the user against Active Directory.

API

POST /authenticate/kerberos

Request Body

Parameter	Description
profile_name	Name of the configured Active Directory authentication profile.

Response

On successful authentication, the API returns a temporary subject token.

{  "subject_token": "eyJhbGciOi..."}

The subject_token is required for the next authentication step.

---

Step 2: Exchange the Subject Token for SigningHub Tokens

Use the subject token received from the Kerberos endpoint to obtain SigningHub authentication tokens.

API

POST /authenticate

Request Body

Parameter	Description
client_id	Client application identifier.
client_secret	Client application secret.
grant_type	Must be set to token-exchange.
subject_token	Token received from the /authenticate/kerberos endpoint.

Response

{   "access_token": "eyJhbGciOi...",  
    "refresh_token": "eyJhbGciOi...",  
    "token_type": "Bearer",  
    "expires_in": 3600}

The returned access token is used to authorise subsequent SigningHub API requests.