CSC signing

Introduction

The Cloud Signature Consortium (CSC) is a standard protocol for cloud-based digital signatures that supports web and mobile applications and complies with the most demanding electronic signature regulations in the world. The goal is to provide a common technical specification that will make solutions interoperable and suitable for uniform adoption in the global market, and to meet the highest level requirements of the European Union’s regulation on Identification and Trust Services (eIDAS). SigningHub supports the Cloud Signature Consortium (CSC) API protocol, this enables customers to leverage Remote Signing Service Providers (RSSP) for signing documents. Support for CSC within SigningHub now means customers can not only use SigningHub with Ascertia ADSS Signing Server but also independently with a CSC compliant RSSP.

SigningHub supports Cloud Signature Consortium (CSC) signing via the following two flows:

• CSC Signing - Client Credentials Flow

• CSC Signing - Authorisation Code Flow

---

CSC Signing - Client Credentials Flow

• How it works?

• Configure a Connector in SigningHub Admin

• Configure a Signing Profile in SigningHub Admin

• Add Signing Profile to a Service Plan in SigningHub Admin

• Add Signing Server to a User Role in SigningHub Web

• Specify the CSC User ID against your profile in SigningHub Web

• CSC Signing

---

How it works?

1. To perform CSC signing, you must configure a CSC connector, in SigningHub Admin.

2. Configure a signing profile using the connector, in SigningHub Admin.

3. Configure the signing profile to the service plan, in SigningHub Admin.

4. Add Signing Server to your enterprise user role that you want to use for CSC signing.

5. Specify your CSC User ID against your profile.

6. Sign the document using the CSC Signing Server via SigningHub Web or API.

---

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "CSC" as the "Provider".

   
2. In the "Details" section, choose "Client Credentials" as the "Auth Type".

   

A call back URL has to be registered with the CSC (Cloud Signature Consortium) signing server. The URL where the user will be redirected after the authorisation process has completed. Here is the format of call back URL: "{DEPLOYMENT_WEB_URL}/CSC/OAuth/CallBack" For example if your SigningHub site is "https://web.signinghub.com" then the Callback URL for SigningHub will be "https://web.signinghub.com/CSC/OAuth/CallBack".

---

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Select the CSC Connector created earlier, in the highlighted field below:

   

---

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to the service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

   

---

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

   

---

Specify the CSC User ID against your profile in SigningHub Web

Make the following configurations to your profile in SigningHub Web:

1. In your "Profile Information" tab, specify the "Cloud Signature Consortium (CSC) User ID".

   

---

Signing

Sign the document using the CSC Signing Server via SigningHub Web or API.

Signing via SigningHub Web

To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:

1. From the document listing, open a document having the signature field that you want to sign.

2. Double-click on the signature field and select the CSC Signing Server.

   
3. Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.

1. The signing logs are maintained under "User Activity Logs", "Workflow History", and "Workflow Evidence Report".

2. In case of CSC Signing:

   • Whenever a user clicks on the "Sign Now" button, to sign the document, the document will be locked. While the document is locked, other recipient can not process the document. The document will automatically unlock in case:

     • The signature has been successfully applied.

     • A period of 5 minutes has passed since the document was locked. (If you refresh or kill the browser window after clicking on the "Sign Now" button, the document will unlock after a period of 5 minutes has passed since the document was locked.)

     • Any exception has occurred from SigningHub or the CSC Server.

     • Any cancel action has been performed after clicking the "Sign Now" button.

   • If the package has multiple documents, the locking functionality will only lock the document being signed, and not the whole package.

   • The document locking functionality also works in case of Bulk Signing.

Signing via API

To perform CSC signatures via API, follow the below-mentioned steps:

1. Use the "Authenticate" API to get the authentication token of the user who is performing the signatures.

2. The signature application uses the "Get RSSP Information" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.

3. The signature application uses the "Get RSSP Info" API which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.

4. The signature application gets the access token using the "Get Access Token | SAD" API, Server will itself decide the grant_type (client_credentials / authorization_code) depending on its configurations.

5. The signature application gets the list of credentials associated using the "Get Filtered Credential List" API. if the RUT filtration is required this API will filter the credentials as per the RUT values. A user may have one or multiple credentials hosted by a single remote signing service provider.

6. The signature application gets the information on a signing credential, its associated certificate, and a description of the supported authorization mechanism using the "Get Credentials Info" API.

7. If the "authorization_required" parameter is true, in response to the "Get RSSP Information" API, the "Get Account Token" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" CSC Server endpoint.

8. Use the "Get Document Hash" API to get the hash of the document.

7. The signature application can use any one of the following API for authorization of credential ID, based on the response of the "Get Credentials Info" API of the CSC server:

• "Send OTP via RSSP" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.
• "RSSP Credentials Authorization" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "Get Sign Hash from RSSP" API request.
• "oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD via "Get Access Token | SAD" API. The SAD received in response shall be used in the "Get Sign Hash from RSSP" API request.

8. Use the "Embed Signature" API to embed signatures in the document.

9. The signature application uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:

• "Revoke Access Token" API to revoke the service access token or refresh token.
• "Revoke OAuth2 Access Token" API to revoke an OAuth 2.0 access token or refresh token.

The CSC Signing process can be a one-step or two-step operation, depending on the SCAL value returned by the "Get Credentials Info" API response. The distinction lies in how the document hash is calculated and how the signature is embedded.

• 1-Step Sign:

  • Condition: If SCAL is 1 in the "Get Credentials Info" API response, the signature application does not need to call the "Get Document Hash" API to calculate the document hash.
  • Process: The application simply collects the necessary data to call the "Sign Document via RSSP Directly" API. This API will automatically calculate the document hash, sign it using the CSC server, and embed the signature directly into the document.
• 2-Step Sign:

  • Condition: If SCAL is 2 in the "Get Credentials Info" API response.
  • Process: Follow the below steps:

    • First, the signature application must call the "Get Document Hash" API to retrieve the document’s hash.
    • Next, the application must call the "Embed Signature" API to embed the signature into the document.

---

CSC Signing - Authorisation Code Flow

• How it works?

• Configure a Connector in SigningHub Admin

• Configure a Signing Profile in SigningHub Admin

• Add Signing Profile to a Service Plan in SigningHub Admin

• Add Signing Server to a User Role in SigningHub Web

• CSC Signing

---

How it works?

1. To perform CSC signatures, you must configure a CSC connector, in SigningHub Admin.

2. Configure a signing profile using the connector, in SigningHub Admin.

3. Configure the signing profile to the service plan, in SigningHub Admin.

4. Add Signing Server to your enterprise user role that you want to use for CSC signing.

5. Sign the document using the CSC Signing Server via SigningHub Web or API.

---

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "CSC" as the "Provider".

   
2. In the "Details" section, choose "Authorization Code" as the "Auth Type".

   

A call back URL has to be registered with the CSC (Cloud Signature Consortium) signing server. The URL where the user will be redirected after the authorisation process has completed. Here is the format of call back URL: "{DEPLOYMENT_WEB_URL}/CSC/OAuth/CallBack" For example if your SigningHub site is "https://web.signinghub.com" then the Callback URL for SigningHub will be "https://web.signinghub.com/CSC/OAuth/CallBack".

---

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Select the CSC Connector created earlier, in the highlighted field below:

   

---

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to the service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

   

---

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Admin:

1. Against your user role, in the "Singing Server Preferences" tab, add the signing server.

---

Signing

Sign the document using the CSC Signing Server via SigningHub Web or API.

Signing via SigningHub Web

To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:

1. From the document listing, open a the document having the signature field that you want to sign.

2. Click on the signature field, select the CSC Signing Server.

   
3. Input the CSC user credentials, provided by the CSC Signing Server.

   
4. Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.

1. The signing logs are maintained under "User Activity Logs", "Workflow History", and "Workflow Evidence Report".

2. In case of CSC Signing:

   • Whenever a user clicks on the "Sign Now" button, to sign the document, the document will be locked. While the document is locked, other recipient can not process the document. The document will automatically unlock in case:

     • The signature has been successfully applied.

     • A period of 5 minutes has passed since the document was locked. (If you refresh or kill the browser window after clicking on the "Sign" button, the document will unlock after a period of 5 minutes has passed since the document was locked.)

     • Any exception has occurred from SigningHub or the CSC Server.

     • Any cancel action has been performed after clicking the "Sign Now" button.

   • If the package has multiple documents, the locking functionality will only lock the document being signed, and not the whole package.

   • The document locking functionality also works in case of Bulk Signing.

Signing via API

To perform CSC signatures via API, follow the below-mentioned steps:

1. Use the "Authenticate" API to get the authentication token of the user who is performing the signatures.

2. The signature application uses the "Get RSSP Information" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.

3. The signature application uses the "Get RSSP Info" API which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.

4. If the "authorization_required" parameter is true, in response to the "Get RSSP Information" API, the "Get Account Token" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" endpoint.

4. The signature application requests authorization for the user to access the RSSP resources using the "oauth2/authorize" API of the CSC server. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain an access token with "service" as scope. To get the access token call the "Get Access Token | SAD" SigningHub API to get the Bearer/SAD token.

5. The signature application gets the list of credentials associated using the "Get Filtered Credential List" API. if the RUT filtration is required this API will filter the credentials as per the RUT values. A user may have one or multiple credentials hosted by a single remote signing service provider.

6. The signature application gets the information on a signing credential, its associated certificate, and a description of the supported authorization mechanism using the "Get Credentials Info" API.

7. If the "authorization_required" parameter is true, in response to the "Get RSSP Information" API, the "Get Account Token" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" CSC Server endpoint.

8. Use the "Get Document Hash" API to get the hash of the document.

7. The signature application can use any one of the following API for authorization of credential ID, based on the response of the "Get Credentials Info" API of the CSC server:

• "Send OTP via RSSP" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.
• "RSSP Credentials Authorization" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "Get Sign Hash from RSSP" API request.
• "oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD via "Get Access Token | SAD" API. The SAD received in response shall be used in the "Get Sign Hash from RSSP" API request.

8. Use the "Embed Signature" API to embed signatures in the document.

9. The signature application uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:

• "Revoke Access Token" API to revoke the service access token or refresh token.
• "Revoke OAuth2 Access Token" API to revoke an OAuth 2.0 access token or refresh token.

The CSC Signing process can be a one-step or two-step operation, depending on the SCAL value returned by the "Get Credentials Info" API response. The distinction lies in how the document hash is calculated and how the signature is embedded.

• 1-Step Sign:

  • Condition: If SCAL is 1 in the "Get Credentials Info" API response, the signature application does not need to call the "Get Document Hash" API to calculate the document hash.
  • Process: The application simply collects the necessary data to call the "Sign Document via RSSP Directly" API. This API will automatically calculate the document hash, sign it using the CSC server, and embed the signature directly into the document.
• 2-Step Sign:

  • Condition: If SCAL is 2 in the "Get Credentials Info" API response.
  • Process: Follow the below steps:

    • First, the signature application must call the "Get Document Hash" API to retrieve the document’s hash.
    • Next, the application must call the "Embed Signature" API to embed the signature into the document.