When using a cloud-based installation, SigningHub gives you an option to use your Microsoft Active Directory Federation Services (ADFS) credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your organizational domain user ID and password will be used for SigningHub authentication. However, logging in through your Microsoft ADFS credentials for the first time, will take you to the registration screen and display your Microsoft ADFS ID (email address) for new registration. After registration, you can easily login through your Microsoft ADFS credentials.

Login through your Microsoft ADFS credentials

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Microsoft ADFS" option.

4. A popup will appear, specify your domain user ID (registered in Active Directory) and password. Click "Ok".

5. From the next appearing screen, select the relying party from the "Select one of the following sites" option. Click "Go".

When using an on-premises installation, SigningHub gives you an option to use your Microsoft Active Directory credentials to log into SigningHub. You don't even need to have a SigningHub ID, as your organizational domain user ID and password will be used for SigningHub authentication. In such a case, logging in through your Microsoft Active Directory credentials for the first time, will take you to the registration screen and display your Microsoft Active Directory ID (email address) for new registration. After registration, you can log in through your Microsoft Active Directory credentials. However, if the "Automatically register the users" option is enabled from the "Auto Provision Users" screen, and an Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Active Directory users from there will be automatically registered and activated in SigningHub.

Login through your Microsoft Active Directory credentials

1. Browse your local on-premises installation URL.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Microsoft Active Directory" option.

4. Specify your user ID (registered in Active Directory) and domain password.

5. Click the "Login" button.

Single Sign-on (SSO) provision

Single sign-on (SSO) is an authentication process that allows a user to utilise his specific credentials (ID and password) to access multiple applications. The process authenticates the user for all the applications they have been given rights and avoids further prompts when they switch applications during a particular session. The "Microsoft Active Directory" authentication method also supports the Single sign-on (SSO) facility. To configure this, go to the integration screen and select "Active Directory" in the "Default Authentication Method" drop-down. However, there are certain browser based configurations that need to be done at the client's end, in order to seamlessly use SSO against the "Microsoft Active Directory" authentication method.

Configurations required in Microsoft Internet Explorer (IE)/ Google Chrome for each individual

When accessing the SigningHub app through Microsoft Internet Explorer or Google Chrome for SSO, an individual would need to do the following configurations:

1. Open the "Internet Options" dialogue box by choosing "Internet Options" either from the Control Panel or from the "Tools" menu in Internet Explorer.

2. In the "Internet Options" dialog box, on the "Security" tab, select "Local intranet", and then click "Custom Level".

3. In the "Security Settings" dialogue box, under "Logon", select "Automatic logon only in Intranet zone", and then click "OK".

4. In the "Internet Options" dialogue box on the "Security Settings" tab with "Local intranet" still selected, click "Sites".

5. In the "Local intranet" dialogue box, click "Advanced".

6. In the next dialogue box (also titled "Local intranet"), type the URL of your Communicator Web Access site (for example, https://web.signinghub.com) in the "Add this Web site to the zone box", and then click "Add".

7. In the "Local intranet" dialog, box click "OK".

8. In the original "Local intranet" dialogue box, click "OK".

9. In the "Internet Options" dialogue box, click "OK".

Configurations required in Microsoft Internet Explorer (IE)/ Google Chrome by using Group Policy

When the end users (within Active Directory) need to access the SigningHub app through Microsoft Internet Explorer or Google Chrome for SSO, a network administrator could make the following browser configurations for all the users through Group Policy:

1. Open the Group Policy Management Console, and then either create a new Group Policy Object (GPO) or edit an existing GPO.

2. Expand "Computer Configuration", expand "Policies", expand "Administrative Templates", expand "Windows Components", expand "Internet Explorer", expand "Internet Control Panel", and then click "Security Page".

3. In the details pane, double-click "Site to Zone Assignment List".

4. In the "Site to Zone Assignment List Properties" dialog box, click "Enabled".

5. In the "Site to Zone Assignment List Properties" dialog box, click "Show".

6. In the "Show Contents" dialogue box, click "Add".

7. In the "Add Item" dialogue box, type the URL of your Communicator Web Access site (for example, https://web.signinghub.com) in the "Enter the name of the item to be added" box.

8. Type "1" (indicating the local intranet zone) in the "Enter the value of the item to be added" box, and then click "OK".

9. In the "Show Contents" dialogue box, click "OK".

10. In the "Site to Zone Assignment List" dialog box, click "OK".

11. In the Group Policy Management Editor, click "Intranet Zone".

12. In the details pane, double-click "Logon options".

13. In the "Logon options Properties" dialogue box, click "Enabled".

14. In the "Logon options" list, click "Automatic logon only in Intranet zone", and then click "OK".

15. Close the Group Policy Management Editor.

Configurations required in Mozilla Firefox for each individual

When accessing the SigningHub app through Mozilla Firefox for SSO, an individual would need to do the following configurations:

1. Browse the URL "about:config" in Firefox.

2. Click the "I'll be careful, I promise!" button.

3. In the next appearing screen, search the "network.negotiate-auth.trusted-uris" preference and double-click on it.

4. A dialogue box will appear, specify the URL of your Communicator Web Access site (for example, https://web.signinghub.com) and click "OK".

SigningHub gives you an option to use your LinkedIn credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your LinkedIn account will be used for SigningHub authentication. However, logging in through your LinkedIn account for the first time, will take you to the registration screen and display your LinkedIn ID (email address) for new registration. After registration, you can easily login through your LinkedIn account.

Login through your LinkedIn account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "LinkedIn" option. The LinkedIn app will appear in a popup.

4. Specify your LinkedIn ID and password in the app.

5. Click the "Log into LinkedIn" button. SigningHub permissions screen will appear.

6. Click the "Allow" option. The system will let you log into SigningHub.

SigningHub gives you an option to use your Salesforce credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Salesforce account will be used for SigningHub authentication. However, logging in through your Salesforce account for the first time, will take you to the registration screen and display your Salesforce ID (email address) for new registration. After registration, you can easily login through your Salesforce account.

Login through your Salesforce account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Salesforce" option. The Salesforce app will appear in a popup.

4. Specify your Salesforce ID and password in the app.

5. Click the "Log into Salesforce" button. SigningHub permissions screen will appear.

6. Click the "Allow" option. The system will let you log into SigningHub.

Login through your SigningHub account

1. Go to the SigningHub login screen.

2. Click the "SigningHub ID" option.

3. Specify your SigningHub ID that you registered at the time of subscription.

4. Click the "Next" button.

5. Specify your password, and click the "Login" button.

SigningHub offers a range of secure login and authentication methods to ensure a seamless and protected experience for all users. You can conveniently access your SigningHub account using your SigningHub ID or choose from various third-party authentication options that integrate seamlessly with your existing systems. These include popular platforms such as Microsoft Active Directory, Salesforce, Microsoft ADFS, Microsoft Office 365, LinkedIn, and Google.

To enhance security, SigningHub also supports two-factor authentication (2FA) through One-Time Passwords (OTP), ensuring that only authorized users can access sensitive information. For added flexibility, users can utilize SSL client certificates, as well as identity solutions like Freja Mobile, Freja eID, Bank ID, and itsme.

Organizations looking for advanced authentication methods can leverage options like Azure Active Directory, corporate logins, OpenID Connect (OIDC), OAuth2, and Azure SAML for a streamlined login experience. Selecting the authentication method that best fits your needs is crucial for maintaining security and ensuring ease of access to your SigningHub account. With these versatile options, you can choose the most suitable way to log in and manage your digital signing processes effectively.

Select the authentication option you wish to use.

SigningHub also allows you to use OTP via SMS as a secondary authentication method in conjunction with any of the pre-configured authentication methods above. This will make you feel more secure by going through two-factor authentication at the login time. The availability of OTP security features as two-factor authentication is subject to your subscribed service plan and login authentication settings. If you are willing to use this provision, please contact your Enterprise Admin to .

To see an end-to-end flow for OTP authentication at the time of login, .

Using OTP as a two-factor authentication

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click your pre-configured authentication method, i.e. SigningHub ID, Salesforce, etc.

4. Log in with your respective credentials. If the provided credentials are correct:

   1. An OTP will be sent to your mobile device or email address.

   2. A dialogue box will appear on the login screen to enter the received OTP

   3. Once OTP is received enter it in the text field. In case OTP is not received, you may select the option to resend it. You can also choose another method for OTP by selecting 'Switch Method'

5. Enter the received OTP and click the "Login" button.

SigningHub gives you an option to use your Microsoft Office 365 credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your account will be used for SigningHub authentication. Currently, Office 365 uses Azure Active Directory (Azure AD) to manage identities and authentication. However, logging in through your Microsoft Office 365 credentials for the first time, will take you to the registration screen and display your Microsoft Office 365 ID (email address) for new registration. After registration, you can easily login through your Microsoft Office 365 credentials.

Login through your Microsoft Office 365 account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Microsoft Office 365" option. The Microsoft Office 365 app will appear in a popup.

4. Specify your Microsoft Office 365 ID and password in the app.

5. Click the "Login" button. SigningHub permissions screen will appear.

6. Click the "Accept" option. You will be authenticated into SigningHub.

Introduction

SigningHub gives you the option to pre-authorise users in your Microsoft Active Directory so that they may serve as your registered enterprise users. In this way, your enterprise users can use their Directory credentials (i.e. organizational domain user ID and password) for SigningHub authentication, and won't even need to create their SigningHub IDs.

How it works?

1. Configure an Active Directory connector in SigningHub Admin.

2. Configure the connector in an authentication profile, in SigningHub Admin.

3. Configure auto provisioning in SigningHub Web.

4. Configure a security group for auto-provisioning.

5. Auto-provision users at the time of login.

Configure a connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Active Directory" as the "Provider".
2. In the "Details" section, fill in the required fields.

Configure an authentication profile in SigningHub Admin

Make the following configurations to an authentication profile in SigningHub Admin:

1. Select the Active Directory Connector created earlier, in the highlighted field below:

Configure auto-provisioning in SigningHub Web

Make the following configurations in the "Users" tab in SigningHub Web:

1. In the "Auto Provision Users" section, check the "Automatically register the users" check box and select the "Authentication Profile", created earlier. Click the "Save" button.

Configure a security group for auto-provisioning

SingingHub also allows you to give role-based access to SigningHub (i.e. Enterprise Admin, Enterprise Users, etc.) at the Security Group level.

Make the following configurations to a security group in SigningHub Web:

1. For the security group, add the name and role of the security group.

Auto-provision users at login

1. From the "More Login Options" option, select Active Directory.
2. Provide your Active Directory credentials.
3. The following login preferences will be followed when logging into SigningHub Web via Active Directory:

Login preferences for auto-provisioning

SigningHub gives you an option to use your Google credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your account will be used for SigningHub authentication. However, logging in through your Google account for the first time, will take you to the registration screen and display your Google ID (email address) for new registration. After registration, you can easily login through your Google account.

Login through your Google account

1. Go to the SigningHub login screen. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

2. Click the "Google" option. The Google app will appear in a popup.

3. Specify your Google ID and password in the app.

4. Click the "Log into Google" button. SigningHub permissions screen will appear.

5. Click the "Allow" option. The system will let you log into SigningHub.

SigningHub primarily depends on your registered enterprise user ID (email address) for your authentication. However, if you want to attach another unique ID with your account, SigningHub gives you an option to use your SSL certificate to log into SigningHub. For this, your SSL certificate needs to be registered in SigningHub through SigningHub API.

Login through your SSL certificate

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "SSL Client Authentication" option. A popup will appear to select your SSL certificate.

4. Select your certificate and click OK.

Verisec is an identity and access management platform, that provides a strong authentication solution to safeguard access to the system. SigningHub enables you to use the Freja eID app as an optional login and signing authentication method.

Login through your Freja eID app

For this, you need to have a Freja eID account. Once you have registered with Freja eID:

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Freja eID" option.

4. Specify your user ID that is registered with Freja eID.

5. Click the "Next" button. An authentication request will be sent to your mobile device.

6. Run the "Freja eID" app on your mobile device.

7. Open the authentication request and approve it from there. You will be logged in to your SigningHub account.

SigningHub gives you an option to use your Microsoft Azure Active Directory credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Azure Active Directory account will be used for SigningHub authentication. However, logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily log in through your Azure Active Directory credentials.

However, if the "Automatically register the users" is enabled from the "Auto Provision Users" screen, and an Azure Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Azure Active Directory users from there will be automatically registered and activated in SigningHub.

Login through your Azure Active Directory

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Azure AD" option. The Microsoft Azure Active Directory app will appear in a popup.

4. Specify your Microsoft Azure Active Directory ID and password in the app.

5. Click the "Sign in" button. You will be authenticated into SigningHub.

SigningHub gives you an option to use your IDP credentials (OAuth2 supported protocol) to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your personal account will be used for SigningHub authentication. However, logging in through your personal credentials for the first time, will take you to the registration screen and display your personal (email address) for new registration. After registration, you can easily login through your personal credentials.

Login through your supported OAuth2 account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "OAuth2 Configured profile" option. The configured app will appear in a popup.

4. Specify your ID and password in the app.

5. Click the "Login" button. SigningHub permissions screen will appear.

6. Click the "Accept" option. You will be authenticated into SigningHub.

Introduction

SigningHub gives you an option to pre-authorize users in your Azure Active Directory so that they may serve as your registered enterprise users. In this way, your enterprise users can use their Directory credentials (i.e. organizational domain user ID and password) for SigningHub authentication, and won't even need to create their SigningHub IDs.

How it works?

1. Configure an Azure Active Directory connector in SigningHub Admin.

2. Configure the connector in an authentication profile, in SigningHub Admin.

3. Configure auto provisioning in SigningHub Web.

4. Configure a security group for auto-provisioning.

5. Auto-provision the users at login

Configure a connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Azure Active Directory" as the "Provider".
2. In the "Details" section, fill in the required fields.

Configure an authentication profile in SigningHub Admin

Make the following configurations to an authentication profile in SigningHub Admin:

1. Select the Azure Active Directory Connector created earlier, in the highlighted field below:

Configure auto-provisioning in SigningHub Web

To see in detail, how to pre-authorise users in SigningHub, click here.

Make the following configurations in the "Users" tab in SigningHub Web:

1. In the "Auto Provision Users" section, check the "Automatically register the users" check box and select the "Authentication Profile", created earlier. Click the "Save" button.

Configure a security group for auto-provisioning

SingingHub also allows you to give role-based access to SigningHub (i.e. Enterprise Admin, Enterprise Users, etc.) at the Security Group level.

Make the following configurations to a security group in SigningHub Web:

1. For the security group, add the name and role of the security group.

Auto-provision users at login

Logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily login through your Azure Active Directory credentials. However, if the "Automatically register the users" check box is ticked from the "Auto Provision Users" screen, and an Azure Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Azure Active Directory users from there will be automatically registered and activated in SigningHub.

1. From the "More Login Options" option, select Azure Active Directory.
2. Provide your Azure Active Directory credentials.
3. The following login preferences will be followed when logging into SigningHub Web via Azure Active Directory:

Login preferences for auto-provisioning

SigningHub gives you the option to authenticate yourself by using Microsoft Azure's SAML-based Single Sign-on credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your account will be used for SigningHub authentication. However, logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily login through your Azure Active Directory credentials.

To configure Azure with SAML and use it in SH below steps needs to be completed

1. Configure Microsoft Azure

2. Configure SigningHub

Configure Microsoft Azure

1. Sign in to the Azure portal using your Azure Active Directory administrator account.

2. Click on the "Active Directory do Azure".

3. Click on the "Enterprise Applications" on the right side.

4. In the app gallery, you can add an unlisted app by selecting the "Non-gallery Application" tile.

5. After entering a Name for your application, you can configure the single sign-on options and behaviour.

6. Once the app is successfully added, it will appear under "Enterprise Applications".

7. Select your added app from the list.

8. To start, click on Single sign-on from the application's left-hand navigation menu. The next screen presents the options for configuring single sign-on.

9. Select the option "SAML-based Sign-on" from the drop-down "Single Sign-on Mode" to configure SAML-based authentication for the application. This requires that the application support SAML 2.0. Complete the following sections to configure single sign-on between the application and Azure AD.

10. To set up Azure AD, enter the basic SAML configuration. You can manually enter the values or upload a metadata file to extract the values of the fields.

11. When a user authenticates to the application, Azure AD will issue a SAML token to the app that contains information (or claims) about the user that uniquely identifies them. By default, this includes the user's username, email address, first name, and last name.

12. When you create Non-Gallery application, Azure AD will create an application-specific certificate with an expiration date of 3 years from the date of creation. You need this certificate to set up the trust between Azure AD and the application.

13. Click on the "Save" button on top.

14. To ensure users can sign in to SigningHub after it has been configured to use Azure Active Directory. Users must be assigned access to SigningHub in Azure AD to sign in.

15. To configure the application for single sign-on, scroll to the end of the SAML-based sign-on configuration page, and then click on Configure SigningHub (Name of the app).

Configure SigningHub

1. For configuration at SigningHub go to the administrator URL such as "https://admin.signinghub.com/".

2. Create the connector by clicking on the add icon from Configurations>Connectors.

3. Select the provider "SAML Identity Provider" from the "Provider" drop-down.

4. Provide the necessary information such as Name, Login & Logout URL (mentioned in step 15), Binding Type (POST/Redirect define in connector), Signature algorithm (SHA1/SHA256 define in connector ), upload IDP certificate downloaded from azure mentioned in step 12 and click on Save button.

5. Export the SP metadata by clicking on the "Export SP Metadata" button, this metadata can be used in step 10.

6. Create the authentication profile by clicking on the add icon from Configurations>Authentication Profiles.

7. Provide the Name, method as "SAML Authentications", Connector that is created in step 19, select the logo and Save the information.

8. Publish the changes.

9. Access the web URL as "https://web.signinghub.com/".

10. Click the "More Login Options".

11. Click on the authentication profile that you have created above.

12. Provide the credentials and log in here

Corporate logins refer to the private authentication method that is set by your Enterprise Admin. In this way, the enterprise users of a certain enterprise can be authenticated by their enterprise-specific authentication method. Such methods are not usually listed under the "More Login Options" link on the login screen for public users.

There are two ways to enjoy the corporate login facility, they are:

Private authentication profile configured in your enterprise user role

When a private authentication profile is , you are provided with an , which contains your branded enterprise GUI for login. But this is not compulsory either, you can be asked to access a public URL for login. The authentication process will be:

• Browse the URL as provided by your Enterprise Admin

• Specify your registered ID in the login screen

• SigningHub will read your ID and will trigger the configured (private) authentication method (i.e. SSL authentication, Microsoft Active Directory, Salesforce, Google, etc.) screen

• Specify your account credentials to authenticate yourself

Private authentication profile configured in your enterprise default settings

When a private authentication profile is , you are always provided with an , which contains your branded enterprise GUI for login. The authentication process will be:

• Browse the Enterprise URL as provided by your Enterprise Admin

• SigningHub will automatically trigger the configured (private) authentication method (i.e. SSL authentication, Microsoft Active Directory, Salesforce, Google, etc.) screen

• Specify your account credentials to authenticate yourself

SigningHub gives you an option to use your IDP credentials (OIDC supported protocol) to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your personal account will be used for SigningHub authentication.

However, logging in through your personal credentials for the first time, will take you to the registration screen and display your personal (email address) for new registration. After registration, you can easily login through your personal credentials.

Login through your supported OIDC account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "OIDC Configured profile" option. The configured app will appear in a popup.

4. Specify your ID and password in the app.

5. Click the "Login" button. SigningHub permissions screen will appear.

6. Click the "Accept" option. You will be authenticated into SigningHub.

OIDC user profile information NID sync with SigningHub NID

When syncing a user's National Identity (NID) and email from OpenID Connect (OIDC) with SigningHub, actions vary based on whether the user already exists in the SigningHub system:

1. If both email and NID are received from OIDC and the user exists in SigningHub: The user will log in, and the NID in the [User] table will be updated with the new NID from OIDC. If the user does not yet exist, they will be registered in the system, and their NID will be added to the [User] table.

2. If only the email is received from OIDC and the user exists in SigningHub: The user will simply log in. If the user does not exist, they will be registered.

3. If only the NID is received from OIDC and the user exists in SigningHub: SigningHub will search for a user with the received NID. If found, the user will log in, and their NID in the [User] table will be updated. If the user does not already exist in SigningHub, an error will be shown, as the user must already be present in the UserIdentity or [User] table for NID-only syncs.

4. If neither email nor NID is received from OIDC: An error will be returned in both cases, as the user must already be present in the UserIdentity or [User] table to proceed with syncing.