Login through your SigningHub account

1. Go to the SigningHub login screen.

2. Click the "SigningHub ID" option. Upon clicking, all other login options will be hidden.

3. Specify your SigningHub ID that you registered at the time of subscription.

4. Click the "Next" button.

5. Specify your password, and click the "Login" button.

Login through your Passkey

1. Go to the SigningHub login screen.

2. Click the "Passkey" option. Upon clicking, all other login options will be hidden.

3. Specify the email address associated with your account.

4. Click the "Sign in using Passkey" button.

5. The browser shows a dialogue asking the user to authenticate using a passkey.

6. The user selects a passkey stored in the browser, on a mobile device, or on a USB security key.

7. If verification is successful, the user is granted access.

SigningHub supports Active Directory (AD) authentication using a two-step token exchange process. The client application first authenticates the user through Kerberos to obtain a subject token, which is then exchanged for SigningHub authentication tokens.

Step 1: Authenticate the User via Kerberos

Call the Kerberos authentication endpoint to authenticate the user against Active Directory.

API

Request Body

Response

On successful authentication, the API returns a temporary subject token.

The subject_token is required for the next authentication step.

Step 2: Exchange the Subject Token for SigningHub Tokens

Use the subject token received from the Kerberos endpoint to obtain SigningHub authentication tokens.

API

Request Body

Response

The returned access token is used to authorise subsequent SigningHub API requests.

SigningHub gives you an option to use your Salesforce credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Salesforce account will be used for SigningHub authentication. However, logging in through your Salesforce account for the first time, will take you to the registration screen and display your Salesforce ID (email address) for new registration. After registration, you can easily login through your Salesforce account.

Login through your Salesforce account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Salesforce" option. The Salesforce app will appear in a popup.

4. Specify your Salesforce ID and password in the app.

5. Click the "Log into Salesforce" button. SigningHub permissions screen will appear.

6. Click the "Allow" option. The system will let you log into SigningHub.

When using a cloud-based installation, SigningHub gives you an option to use your Microsoft Active Directory Federation Services (ADFS) credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your organizational domain user ID and password will be used for SigningHub authentication. However, logging in through your Microsoft ADFS credentials for the first time, will take you to the registration screen and display your Microsoft ADFS ID (email address) for new registration. After registration, you can easily login through your Microsoft ADFS credentials.

Login through your Microsoft ADFS credentials

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Microsoft ADFS" option.

4. A popup will appear, specify your domain user ID (registered in Active Directory) and password. Click "Ok".

5. From the next appearing screen, select the relying party from the "Select one of the following sites" option. Click "Go".

SigningHub gives you an option to use your Microsoft Office 365 credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Microsoft Office 365 account will be used for SigningHub authentication. Currently, Office 365 uses Azure Active Directory (Azure AD) to manage identities and authentication. However, logging in through your Microsoft Office 365 credentials for the first time, will take you to the registration screen and display your Microsoft Office 365 ID (email address) for new registration. After registration, you can easily login through your Microsoft Office 365 credentials.

Login through your Microsoft Office 365 account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Microsoft Office 365" option. The Microsoft Office 365 app will appear in a popup.

4. Specify your Microsoft Office 365 ID and password in the app.

5. Click the "Login" button. SigningHub permissions screen will appear.

6. Click the "Accept" option. You will be authenticated into SigningHub.

SigningHub primarily depends on your registered enterprise user ID (email address) for your authentication. However, if you want to attach another unique ID with your account, SigningHub gives you an option to use your SSL certificate to log into SigningHub. For this, your SSL certificate needs to be registered in SigningHub through SigningHub API.

Login through your SSL certificate

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "SSL Client Authentication" option. A popup will appear to select your SSL certificate.

4. Select your certificate and click OK.

This page provides an overview of the login and authentication process in SigningHub. It describes how users can securely access the application using supported authentication methods and explains the login flow, including account selection, enterprise access, and session handling. The page also covers how user and enterprise information is managed during and after authentication to ensure a consistent and secure login experience.

Upon the first successful login, the browser remembers the user’s account, the associated enterprise, and the authentication profile used to log in. During the initial login, the user is directed to their default enterprise. If the user switches between multiple enterprises, those enterprises are also remembered and listed for future access.

Upon logout, the user is redirected to the 'Choose an account' screen, where all remembered accounts are displayed along with their respective enterprises or individual accounts and the authentication profile used to access them. When a remembered account is selected, the associated email address is automatically populated, and the last used authentication method for that account and enterprise combination is automatically triggered. If the authentication method uses a pop-up-based flow, the authentication pop-up is opened seamlessly without requiring the user to manually select the authentication profile again. Upon successful authentication, the user is logged directly into the corresponding account and enterprise.

In the case of an individual account, the label 'Individual Account' is shown instead of an enterprise name.

SigningHub offers a range of secure login and authentication methods to ensure a seamless and protected experience for all users. You can conveniently access your SigningHub account using your SigningHub ID or choose from various third-party authentication options that integrate seamlessly with your existing systems. These include popular platforms such as Microsoft Active Directory, Salesforce, Microsoft ADFS, Microsoft Office 365, LinkedIn, and Google.

To enhance security, SigningHub also supports two-factor authentication (2FA) through One-Time Passwords (OTP), ensuring that only authorised users can access sensitive information. For added flexibility, users can utilise SSL client certificates, as well as identity solutions like Freja Mobile, Freja eID, Bank ID, and itsme.

Organisations looking for advanced authentication methods can leverage options like Azure Active Directory, corporate logins, OpenID Connect (OIDC), OAuth2, and Azure SAML for a streamlined login experience. Selecting the authentication method that best fits your needs is crucial for maintaining security and ensuring ease of access to your SigningHub account. With these versatile options, you can choose the most suitable way to log in and manage your digital signing processes effectively.

Select the authentication option you wish to use.

When using an on-premises installation, SigningHub gives you an option to use your Microsoft Active Directory credentials to log into SigningHub. You don't even need to have a SigningHub ID, as your organizational domain user ID and password will be used for SigningHub authentication. In such a case, logging in through your Microsoft Active Directory credentials for the first time, will take you to the registration screen and display your Microsoft Active Directory ID (email address) for new registration. After registration, you can log in through your Microsoft Active Directory credentials. However, if the "" option is enabled from the "Auto Provision Users" screen, and an Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Active Directory users from there will be automatically registered and activated in SigningHub.

1. Browse your local on-premises installation URL.

SigningHub gives you an option to use your LinkedIn credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your LinkedIn account will be used for SigningHub authentication. However, logging in through your LinkedIn account for the first time, will take you to the registration screen and display your LinkedIn ID (email address) for new registration. After registration, you can easily login through your LinkedIn account.

Login through your LinkedIn account

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "LinkedIn" option. The LinkedIn app will appear in a popup.

4. Specify your LinkedIn ID and password in the app.

5. Click the "Log into LinkedIn" button. SigningHub permissions screen will appear.

6. Click the "Allow" option. The system will let you log into SigningHub.

SigningHub gives you an option to use your Google credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Google account will be used for SigningHub authentication. However, logging in through your Google account for the first time, will take you to the registration screen and display your Google ID (email address) for new registration. After registration, you can easily login through your Google account.

Login through your Google account

1. Go to the SigningHub login screen. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

2. Click the "Google" option. The Google app will appear in a popup.

3. Specify your Google ID and password in the app.

4. Click the "Log into Google" button. SigningHub permissions screen will appear.

5. Click the "Allow" option. The system will let you log into SigningHub.

SigningHub also allows you to use OTP via SMS as a secondary authentication method in conjunction with any of the pre-configured authentication methods above. This will make you feel more secure by going through two-factor authentication at the login time. The availability of OTP security features as two-factor authentication is subject to your subscribed service plan and login authentication settings. If you are willing to use this provision, please contact your Enterprise Admin to .

To see an end-to-end flow for OTP authentication at the time of login, .

1. Go to the SigningHub login screen.

SSL Authentication Flow

SigningHub supports SSL authentication using a two-step token exchange process. The client application first authenticates the user using an SSL client certificate to obtain a subject token, which is then exchanged for SigningHub authentication tokens.

Step 1: Authenticate the User via SSL

Call the SSL authentication endpoint to authenticate the user using the configured SSL authentication profile.

API

POST /authenticate/ssl

Request Body

Response

On successful authentication, the API returns a temporary subject token.

{  "subject_token": "eyJhbGciOi..."}

The subject_token is required for the next authentication step.

Step 2: Exchange the Subject Token for SigningHub Tokens

Use the subject token received from the SSL authentication endpoint to obtain SigningHub authentication tokens.

API

POST /authenticate

Request Body

Response

{   "access_token": "eyJhbGciOi...",  
    "refresh_token": "eyJhbGciOi...",  
    "token_type": "Bearer",  
    "expires_in": 3600}

The returned access token is used to authorize subsequent SigningHub API requests.

Verisec is an identity and access management platform, that provides a strong authentication solution to safeguard access to the system. SigningHub enables you to use the Freja eID app as an optional login and signing authentication method.

For this, you need to have a Freja eID account. Once you have registered with Freja eID:

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

SigningHub gives you an option to use your Microsoft Azure Active Directory credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Azure Active Directory account will be used for SigningHub authentication. However, logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily log in through your Azure Active Directory credentials.

However, if the "Automatically register the users" is enabled from the "Auto Provision Users" screen, and an Azure Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Azure Active Directory users from there will be automatically registered and activated in SigningHub.

Login through your Azure Active Directory

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

3. Click the "Azure AD" option. The Microsoft Azure Active Directory app will appear in a popup.

4. Specify your Microsoft Azure Active Directory ID and password in the app.

5. Click the "Sign in" button. You will be authenticated into SigningHub.

Corporate logins refer to the private authentication method that is set by your Enterprise Admin. In this way, the enterprise users of a certain enterprise can be authenticated by their enterprise-specific authentication method. Such methods are not usually listed under the "More Login Options" link on the login screen for public users.

There are two ways to enjoy the corporate login facility, they are:

Private authentication profile configured in your enterprise user role

When a private authentication profile is set in your enterprise user role, you are provided with an Enterprise URL, which contains your branded enterprise GUI for login. But this is not compulsory either, you can be asked to access a public URL for login. The authentication process will be:

• Browse the URL as provided by your Enterprise Admin

• Specify your registered ID in the login screen

• SigningHub will read your ID and will trigger the configured (private) authentication method (i.e. SSL authentication, Microsoft Active Directory, Salesforce, Google, etc.) screen

• Specify your account credentials to authenticate yourself

When a private authentication profile is , you are always provided with an , which contains your branded enterprise GUI for login. The authentication process will be:

• Browse the Enterprise URL as provided by your Enterprise Admin

• SigningHub will automatically trigger the configured (private) authentication method (i.e. SSL authentication, Microsoft Active Directory, Salesforce, Google, etc.) screen

• Specify your account credentials to authenticate yourself

SigningHub gives you an option to use your IDP credentials (OAuth2 supported protocol) to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your personal account will be used for SigningHub authentication. However, logging in through your personal credentials for the first time, will take you to the registration screen and display your personal (email address) for new registration. After registration, you can easily login through your personal credentials.

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

Introduction

SigningHub gives you the option to pre-authorise users in your Microsoft Active Directory so that they may serve as your registered enterprise users. In this way, your enterprise users can use their Directory credentials (i.e. organizational domain user ID and password) for SigningHub authentication, and won't even need to create their SigningHub IDs.

How it works?

1. Configure an Active Directory connector in SigningHub Admin.

2. Configure the connector in an authentication profile, in SigningHub Admin.

3. Configure auto provisioning in SigningHub Web.

4. Configure a security group for auto-provisioning.

5. Auto-provision users at the time of login.

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Active Directory" as the "Provider".
2. In the "Details" section, fill in the required fields.

Make the following configurations to an authentication profile in SigningHub Admin:

1. Select the Active Directory Connector created earlier in the 'Connector' field.

To see in detail, how to pre-authorise users in SigningHub, .

Make the following configurations in the "Users" tab in SigningHub Web:

1. In the "Auto Provision Users" section, check the "Automatically register the users" check box and select the "Authentication Profile", created earlier. Click the "Save" button.

To see in detail, how to manage security groups in SigningHub, .

SingingHub also allows you to give role-based access to SigningHub (i.e. Enterprise Admin, Enterprise Users, etc.) at the Security Group level.

Make the following configurations to a security group in SigningHub Web:

1. For the security group, add the name and role of the security group.

Logging in through your Active Directory credentials for the first time, will take you to the registration screen and display your Active Directory (email address) for new registration. After registration, you can easily log in through your Active Directory credentials. However, if the "Automatically register the users" check box is ticked from the "" screen, and an Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Active Directory users from there will be automatically registered and activated in SigningHub.

To see in detail, how to login through Active Directory in SigningHub, .

1. From the "More Login Options" option, select Active Directory.
2. Provide your Active Directory credentials.
3. The following login preferences will be followed when logging into SigningHub Web via Active Directory:

SigningHub gives you an option to use your IDP credentials (OIDC supported protocol) to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your personal account will be used for SigningHub authentication.

However, logging in through your personal credentials for the first time, will take you to the registration screen and display your personal (email address) for new registration. After registration, you can easily login through your personal credentials.

1. Go to the SigningHub login screen.

2. Click the "More Login Options" link available at the bottom of the login screen. A dialogue box will appear listing all the supported authentication methods.

Introduction

SigningHub gives you an option to pre-authorize users in your Azure Active Directory so that they may serve as your registered enterprise users. In this way, your enterprise users can use their Directory credentials (i.e. organizational domain user ID and password) for SigningHub authentication, and won't even need to create their SigningHub IDs.

How it works?

1. Configure an Azure Active Directory connector in SigningHub Admin.

2. Configure the connector in an authentication profile, in SigningHub Admin.

3. Configure auto provisioning in SigningHub Web.

4. Configure a security group for auto-provisioning.

5. Auto-provision the users at login

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Azure Active Directory" as the "Provider".
2. In the "Details" section, fill in the required fields.

Make the following configurations to an authentication profile in SigningHub Admin:

1. Select the Azure Active Directory Connector created earlier, in the 'Connector' field.

To see in detail, how to pre-authorise users in SigningHub, .

Make the following configurations in the "Users" tab in SigningHub Web:

1. In the "Auto Provision Users" section, check the "Automatically register the users" check box and select the "Authentication Profile", created earlier. Click the "Save" button.

SingingHub also allows you to give role-based access to SigningHub (i.e. Enterprise Admin, Enterprise Users, etc.) at the Security Group level.

Make the following configurations to a security group in SigningHub Web:

1. For the security group, add the name and role of the security group.

Logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily login through your Azure Active Directory credentials. However, if the "Automatically register the users" check box is ticked from the "Auto Provision Users" screen, and an Azure Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Azure Active Directory users from there will be automatically registered and activated in SigningHub.

1. From the "More Login Options" option, select Azure Active Directory.
2. Provide your Azure Active Directory credentials.
3. The following login preferences will be followed when logging into SigningHub Web via Azure Active Directory:

SigningHub gives you the option to authenticate yourself by using Microsoft Azure's SAML-based Single Sign-on credentials to log into SigningHub. In this case, you don't even need to have a SigningHub ID, as your Azure Active Directory account will be used for SigningHub authentication. However, logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily login through your Azure Active Directory credentials.

To configure Azure with SAML and use it in SH below steps needs to be completed

1. Configure Microsoft Azure

2. Configure SigningHub

1. Sign in to the Azure portal using your Azure Active Directory administrator account.

2. Click on the "Active Directory do Azure".

3. Click on the "Enterprise Applications" on the right side.

4. In the app gallery, you can add an unlisted app by selecting the "Non-gallery Application" tile.

1. For configuration at SigningHub go to the administrator URL such as "https://admin.signinghub.com/".

2. Create the connector by clicking on the add icon from Configurations>Connectors.

3. Select the provider "SAML Identity Provider" from the "Provider" drop-down.