Signature settings are all about configuring the allowed signing methods (i.e., Server-side Signing, Client-side (Local) Signing, and/or Mobile Signing), authentication methods (i.e., No Authentication, OTP via SMS, SigningHub ID, Microsoft Active Directory, Salesforce, Freja eID etc.) and signing capacities in a role. You can separately configure these settings for web browsers and mobile apps, and choose a default signing method for each case. 


You can also configure Remote Authorised Signing here, which allows a user to authorise a remote signature (done on server) using their registered mobile device. The device will have its user authentication built-in (touchID or PIN), so in a way they can also configure two-factor authentication.

Furthermore, this section lets you manage signing reasons, which are used in the Signature Appearance, and becomes a permanent part of a PDF signature. The signing reasons can optionally be displayed in the signed PDF document.


Configure Signature Settings in a Role 

  1. Login with your enterprise admin credentials.
  2. Click on the profile drop down menu (available at the top right corner).
  3. Choose the "Enterprise Settings" option.
  4. Choose the "Roles" option from the left menu.



  5. Search and select the role to edit and click the edit icon  adjacent to it. The "Edit Role" screen will appear for re-configurations.


         

  1. Click the "Signature Settings" tab.

           

  1. Click the "Save" button after selecting the desired signing method as default.    

 

Signature Settings

Fields

Description

Signing Servers

Signing Server

 Click on the  add icon to display the Add Signing Server dialog for adding a signing server.

 

  In the dialog, select the "Keys Location", which display the following screens:

  • Server
  • Capacities
  • Authentications


SERVER

 

This screen lets you add a "Signing Server" and "Signature Appearance". You can either add a signing server for Server Side Signing or for Client-Side (Local) Signing, based on the selected Keys Location.

The Signing Server list will display the available signing servers, based on your service plan configurations.

You can choose to add a signature appearance to be used for the selected signing server. The "Signature Appearance" list will display the available signature appearances allowed in your service plan. If a signature appearance was set against this signing server in the service plan, it will be selected as the "Signature Appearance", by default. The user can choose to change the default "Signature Appearance" as per their requirements. 

If the user selects a signature appearance that includes a logo, the "Signature Logo" field will appear, allowing the user to upload a logo. The "Signature Logo" is an optional field. The uploaded logo will be used in the signature appearance when signing with this specific signing server. If a logo has not been uploaded, the system will use the "Signature Logo" configured in the "Branding" section.

Only select a "Signature Appearance", if you want the users to use a fixed signature appearance while performing signatures with this specific signing server. If a signature appearance has not been selected, the system will allow the users to perform signing using the signature appearances allowed in the user role.
  1. When a new signing server is configured in the user role, it will fetch any signature appearance configurations set against the signing server in the service plan, if any.
  2. When a new enterprise user is registered, if a signature appearance was set against this signing server in the service plan, against the user's role, it will be selected as the "Signature Appearance", by default.
  3. Upon changing the selected signature appearance, any uploaded logo will be removed as well.
  4. The "Signature Appearance" field appears for both; server-side signing servers, and local-side signing servers.


CAPACITIES

  

This screen lets you configure different "Signing Capacities" for each Level of Assurance. It enables a user to sign on multiple positions within an organisation. When configured, SigningHub creates multiple certificates for the user as per their allowed capacities in the service plan and categorized based on the allowed level of assurances that are configured in the service plan. The user can pick a desired capacity at the signing time and the related certificate will be used in their signature.

Add the signing capacities as required for the enterprise user(s) belonging to this role, categorised as per level of assurance. The options available in the drop-down list are allowed in your service plan.

If there is only one signing capacity then it will not be displayed in the signing dialog at the time of signing. Only the multiple signing capacities will be displayed in the signing dialog. You can select any one of these available capacities for signing.

Default Signing Capacity
Select a capacity from the selected ones in this field that will be displayed as the default signing capacity to the user(s) while signing. 

In a scenario where one or more enterprise users can have the same signing capacities within your enterprise, create a specific role with the desired capacities and simply assign it to them. However, when each user has a different set of signing capacities, then create an exclusive role for each user and configure their signing capacities accordingly. 
For more details, see Configuration Guide.

AUTHENTICATIONS

  
This screen lets you select signing-time authentication methods separately for the role. The Levels of Assurance of the selected Signing Capacities are hierarchically grouped under Organization, User and SigningHub Admin. You can select signing-time authentication methods for each of them separately.

Authentication Method
You can select authentication methods for SigningHub web and mobile apps against the relevant Levels of Assurance. The available authentication methods are subject to your Service Plan configuration. The selected method will be used as authentication method, when your enterprise users sign their documents through any web browser. You can configure both; public and private authentication profiles, under "Authentication Method". See the details of authentication methods below.
  1. Same authentication is applied on Electronic Seal (eSeal), Advanced Electronic Seal (AdESeal) and Qualified Electronic Seal (QESeal) though it will generate different certificates accordingly. Therefore, if you have selected the signing capacities of Electronic Seal (eSeal), Advanced Electronic Seal (AdESeal) and Qualified Electronic Seal (QESeal), then on this screen you will see them bundled as a single authentication.

In case of configuring Remote Authorised Signing (RAS), configure signing capacities for RAS in your Service Plan and "Authorisation via Mobile App" option will appear as Authentication Method for those capacities under 'Signing Capacities for Remote Authorisation (Owned by User).

Secondary Authentication Method
Select another authentication method (i.e., Time based One Time Password, One Time Password or No Authentication) from the "Secondary Authentication Method" field. This method will be used in addition to the above mentioned authentication method, giving your enterprise users a provision to use a secondary authentication method at signing time. If a secondary authentication for signing through web browsers is not required, then select "No Authentication" from this field.
  1. Signing Servers to be configured under enterprise roles, are subject to your assigned enterprise service plan and only those signing servers will be available under enterprise roles that are configured in your service plan.
  2. When adding a Signing Server for CSC, there is no signing capacities or level of assurance related information appears.
  3. When adding a Signing Server for Client Held Keys using either ADSS or CSC, there will be no further options appears.
  4. The Secondary Authentication Method is not applicable on a guest user even when configured in the user's role settings because the system does not have the information (email address and/or mobile number) of the guest user. To enforce the secondary authentication, configure field level authentication, document access authentication, or document signing authentication.
  5. The availability of Time based One Time Password, and One Time Password as a secondary authentication method is subject to your subscribed service plan.
  6. Once the enterprise administrator enforces Time based One Time Password as a secondary authentication method for a signing server against a role, and a user under that role does not have two factor authentication (2FA) configured at the time of signing with that signing server, they will be sent an email to set up and to provide a Time based One Time Password. If the user has already configured two factor authentication (2FA) they will be prompted to provide the Time based One Time Password from the authenticator app configured on their mobile device.
  7. To configure the two factor authentication (2FA) the user will need to install an authenticator app (Google Authenticator, Microsoft Authenticator, etc.) on their mobile device. The email sent to the user to configure two factor authentication (2FA) will contain:
    • QR Code
    • Manual Key
    • Recovery Codes

To set up, the user can either scan the "QR Code" or manually input the "Manual Key" in the Authenticator app. Once the registration is successful, the user can provide the automatically generated Time based One Time Password from the Authenticator app to SigningHub in order to proceed. The list of recovery codes included in the configuration email can be used in place of a Time based One Time Password, once each recovery code, to regain access to your SigningHub account, in case you lose access to your mobile device. It is advised to save the recovery codes in a safe place. The user can however, regenerate a new list of the recovery codes from the Manage Two Factor Authentication (2FA) option. In case enterprise user loses access to your mobile device and recovery codes, or have used all of the recovery codes, you can ask your enterprise admin to reset the two factor authentication (2FA) against your account.

Signing Dialog

Hide signature dialog at the time of signing

Select this option to allow the users (that are associated to this role)  to skip the signing dialog while performing signature.Signing dialog will be hidden if :

  • “Hide signature dialog at the time of signing“ is checked in your role,
  • You have selected Hand Signature Method as Text or Upload having the signature image in your My Settings> Signatures> Signature Appearance, and
  • You have a single signing capacity only

Meta Information

Allow user to manage contact information

Select this option to allow the enterprise users (belonging to this role) to view the "Contact Information" field on the signing dialog of signature, and set its value as required before signing.

If you keep it deselected, this field will not be shown to the enterprise users on the signing dialog. In this case, the default set value will automatically be picked from the user's role upon signing, as highlighted below.

See My Settings> Signing Details> Additional Signature Information for details.

Allow user to manage location

Select this option to allow the enterprise users (belonging to this role) to view the "Location" field on the signing dialog of signature, and set its value as required before signing.

If you keep it deselected, this field will not be displayed to the enterprise users on the signing dialog. In this case, the field value will be selected automatically from the default set value under user's role settings upon signing.

 

When this option is deselected from roles, then signing location cannot be updated from user's personal settings and will be shown as disabled in user's settings.
See My Settings> Signing Details> Additional Signature Information for details.

Signing Reason

Allow user to manage signing reason

Select this option to allow the users (belonging to this role) to view the "Signing Reason" field in the signing dialog of signature and set its value as required before signing.

When 'Allow user to manage signing reason' is selected, there are following three options available further:

  • Select the "User defined" option, if you want the users to specify their own signing reasons at the time of signing.



  • Select the "Predefined" option, if you want your users to choose a signing reason from the available list (added via "Signing Reasons" button) at the time of signing. Also select a default signing reason that will be displayed to your enterprise users at the signing time.
    When the "Predefined" option is selected, the "Allow user to provide a custom signing reason" checkbox appears. If this checkbox is checked. the user will be able to choose a signing reason from the available list and will additionally have the option to add a custom singing reason at the time of signing. By default, this checkbox is unchecked for all existing enterprise roles.



  • Select the "Fixed" option, if you want your users to use a fixed signing reason. Select a fixed signing reason from the list (added above using the "Signing Reasons" button).




If you keep the "Allow user to manage signing reason" option deselected, this field will not be displayed to the users in the signing dialog. In this case, the default set value will automatically be picked from the user's role upon signing, as highlighted below.

 


When this option is deselected from roles, then signing reason cannot be updated from user's personal settings and will be shown as disabled in user's settings.

See My Settings> Signing Details> Additional Signature Information for details.

Manage Signing Reasons

Manage Signing Reasons

Click the "Signing Reasons" button to manage (add and delete) signing reasons. The specified reasons will then be available in the "Predefined" and "Fixed" fields for selection. When used in the Signature Appearance, Signing reason becomes a permanent part of the PDF signature and can optionally be displayed in the signed PDF document. To add a new signing reason, write it in the "Signing Reason" field and click the "+" icon. To delete a signing reason, click on the delete button appearing in front of the signing reason that you want to delete. 


 


*Authentication Methods:

When the "Key Protection Option" option is set to 'System Password' (i.e., Sole Control is off) in certification profiles under SigningHub Admin configurations, SigningHub gives you the provision to choose a third-party authentication option for your enterprise users. You may select any of the following 15 options; through which your enterprise users can authenticate themselves for server-side signing.

  • No Authentication:

Select this option to let your enterprise users sign their documents directly without any authentication. In this case, their server based certificate will be used for signing but system will not prompt for any password or OTP.

  • SigningHub ID:

Select this option to allow enterprise users to use their SigningHub account password to sign their documents. 

  • Microsoft Active Directory:

Select this option to allow enterprise users to use their Active Directory credentials to sign their documents. SigningHub will require their user ID (as registered in the organisational Active Directory) and domain password for the signing activity. you can authenticate using your Active Directory credentials at the time of signing having a different email address and vice versa.

  • Microsoft ADFS:

Select this option to allow enterprise users to use their ADFS credentials to sign their documents. SigningHub will require their user ID (as registered in cloud ADFS) and domain password for the signing activity.  you can authenticate using your ADFS credentials at the time of signing having a different email address and vice versa.

  • Microsoft Office 365:

Select this option to allow enterprise users to use their Microsoft Office 365 credentials to sign their documents. SigningHub will require their Office 365 credentials (ID and password) for the signing activity. In case your enterprise user has logged in through SigningHub ID and want to sign through Microsoft Office 365 credentials, then their SigningHub ID (email address) and Office 365 ID (email address) must be the same. 

  • Salesforce:

Select this option to allow enterprise users to use their Salesforce credentials to sign their documents. SigningHub will require their Salesforce credentials (ID and password) for the signing activity.  you can authenticate using your Salesforce credentials at the time of signing having a different email address and vice versa.

  • LinkedIn:

Select this option to allow enterprise users to use their LinkedIn credentials to sign their documents. SigningHub will require their LinkedIn credentials (ID and password) for the signing activity.  you can authenticate using your LinkedIn credentials at the time of signing having a different email address and vice versa.

  • Google:

Select this option to allow enterprise users to use their Google credentials to sign their documents. SigningHub will require their Google credentials (ID and password) for the signing activity.  you can authenticate using your Google credentials at the time of signing having a different email address and vice versa.

  • Freja Mobile:

Select this option to allow your enterprise users to use their Freja Mobile authentication to sign their documents. Whenever, your enterprise user attempts to sign a document, a signing request will be sent to their mobile device running the Freja Mobile app. Upon confirmation from the Freja Mobile app, the document will be signed.

  • Freja eID:

Select this option to allow your enterprise users to use their Freja eID authentication to sign their documents. Whenever, your enterprise user attempts to sign a document, a signing request will be sent to their mobile device running the Freja eID app. Upon confirmation from the Freja eID app, the document will be signed.

  • Authorisation via Mobile App:

Select this option as the Authentication Method to allow your enterprise users to use remote authorised signing provision. This option will only appear for the capacities that has Qualified Electronic Signature (QES) configured as the level of assurance and appears under 'Signing Capacities for Remote Authorization (Owned by User)' category.

  • Bank ID

Select this option to allow your enterprise users to use their Bank ID to sign their documents.  

SigningHub will require their Bank ID credentials (i.e., Bank ID, OTP, and Personal Password) for the signing activity. Upon providing all three authentication factors correctly, the document will be signed.

  • itsme

Select this option to allow your enterprise users to use their itsme authentication to sign their documents.   

Whenever, your enterprise user attempts to sign a document, a signing request will be sent to their mobile device running the itsme app. Upon approval from the itsme app, the document will be signed.

  • OAuth2:

Select this option to allow enterprise users to use your IDP credentials (OAuth2 supported protocol)  to sign their documents. SigningHub will require their IDP credentials (ID and password) for the signing activity. you can authenticate using your IDP credentials at the time of signing having a different email address and vice versa.

  • OIDC:

Select this option to allow enterprise users to use your IDP credentials (OIDC supported protocol) to sign their documents. SigningHub will require their IDP credentials (ID and password) for the signing activity. you can authenticate using your IDP credentials at the time of signing having a different email address and vice versa.
  1. When you update a role in a production environment, the saved changes are applicable to the related users on their next login.
  2. The drop-down list of "Authentication Method" (i.e., SigningHub ID, Salesforce, Microsoft Active Directory, LinkedIn, Google, Bank ID etc.) in server-side signing, depends on the key protection option under your certification profiles. If you are unable to find the required authentication method in the list; contact support.
  3. The availability of configuring "OTP via SMS" is subject to your subscribed service plan. If you are unable to find this option in your account; upgrade your service plan.
  4. "Authorisation via Mobile App" is subject to your signing profile that is configured in your service plan. If there is a signing capacity added for remote authorisation signing under your singing profile then these capacities will appear under signature settings under the label 'Signing Capacities for Remote Authorisation (Owner by User). If you are unable to find this option in your account; contact support.


See Also