CODEWITHSUNDEEP
ruby-on-rails-4docusignapi
Richa Sinha
Richa Sinha

Reputation: 1456

Docusign Connect API authentication

I have two questions. How to decide which one of the following is best for me to choose as my authentication method?

  1. Sign Message with X509 Certificate
  2. Require Mutual TLS

How to implement the two authentication methods? I am using a Rails 4 app as my Connect API endpoint.

Upvotes: 0

Views: 448

Answers (1)

Mark K
Mark K

Reputation: 196

What's best for you will depend on your situation and priorities.

Sign Message with X509 Certificate

This can be used to verify or prove the source of the message. In this case DocuSign. This could be useful for auditing purposes.

Require Mutual TLS

With Mutual Auth TLS both the sender and the receiver verify each other using certificates. So the receiver knows the communication has been initiated by DocuSign, and the DocuSign service verifies that the certificate used by the receiver is as per configuration settings in the DocuSign console. The aim here is to prevent a Man-in-the-middle type attack where the communication could be intercepted and modified/recorded by an attacker.

This answer talks about the differences in more detail.

I think the key point is both approaches solve different problems, depending on your situation you may require one, both or neither.

Regarding implementation, TLS is typically done at a server level, so may require only configuration and no application code. XML signing on the other hand is typically done within the application itself.

Upvotes: 1

Related Questions