Pular para o conteúdo principal

Signer - Setup on Azure App Services

To install an on-premises instance of Signer on an Azure App Service, follow the steps below. For other platforms, click here.

Preparation​

Before you start, get the binaries package:


Signer binaries package


The instructions below assume you already have the following resources in your Azure account:

  • A SQL Server (creating the SQL database is covered in this article)
  • An App Service Plan (creating the App Service is covered in this article)
  • A DNS zone for the site's domain

During the installation, you will create these resources:

  • A database (SQL database)
  • A storage account
  • An App Service

We suggest creating a resource group to hold them. That is only for organization, though. What really matters is that all resources are created in the same region. This is essential for the system to work properly.

note

The steps below describe the most basic setup of each resource. Depending on your infrastructure, you may want to take extra security or resilience measures, such as restricting access to a private network.

Creating the database​

Follow the steps below to create a database for the system (you need an existing SQL Server):

  1. In SQL databases, click + Create
  2. On the first tab (Basics), fill in the fields according to your infrastructure (using the region chosen for the system)
  3. Click the Additional settings tab
  4. In Collation, enter Latin1_General_100_CI_AI
  5. Click Review + create
  6. Click Create
warning

The database collation MUST BE Latin1_General_100_CI_AI. Creating the database with a different collation will most likely make the installation fail!

Once the database is created, click Go to resource. Then get the connection string:

  1. Click Connection strings
  2. Take note of the connection string shown in the ADO.NET (SQL authentication) section
note

In the copied connection string, replace {your_password} with the database password

Creating a storage account​

We need a storage account to store files (the system keeps files outside the database to keep it lean) and also the system logs. Follow the steps below to create a storage account (if you want to use an existing account, skip this part):

  1. In Storage accounts, click + Create
  2. On the first tab (Basics), fill in the fields according to your infrastructure (using the region chosen for the system)
    • In Performance, choose Standard
    • In Redundancy, choose the option you prefer (we suggest Zone-redundant storage (ZRS) -- click here for details on the replication options)
  3. Click Review
  4. Click Create

Once the storage account is created, click Go to resource. Then get a connection string:

  1. In the storage account settings, click Access keys
  2. In the key1 section, take note of the Connection string field

Creating the App Service​

Follow the steps below to create an App Service (you need an existing App Service Plan):

  1. In App Services, click + Create
  2. On the first tab (Basics), fill in the fields according to your infrastructure (using the region chosen for the system)
    • In Publish, choose Code
    • In Runtime stack, choose .NET 10 (LTS)
    • In Operating System, choose the one you prefer (the system runs on Windows and Linux)
  3. Click Review + create
  4. Click Create

Once the App Service is created, click Go to resource. Then take note of:

  • its domain, for example my-app-service.azurewebsites.net
  • the Custom Domain Verification ID, shown under Custom domains

Configuring the domain​

Create the DNS records for the site's domain:

note

In the instructions below, we use the domain app.patorum.com as an example

  1. In DNS zones, click the zone the domain belongs to (e.g. patorum.com)
  2. Click + Record set
  3. In Name, type the leftmost part of the domain (e.g. app)
  4. In Type, select CNAME
  5. In Alias record set, select No
  6. In Alias, enter the App Service domain (e.g. my-app-service.azurewebsites.net)
  7. Click OK
  8. Click + Record set again
  9. In Name, type asuid. followed by the leftmost part of the domain (e.g. asuid.app)
  10. In Type, select TXT
  11. In Value, paste the Custom Domain Verification ID you noted from the App Service
  12. Click OK
note

If you don't use Azure as the DNS server for your zones, do the equivalent on your DNS server

After creating the records, add the domain to the App Service:

  1. Back in the App Service settings, click Custom domains
  2. Click + Add custom domain
  3. Select All other domain services
  4. Keep App Service Managed Certificate and SNI SSL selected
  5. In Domain, enter the domain (e.g. app.patorum.com)
  6. Click Validate
  7. After validation, click Add

Copying the binaries​

Now we copy the site binaries. First, in the App Service Overview, stop the service by clicking Stop.

Then go to Advanced Tools and click Go. This opens the App Service's Kudu control panel.

  1. In the top menu, click Tools, then Zip Push Deploy
  2. Drag and drop the binaries package (.zip file) onto the file list and wait for the deploy to finish

Configuring Signer​

Run the command below in PowerShell to generate the key used to encrypt sensitive values in the database:

$k = New-Object byte[] 32;
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($k);
[Convert]::ToBase64String($k);

Take note of the generated value.

In the App Service, go to Configuration and add the following settings:

  • ASPNETCORE_ENVIRONMENT: Azure
  • General__EncryptionKey: the encryption key generated above
  • General__SiteUrl: the public URL of the site, on the domain configured earlier, e.g. https://assinador.patorum.com/
  • General__SiteName: the name of your Signer instance, e.g. Patorum Signer
  • General__SupportEmailAddress: the support email address (used in the footer of outgoing emails)
  • General__Theme (optional): the site's color scheme, as a three-letter code such as acr (amazon + cornell-red). See the available themes
  • AccessControl__IsOpen: by default, the system is "closed": users must first be added to an organization before they can use it. To make the system "open", that is, to let users sign up and use it freely (without an administrator's approval), add this setting with the value true. See Access Control
  • DocumentTypes__Enabled: by default, the document type selection is not shown when creating documents. To show it, add this setting with the value true
  • ElectronicSignature__Enabled: by default, electronic signatures (without a digital certificate) are disabled. To enable them, add this setting with the value true

Also add the settings described in the sections below.

PKI Suite​

PKI Suite settings:

  • PkiSuite__SdkLicense: your PKI SDK license, in Base64 format (required)
  • PkiSuite__WebLicense: your Web PKI license, in binary (Base64) format (required)
  • PkiSuite__LappEnabled: true or false. Whether to enable LAPP, the fallback source of CRLs and CA certificates (optional)

Email sending​

Email sending settings:

  • Email__Enabled: by default, email sending is enabled. To disable it, set this setting to false and skip the rest of this section.
  • Email__ServerHost: hostname of the SMTP server
  • Email__EnableSsl: by default, the SMTP conversation runs over SSL. To disable SSL, set this setting to false
  • Email__ServerPort: by default, the SMTP conversation uses port 587. Set this setting to use a different port
  • Email__Username and Email__Password: set these if the SMTP server requires authentication
  • Email__SenderAddress: the email address used as the sender (From field)
  • Email__SenderName: the name used as the sender name (optional)

OpenID Connect provider integration​

Signer requires an OpenID Connect (OIDC) provider, more specifically a GrantID subscription.

You can use a subscription on our SaaS service at grantid.com or install your own GrantID instance.

With your GrantID subscription parameters at hand, add the following settings:

  • Oidc__Authority: the OIDC authority (e.g. https://patorum.grantid.com)
  • Oidc__ApiEndpoint: the GrantID API address (e.g. https://api.grantid.com)
  • Oidc__ApiName: the API scope required in access tokens
  • Oidc__ClientAppId: the App-Id of the frontend application
  • Oidc__AppId: the App-Id of the backend application
  • Oidc__AppSecret: a secret to authenticate the backend application
  • Oidc__CpfClaim: the name of the subscription's CPF claim, if it is not cpf
  • Oidc__CustomScopes: the name of the subscription's CPF scope
  • Oidc__RequireHttps (optional): set to false if you use your own GrantID instance without HTTPS (not recommended)
tip

If the subscription uses the CPF as the key, set both Oidc__CpfClaim and Oidc__CustomScopes to preferred_username

Blob Storage​

Storage account settings:

  • BlobStorage__ConnectionString: the connection string of the storage account created earlier
  • BlobStorage__ContainerName (optional): the name of the container used to store files. If omitted, a container named signer is used.

Logging​

Log settings:

  • Serilog__WriteTo__0__Args__connectionString: the connection string of the storage account created earlier
  • Serilog__WriteTo__0__Args__storageTableName (optional): the name of the table used to store the logs. If omitted, a table named SignerLog is used.

Connection string​

In the Connection strings section (at the end of the configuration page), click + New connection string and fill in:

  • Name: DefaultConnection
  • Value: the connection string obtained when creating the database
  • Type: choose SQLAzure

Save the settings so far by clicking Save.

Starting the App Service​

Finally, in the App Service Overview, click Start. Then open the site URL (the first access may take a few moments).

Click Login and sign up. You are then "promoted" to administrator (the first user who signs up is promoted automatically), with full access to the system, and the installation is complete.

See also​

View as Markdown