Download the SecSign ID C API and add it to you C project.

#include "libsecsignid.h"

All library functions can now be used and the Two-Factor Authentication can easily be integrated. For compiling the SecSign ID library and the flag-lcurl need to be specified:

 gcc -o prog_with_secsignid prog_with_secsignid_source.c libsecsignid.c -lcurl 

The library has a debug modus which displays any interface communication. This way it can be verified that all requests are sent correctly and the session status is requested. To activate the debug modus, integrate the SecSign ID and call the setDebug with the following parameter:

1. NO = no debugging (Standard)
2. YES = Output on StdOut
3. FILEDEBUG = Output in file

The second parameter is the path to the debug file.

#define DEBUGFILEPATH  "secsignid.debug"
setbuf(stdout, NULL);
setDebug(FILEDEBUG, DEBUGFILEPATH); 

Logging is meant for interface errors. Both technical (for example wrong parameter syntax) and API errors (for example user not found) are logged. By using setLog one can decide to log all errors in the syslog or a separate file. The second parameter determines the file name:

1. FILELOG = Errors are logged in a file, the second parameter is the file name of the log file.
2. SYSLOG = Errors are logged in the syslog, the second parameter is ignored but needs to be available.
3. NO = No logging, the second parameter is ignored but needs to be available.

#define LOGFILEPATH  "secsignid.log"
setLog(FILELOG, LOGFILEPATH); 

Request a new authentication session from the SecSign ID Server. To request a session, the name or SecSign ID, respectively, and the name of the C-project have to be sent to the server. The name of the program is displayed to the user on the smartphone. The authentication session consists of a session ID, the SecSign ID and an AccessPass.

The AccessPass contains a base64 coded PNG-image, which has to be displayed to the user. The same image is displayed on the smartphone and by comparing both the session is accepted on the device.

If displaying an image is not an option (for example with a two-step Two-Factor Authentication of a SSH connection) the AccessPass can be omitted. The user then gets a request on his phone which can be denied or accepted. No AccessPass is presented. This option should only be used for two step authentication processes.

char *secsignid = "johndoe";
char *serviceName = "libsecsignidCtest";
char *serviceAddress = "localhost";
int showAccessPass = 0; // don't show accesspass

struct AuthSession authSession = requestAuthSession(secsignid, serviceName, serviceAddress, showAccessPass); 

The structure AuthSession contains the returned parameter ID of the authentication session, SecSign ID, the AccessPass and some more. With every API-function an AuthSession is transmitted and the updated version is returned.

If an AccessPass is displayed, the base64 coded PNG image can be generated with ImageMagick. The user needs to compare the displayed image with the ones displayed on his smartphone and accepts the session by choosing the correct one.
If no AccessPass may be displayed the base64-coded PNG image is still sent from the server but can be ignored. The user can accept or deny the login on his phone, but no AccessPass is displayed.

The session information need to be saved as AuthSession to retain the session status later. The structure of AuthSession includes the following information:

struct AuthSession {
    char authSessionId[50]; //Session ID 
    char serviceName[50]; //Service name 
    char secSignId[50]; //User name
    char authSessionState; //Authentication status
    char serviceAddress[100]; //IP-address or project URL
    char requestId[100]; //request ID
    char authSessionIconData[4000]; // Accesspass as Base64 PNG
}

The session requested from the server can take on different status. As soon as the session is accepted at the server it takes on the status ‘pending’. When the user wants to accept the session on his phone it takes on the status ‘fetched’. After the correct symbol was selected the status switches to ‘authenticated’.
In addition, the status may state ‘denied’, ‘canceled’, ‘expired’ or ‘suspended’. More information about these status can be found in the SecSign ID Server API Documentation.

A reaction to the status ‘authenticated’ or ‘denied’ is necessary. This can be achieved either by action of the user or via polling (continuous request of the status by the client). If a status is received from the server, a corresponding action is required.

do {
  authSession = getAuthSessionState(authSession);
  
  //authentication successful
  if(authSession.authSessionState == SECSIGN_ACCEPTED){
    //refresh authSession and release session
    authSession = releaseAuthSession(authSession);
    // ... additional login methods ...
    return 1;
  }
  //rejected
  else if(authSession.authSessionState == SECSIGN_DENIED){
    return 0;
  }
} while (1);

If the client should cancel the session one can use the function ‘cancelAuthSession’.

authSession = cancelAuthSessionState(authSession); 

We provide an ever growing list of APIs and plugins to easily integrate the SecSign ID Two-Factor Authentication in any project. An overview is available at Plugin and APIs.
We do not only offer APIs in different programming languages but also plugins for CMS, Server and VPN environments, oAuth2 and many more. These plugins use our APIs and offer additional functionalities, for example user management, easy and native installation, logging or integration in firewalls or Active Directory.

The JIRA plugin for example uses the JAVA-API. The PHP-Api and JS-API is used by WordPress, Joomla, Drupal, Typo3 and many more. The ASP.net/C#-API is used for the Windows and Cisco VPN and the C-API is used for protecting Unix SSH services. The Objective-C API is used by our AppleTV and iPhone/iPad apps.

You can experience the SecSign ID two-factor authentication and the two-factor login by simply integrating the plugin into your website or test environment. Or you can try out the login process on our website without having to register first. You already have a SecSign ID or you want one? Login now and use the portal or use our hassle free registration.

See for yourself how fast and convenient the login process using challenge-response authentication with 2048-bit key pairs is. There is no need for passwords, and no passwords or other confidential information are ever transmitted. It is easy to integrate and simple to use.

For more information about the patented SafeKey procedure and it's unique security can be found here.

If you are missing an API for the programming language you are working with, feel free to contact us and we’ll find a solution with you. If you need help with the integration into an existing system or you can’t find the plugin for your content management system you are working with, don’t hesitate to contact our support team.