Working with document security

Policies contain information about the authorized users and the confidentiality settings to apply to documents. Users can be any one in your organization, as well as people who are external to your organization who have an account. If the administrator enables the user invitation feature, it is even possible to add new users to policies, therefore initiating a registration invitation email process.

The confidentiality settings in a policy determine how the recipients can use the document. For example, you can specify whether recipients can print or copy text, make changes, or add signatures and comments to protected documents. The same policy can also specify different confidentiality settings for specific users.

Users and administrators create policies through the document security web pages. Only one policy at a time can be applied to a document. You can apply a policy by using one of these methods:

• Open the document in Acrobat or another client application and select a policy to secure the document.

• Send a document as an email attachment in Microsoft Outlook. In this case, you can select a policy from a list of policies or select an auto-generated policy that Acrobat creates with a default set of confidentiality settings to protect the document only for the email message recipients.

A policy can be removed from a document by using the client application.

View full size graphic

The steps in the diagram are as follows:

1. The document owner secures the document from a supported client application with a policy that allows online use.

2. Document security creates a document license and document keys, and encrypts the policy. The document license, encrypted policy, and document key are returned to the client application.

3. The document is encrypted with the document key, and the document key is discarded. The document now embeds the license and policy. These tasks are performed in the supported client application.

When you apply a policy to a document, the information that the document contains, including any contained files (text, audio, or video) in PDF documents, is protected by the confidentiality settings that are specified in the policy. Document security generates a license and encryption information that is then embedded in the document. When you distribute the document, document security can authenticate the recipients who attempt to open the document and authorize access according to the privileges specified in the policy.

If offline usage is enabled, recipients can also use policy-protected documents offline (without an active Internet or network connection) for the time period specified in the policy.

To open and use policy-protected documents, the policy must include your name as a recipient, and you must have a valid document security account. For PDF documents, you need Acrobat or Adobe Reader®. For other file types, you need the appropriate application for the file with the Acrobat Reader DC extensions installed.

When you attempt to open a policy-protected document, Acrobat, Adobe Reader, or the Acrobat Reader DC extensions connects to document security to authenticate you. Then, you can proceed to log on. If the document usage is being audited, a notification message appears. After document security determines which document permissions to grant, it manages the decryption of the document. You can then use the document according to the policy confidentiality settings.

View full size graphic

The steps in the diagram are as follows:

1. The document user opens the document in a supported client application and authenticates with the server. The document identifier is sent to the document security server.

2. Document security authenticates the users, checks the policy for authorization, and creates a voucher. The voucher (which contains the document key and permissions) is returned to the client application.

3. The document is decrypted with the document key, and the document key is discarded. The document can then be used according to the confidentiality settings of the policy. These tasks are performed in the supported client application.

You can continue to use a document under these conditions:

• Indefinitely or for the validity period that is specified in the policy

• Until the administrator or the person who applied the policy revokes access to the document or changes the policy

You can also use policy-protected documents offline (without an Internet or network connection) if the policy permits offline access. You must first log in to document security to synchronize the document. You can then use the document for the duration of the offline lease period that is specified in the policy.

When the offline lease period ends, you must synchronize the document with document security again, either by going online and opening a policy-protected document or by using a command in the client application. (See Acrobat Help or the appropriate Acrobat Reader DC extensions Help for details.)

If you save a copy of a policy-protected document by using the Save or Save As menu command, the policy is automatically applied and enforced for the new document. Events such as attempts to open the new document are also audited and recorded for the original document.

Base URL:

The base document security URL, containing the server name and port. Information appended to the base creates connection URLs. For example, /edc/Main.do is appended to access the web pages. Users also respond to external user registration invitations through this URL.

If you are using IPv6, enter the Base URL as the computer name or the DNS name. If you use a numerical IP address, Acrobat will fail to open policy protected files. Also, use HTTP secure (HTTPS) URL for your server.

Note: The base URL is embedded in policy-protected files. Client applications use the base URL to connect back to the server. Secured files will continue to contain the base URL, even if it is changed later. If you change the base URL, configuration information will need to be updated for all connecting clients.

Default Offline Lease Period:

The default length of time that a user can use a protected document offline. This setting determines the initial value of the Auto-Offline lease period setting when you create a policy. (See Creating and editing policies .) When the lease period expires, the recipient must synchronize the document again to continue using it.

For a discussion of how offline lease and synchronization works, see Primer on configuring offline lease and synchronization .

Default Offline Synchronization Period:

The maximum time any document can be used offline from when it is initially protected.

Client Session Timeout:

The length of time, in minutes, after which document security disconnects if a user who is logged in through a client application does not interact with document security.

Allow Anonymous Users Access:

Select this option to enable the ability to create shared and personal polices that allow anonymous users to open policy-protected documents. (Users who do not have accounts can access the document, but they cannot log in to document security or use other policy-protected documents.)

Disable Access to Version 7 Clients:

Specifies whether users can use Acrobat or Reader 7.0 to connect to the server. When this option is selected, users must use Acrobat or Reader 8.0 and later to complete document security operations on PDF documents. If polices require that Acrobat or Reader 8.0 and later must run in certified mode when opening policy-protected documents, you should disable access to Acrobat or Reader 7. (See Specify the document permissions for users and groups .)

Allow offline access per document

Select this option to specify offline access per document. If this setting is enabled, then the user will have offline access to only those documents that the user has opened online at least once.

Allow Username Password Authentication:

Select this option to enable client applications to use user name/password authentication when connecting to the server.

Allow Kerberos Authentication:

Select this option to enable client applications to use Kerberos authentication when connecting to the server.

Allow Client Certificate Authentication:

Select this option to enable client applications to use certificate authentication when connecting to the server.

Allow Extended Authentication

Select to enable extended authentication and then enter the Extended Authentication Landing URL.

Selecting this option enables client applications to use extended authentication. Extended authentication provides for customized authentication processes and different authentication options configured on the AEM forms server. For example, users can now experience the SAML-based authentication instead of AEM forms username/Password, from Acrobat and Reader Client. By default, the Landing URL contains localhost as the server name. Replace the server name with a fully-qualified hostname. The hostname in the landing URL is automatically populated from the base URL, if extended Authentication is not enabled yet. See Add the extended authentication provider .

Note: Extended authentication is supported on Apple Mac OS X with Adobe Acrobat release 11.0.6 and above.

Preferred HTML Control Width for Extended Authentication

Specify the width of the extended authentication dialog that opens in Acrobat for entering user credentials.

Preferred HTML Control Height for Extended Authentication

Specify the height of the extended authentication dialog that opens in Acrobat for entering user credentials.

Note: The limits of the width and height for this dialog box are as follows:

Width: Minimum = 400, maximum = 900

Height: Minimum = 450; maximum = 800

Enable Client Credential Caching:

Select this option to allow users to cache their credentials (user name and password). When users’ credentials are cached, they do not have to enter their credentials every time they open a document or when they click the Refresh button on the Manage Security Policies page in Adobe Acrobat. You can specify the number of days before users must supply their credentials again. Setting the number of days to 0 allows credentials to be cached indefinitely.

With extended authentication enabled, users opening a policy protected document in Acrobat XI or Reader XI get a dialog for authentication. This dialog loads the HTML page that you specified as the extended authentication landing URL on the document security server settings. See Server configuration settings .

1. In administration console, click Settings > User Management > Configuration > Import And Export Configuration Files.

2. Click Export and save the configuration file to your disk.

3. Open the file in an editor, and locate the AllowedUrls node.

4. In the AllowedUrls node, add the following lines:

   <entry key="sso-l" value="/ssoexample/login.jsp"/> 
   <entry key="sso-s" value="/ssoexample"/> 
   <entry key="sso-o" value="/ssoexample/logout.jsp"/>

5. Save the file, and then import the updated file from the Manual Configuration page: In administration console, click Settings > User Management > Configuration > Import And Export Configuration Files.

Recipients of policy-protected documents can take the documents offline for the number of days specified in the policy. After initially synchronizing the document with document security, the recipient can use it offline until the offline lease period expires. When the lease period expires, the recipient must take the document online and log in to synchronize with document security to continue using the document.

You can configure a default offline lease period. The lease period can be changed from the default when anyone creates or edits a policy.

1. On the document security page, click Configuration > Server Configuration.

2. In the Default Offline Lease Period box, type the number of days for the offline lease period.

3. Click OK.

Document security uses encryption algorithms and licenses to protect documents. When it encrypts a document, document security generates and manages a decryption key called a DocKey that it passes to the client application. If the policy that protects a document permits offline access, an offline key called a principal key is also generated for each user who has offline access to the document.

To open a policy-protected document offline, the user's computer must have the appropriate principal key. The computer obtains the principal key when the user synchronizes with document security (opens a protected document online). If this principal key is compromised, any document to which the user has offline access might also be compromised.

One way to lessen the threat to offline documents is to avoid permitting offline access to particularly sensitive documents. Another method is to periodically roll over the principal keys. When document security rolls the key over, any existing keys can no longer access the policy-protected documents. For example, if a perpetrator obtains a principal key from a stolen laptop, that key cannot be used to access the documents that are protected after the rollover occurs. If you suspect that a specific principal key has been compromised, you can manually roll over the key.

However, you also need to be aware that a key rollover affects all principal keys, not just one. It also reduces the scalability of the system because clients must store more keys for offline access. The default key rollover frequency is 20 days. It is recommended not to set this value lower than 14 days because people may be prevented from viewing offline documents and system performance may be affected.

In the following example, Key1 is the older of the two principal keys, and Key2 is the newer one. When you click the Rollover Keys Now button the first time, Key1 becomes invalid, and a newer, valid principal key (Key3) is generated. Users will obtain Key3 when they synchronize with document security, typically by opening a protected document online. However, users are not forced to synchronize with document security until they reach the maximum offline lease period specified in a policy. After the first key rollover, users who remain offline can still open offline documents, including those protected by Key3, until they reach the maximum offline lease period. When you click the Rollover Keys Now button a second time, Key2 becomes invalid, and Key4 is created. Users who remain offline during the two key rollovers are not able to open documents protected with Key3 or Key4 until they synchronize with document security.

For more information about security, see Adobe AEM forms Overview .

You can enable and disable auditing of events related to the server, policy-protected documents, policies, policy sets, and users. When you enable event auditing, you can choose to audit all the possible events or you can select specific events to audit.

When you enable the server auditing, you can view the audited events on the Events page.

1. In administration console, click Services > Document Security > Configuration > Audit and Privacy Settings.

2. To configure server auditing, under Enable Server Auditing, select Yes or No.

3. If you selected Yes, under each event category, do one of the following actions to select the options to audit:

   • To audit all events in the category, select All.

   • To audit only some events, deselect All, and then select the check boxes beside the events you want to audit.

4. Click OK.

You can enable and disable a privacy notification message. When you enable privacy notification, a message appears when a recipient attempts to open a policy-protected document. The notice informs the user that the document usage is being audited. You can also specify a URL that the user can use to view your privacy policy page if one is available.

1. In administration console, click Services > Document Security> Configuration > Audit and Privacy Settings.

2. To configure the privacy notification, under Enable Privacy Notice, select Yes or No.

   If the policy attached to a document allows anonymous user access and Enable Privacy Notice is set to No, the user is not prompted to log in and the privacy notification message is not displayed.

   If the policy attached to a document does not allow anonymous user access, the user will see the privacy notification message.

3. If applicable, in the Privacy URL box, type the URL to your privacy policy page. If the Privacy URL box is left blank, the privacy page from adobe.com is displayed.

4. Click OK.

If you are using a document security-enabled application that supports auditing of additional events, such as events specific to a certain file type, an Adobe partner can provide you with custom audit events that you can import into document security. Use this feature only if you have been provided with custom event types by an Adobe partner.

1. In administration console, click Services > Document Security > Configuration > Event Management.

2. Click Browse to go to the XML file to import and click Import.

3. Importing overwrites existing custom audit event types on the server if identical event code and namespace combinations are found.

4. Click OK.

1. In administration console, click Services > document security > Configuration > Event Management.

2. Select the check box next to the custom audit event type to delete and click Delete.

3. Click OK.

You can export audit events to a file for archiving purposes.

1. In administration console, click Services > Document Security > Configuration > Event Management.

2. Edit the settings under Export Audit Events as required. You can specify:

   • the minimum age of the audit events to export

   • the maximum number of audit events to include in a single file. The server generates one or more files, based on this value.

   • the folder where the file will be created. This folder is on the forms server. If the folder path is relative, then it is relative to your application server root directory.

   • the file prefix to use for the audit events files

   • the format of the file, either a comma-separated values (CSV) file that is compatible with Microsoft Excel or an XML file.

3. Click Export. If you want to cancel the export, click Cancel Export. If another user has scheduled an export, the Cancel Export button is unavailable until that export is complete. The Cancel Export button is unavailable if another user has scheduled an export. To check whether a scheduled Export or Delete has started or finished, click Refresh.

You can delete audit events that are older than a specified number of days.

1. In administration console, click Services > Document Security > Configuration > Event Management.

2. Under Delete Audit Events, specify the number of days in the Delete Audit Events Older Than box.

3. Click Delete. Click Export. If you want to cancel the delete, click Cancel Delete. If another user has scheduled a delete, the Cancel Delete button is unavailable until that export is complete. The Cancel Delete button is unavailable if another user has scheduled an export. To check whether a scheduled Delete has started or finished, click Refresh.

You can enable and disable event auditing and specify the types of events to be audited.

Before you begin, ensure that Server Auditing is enabled. See Configuring event auditing and privacy settings for more information on auditing.

1. In administration console, click Services > Document Security > Configuration > Audit and Privacy Settings.

2. To configure extended usage tracking, under Enable Tracking, select Yes or No.

3. To set the selection of the Allow collection of detailed usage data check box on the log in page, under Enable Tracking default, select Yes or No.

To view the tracked events you can use the Document Events filter on the Events page. The events tracked using JavaScript are labelled as Detailed Usage Tracking. Refer to Monitoring events for more information on events.

Rows to display for search results:

Number of rows that appear on a page when searches are performed.

You can create dynamic watermarks with several watermark elements with each element specified as either text or PDF. You can include up to five elements, in a watermark.

If you choose a text-based watermark, you can specify several elements within the watermark with multiple text entries and specify the positioning of each element. Assign meaningful names to these elements, such as header, footer, and so on.

For example, if you want to specify different text in the header, footer, on the margins, and across the document as a watermark, you create several watermark elements and specify their positions. If you want the user ID of the user and the current date of accessing the document to appear in the header, the policy name in the right margin, and a custom text “CONFIDENTIAL” to appear diagonally across the document, you define separate watermark elements with text as the type, and specify its formatting and positioning. When the watermark is applied to a document, all the elements in the watermark are applied to the document at the same time, in the order they are added to the watermark.

Typically, you use PDF-based watermarks to include graphic contents such as logos or special symbols such as copyright or registered trademark.

You can change the limits on the number of watermark elements and the PDF file size by modifying the document security configuration file. See Change the watermark configuration parameters .

Keep in mind the following when you configure watermarks:

You can create dynamic watermark templates. These templates remain available as a configuration option for policies that administrators or users create.

1. In administration console, click Services > Document Security > Configuration > Watermarks.

2. Click New.

3. In the Name box, type a name for the new watermark.

   Note: You cannot use some special characters in the names or descriptions of watermarks or watermark elements. See the restrictions listed in Considerations for editing policies .

4. Under Name, next to the plus sign, enter a meaningful name to the watermark element such as Header, and add a description, and expand the plus sign to display the options.

5. Under Source, select the type of watermark as either Text or PDF.

6. If you selected Text, do the following:

   • Select the watermark types to include. If you select Custom Text, in the adjacent box, type the text to display for the watermark. Keep in mind the text length that will appear as watermark.

   • Specify the text formatting properties such as font name, font size, foreground color, and background color for the text contents of the watermark text. Specify the foreground and background color as hex values.

     Note: If you select the scaling option as Fit To Page, the font size property is not available for editing.
7. If you selected PDF for rich watermark options, Click Browse next to Select Watermark PDF to select the PDF document that you want to use as the watermark.

   Note: Do not use a password-protected PDF document. If you specify a password-protected PDF as the watermark element, the watermark is not applied.
8. Under Use As Background, select either Yes or No.

   Note: Currently, the watermark appears in the foreground irrespective of this setting.

9. To control where the watermark is displayed on the document, configure the Vertical Alignment and Horizontal Alignment options.

10. Either select Fit to Page or select % and type a percentage in the box. The value must be a whole number, not a fraction. To configure the watermark size, you can use a value that is the percentage of the page or set the watermark to fit the size of the page.

11. In the Rotation box, type the degrees by which to rotate the watermark. The range is from -180 to 180. Use a negative value to rotate the watermark counterclockwise. The value must be a whole number, not a fraction.

12. In the Opacity box, type a percentage. Use a whole number, not a fraction.

13. Under Advanced Options, set the following:

    Page Range Options

    Set the range of pages where the watermark should be displayed. Enter the start page as 1 and the end page as -1 to have all pages marked with the watermark.

    Display Options

    Select where you want to have the watermark appear. By default, the watermark appears both on soft copy (online) and hard copy (print).

14. Click New under watermark Elements to add more watermark elements if necessary.

15. Click OK.

1. In administration console, click Services > document security > Configuration > Watermarks.

2. Click the appropriate watermark in the list.

3. On the Edit Watermarks page, change the settings as required.

4. Click OK.

When you delete a dynamic watermark, it is no longer available to add to a new policy. However, the watermark remains on existing policies that currently use it, and documents that the policy currently protects continue to show the dynamic watermark until you or a user edits the policy that contains the deleted watermark. After the policy is edited, the watermark is no longer applied. A message appears, indicating that the existing watermark is deleted on the policy and the user can select another one to replace it.

1. In administration console, click Services > Document Security > Configuration > Watermarks.

2. Select the check box beside the appropriate watermark and click Delete.

3. Click OK.

You can restrict registration with document security for certain external users or user groups. This option is useful, for example, to allow access to a certain user group but exclude specific individuals who are part of the group.

The following settings are located in the Email Restriction Filter area of the Invited User Registration page.

Exclusion:

Type the email address of a user or group to exclude. To exclude multiple users or groups, type each email address on a new line. To exclude all users who belong to a particular domain, enter a wildcard and the domain name. For example, to exclude all users in the example.com domain, enter *.example.com .

Inclusion:

Type the email address of a user or group to include. To include multiple users or groups, type each email address on a new line. To include all users who belong to a particular domain, enter a wildcard and the domain name. For example, to include all users in the example.com domain, enter *.example.com .

The following settings are located in the General Settings area of the Invited User Registration page.

SMTP Host:

The host name of the SMTP server. The SMTP server manages the outgoing email notices to register and activate invited user accounts.

If required by your SMTP host, type the required information in the SMTP Server Account Name and SMTP Server Account Password boxes to connect to the SMTP server. Some organizations do not enforce this requirement. If you need information, see your system administrator.

SMTP server socket class name:

Socket class name for the SMTP server. For example, javax.net.ssl.SSLSocketFactory .

Email Content Type:

Accepted MIME type like text/plain or text/html .

Email Encoding:

Encoding format to use when sending email messages. You can specify any encoding, for example, UTF-8 for Unicode or ISO-8859-1 for Latin. The default is UTF-8.

Redirect Email Address:

When you specify an email address for this setting, any new invitation are sent to the address provided. This setting can be useful for testing purposes.

Use Local Domains:

Select the appropriate domain. On a new installation, ensure that you created the domain by using User Management. If this is an upgrade, an external user domain was created during the upgrade and can be used.

Use SSL for SMTP server:

Select this option to enable SSL for the SMTP server.

Display login link on registration page:

Displays a login link on the registration page displayed for invited users.

Document security automatically issues a registration invitation email when you create a new invited user account or when an existing user adds an external recipient who has not previously registered or been invited to register to a policy. The email contains a link that the recipient can use to access the registration page and enter personal account information, including user name and password. The password can be any combination of eight characters.

When the recipient activates the account, the user becomes a local user.

The following settings are located in the Invitation Email Configuration area of the Invited User Registration page.

From:

The email address from which the invitation email is sent. The default format of the From email address is postmaster@[your_installation_domain].com.

Subject:

Default subject for the invitation email message.

Timeout:

The number of days after which the registration invitation expires if the external user does not register. The default value is 30 days.

Message:

The text that appears in the body of the message inviting the user to register.

After invited users register, document security sends an activation email. The activation email contains a link to the account activation page where the users can activate their account. When the accounts are activated, users can log in to document security by using their email address and the password they created when they registered.

When the recipient activates the user account, the user becomes a local user.

The following settings are located in the Activation Email Configuration area of the Invited User Registration page.

From:

The email address from which the activation email is sent. This email address receives failed delivery notices from the registrant’s email host and also any messages that the recipient sends in reply to the registration email. The default format of the From email address is postmaster@[your_installation_domain].com.

Subject:

Default subject for the activation email message.

Timeout:

The number of days after which the activation invitation expires if the user does not activate the account. The default value is 30 days.

Message:

The text that appears in the body of the message a message indicating that the recipient’s user account needs to be activated. You may also want to include information such as how to contact an administrator to obtain a new password.

If you have to reset an invited user’s password, a confirmation email is generated that invites the user to choose a new password. A user’s password cannot be determined; if the user forgets it, you must reset it.

The following settings are located in the Reset Password Email area of the Invited User Registration page.

From:

The email address from which the password reset email is sent. The default format of the From email address is postmaster@[your_installation_domain].com.

Subject:

Default subject for the reset email message.

Message:

The text that appears in the body of the message a message indicating that the recipient’s external user password is reset.

As an administrator, specify which users and groups can create custom policies. This permission can be set at the user and group level. The search functionality searches the User Management database for users and groups.

1. In administration console, click Services > Document Security > Configuration > My Policies.

2. On the My Policies page, click the Create Policies tab and click Add Users and Groups.

3. In the Find box, type the user name or email address of the user or group that you are searching for. If you do not have this information, leave the box empty. You can also type a partial name or email address, such as when you know only the first two letters of a user name.

4. In the Using list, select your search parameters Name or Email.

5. In the Type list, select Group or User to narrow your search.

6. In the In list, select the domain to search. If you do not know the user or group’s domain, select All Domains.

7. In the Display list, specify the number of search results to display per page and then click Find.

8. To add My Policies users and groups, select the check box for each user and group to add.

9. Click Add, and then click OK.

Your selected users and groups now have permission to create custom policies.

1. On the document security page, click Configuration > My Policies.

2. On the My Policies page, click the Create Policies tab. Users and groups with permissions to create custom policies are displayed.

3. Select the check box next to the users and groups to remove from this permission.

4. Click Delete, and then click OK.

When users are managing their custom policies, they can search for users and groups to add to their policies. You must specify the domains from which users and groups are visible in these searches.

1. On the document security page, click Configuration > My Policies.

2. On the My Policies page, click the Visible Users and Groups tab.

3. To make the users and groups in a domain visible, click Add Domains, select the domains, and click Add. To remove a domain, select the checkbox next to the domain name and click Delete.

Document security enables users to open and use protected document when they are not connected to the document security server. The user’s client application must regularly synchronize with the server to keep documents valid for offline use. The first time users open a protected document, they are asked whether their computer should be authorized to perform periodic client synchronization.

By default, the synchronization occurs automatically every four hours and as-needed when a user is connected to the document security server. If the offline period for a document expires while the user is offline, the user must reconnect to the server to enable the client application to synchronize with the server.

In the document security configuration file, you can specify the default frequency of the automatic background synchronization. This setting acts as the default timeout period client applications, unless the client explicitly sets its own timeout value.

1. Export the document security configuration file. (See Manually editing the document security configuration file .)

2. Open the configuration file in an editor and locate the PolicyServer node. Under that node, locate the ServerSettings node.

3. In the ServerSettings node, add this following entry and then save the file:

   <entry key="BackgroundSyncFrequency" value=" time "/>

   where time is the number of seconds between automatic background synchronizations. If you sent this value to 0 , synchronization always occurs. The default value is 14400 seconds (every four hours).

4. Import the configuration file. (See Manually editing the document security configuration file .)

You can configure document security to deny services to applications that meet specific criteria. The criteria can specify a single attribute such as a platform name or it can specify multiple sets of attributes. This feature can help you control the requests document security must handle. Here are some applications of this feature:

• Revenue protection: You may want to deny access to any client application that does not support your revenue conventions.

• Application compatibility: Some application may be incompatible with the policies or behavior of your document security server.

When client applications attempt to establish a link with document security, they supply application, version, and platform information. Document security compares this information against Denials settings it obtains from the document security configuration file.

The Denials settings can contain several sets of denial conditions. If all of the attributes of any one set match, the requesting application is denied access to the document security services.

The denial-of-service feature requires that client applications use the document security C++ Client SDK version 8.2 or later. The following Adobe products provide product information when requesting document security services:

• Adobe Acrobat 9.0 Professional/Acrobat 9.0 Standard and later

• Adobe Reader 9.0 and later

• Acrobat Reader DC extensions for Microsoft Office 8.2 and later

Client applications use the Client API from the document security C++ Client SDK to request services from document security. The Client API requests include platform and SDK version information (precompiled into the Client API) and product information obtained from the client application.

Client applications or plug-ins supply product information in their implementation of a callback function. The application provides the following information:

• Integrator name

• Integrator version

• Application family

• Application name

• Application version

If any information is not applicable, the client application leaves the corresponding field blank.

Several Adobe applications include product information when requesting document security services, including Acrobat, Adobe Reader, and Acrobat Reader DC extensions for Microsoft Office.

<node name="ClientVersionRules"> 
    <map> 
        <entry key="infoURL" value="http://www.dont.use/windows.html"/> 
    </map> 
    <node name="Denials"> 
        <map/> 
        <node name="Entry_1"> 
            <map> 
                <entry key="SDKPlatforms" value="Microsoft Windows"/>  
            </map> 
        </node> 
    </node> 
</node>

<node name="ClientVersionRules"> 
    <map> 
        <entry key="infoURL" value="http://get.a.new/version.html"/> 
    </map> 
    <node name="Denials"> 
        <map/> 
        <node name="FirstDenialSettings"> 
            <map> 
                <entry key="AppNames" value="My Application"/>  
                <entry key="AppVersions" value="3.0"/> 
            </map> 
        </node> 
        <node name="SecondDenialSettings"> 
            <map> 
                <entry key="AppNames" value="My Other Application"/>  
                <entry key="AppVersions" value="2.0"/> 
            </map> 
        </node> 
    </node> 
</node>

<node name="ClientVersionRules"> 
    <map> 
        <entry key="infoURL" value="http://get.a.new/version.html"/> 
    </map> 
    <node name="Denials"> 
        <map/> 
        <node name="Entry_1"> 
            <map> 
                <entry key="AppFamilies" value= 
    "document security Extension for Microsoft Office"/> 
                <entry key="AppNames" value= "Microsoft PowerPoint"/>  
                <entry key="AppVersions" value="2007,2010"/> 
            </map> 
        </node> 
    </node> 
</node

Many document security users do not have access to external links such as www.adobe.com while they are using the Right Management user interfaces:

• http://[host]:[port]/adminui

• http://[host]:[port]/edc.

The following changes to the config.xml disables all external links from the Right Management user interfaces.

1. Export the document security configuration file. (See Manually editing the document security configuration file .)

2. Open the configuration file in an editor and locate the DisplaySettings node.

3. To disable all external links, in the DisplaySettings node, add the following entry and then save the file:

   <entry key="ExternalLinksAllowed" value="false"/>

4. Import the configuration file. (See Manually editing the document security configuration file .)

The following changes to the config.xml enable TLS support for the Invited User Registration feature.

1. Export the document security configuration file. (See Manually editing the document security configuration file .)

2. Open the configuration file in an editor and locate the DisplaySettings node.

3. Locate the following node:

   <node name="ExternalUser">

4. Set the value of the SmtpUseTls key in the ExternalUser node to true .

5. Set the value of the SmtpUseSsl key in the ExternalUser node to false .

6. Save the config.xml .

7. Import the configuration file. (See Manually editing the document security configuration file .)

The following changes to the config.xml todisable SOAP endpoints for document security documents.

1. Export the document security configuration file. (See Manually editing the document security configuration file .)

2. Open the configuration file in an editor and locate the following node:

   <node name="DRM">

3. In the DRM node, locate the entry node:

   <entry key="AllowUnencryptedVoucher" value="true"/>

4. To disable SOAP endpoints for document security documents, set the value attribute to false .

   <node name="DRM"> 
       <map> 
           <entry key="AllowUnencryptedVoucher" value="false"/> 
       </map> 
   </node>

5. Save the config.xml .

6. Import the configuration file. (See Manually editing the document security configuration file .)

When you edit a policy, the changes affect documents that the policy currently protects, as well as documents that the policy protect thereafter. For example, if you remove recipients from a policy that is currently applied to a document, the recipients can no longer open the document.

The status of the document determines when the change takes effect:

• If the document is online, changes are applied immediately unless the user has the document open. In this case, the user must close the document for the changes to take effect.

• If a recipient is using the document offline (for example, on a laptop computer), the changes take effect the next time the recipient takes the document online and synchronizes with document security by opening any policy-protected document.

When you edit policies, these restrictions apply:

• Invited users can only edit policies if the administrator enables this capability. If you cannot edit policies, the Edit option will not be available.

• Policy set coordinators can edit policies within policy sets only if they have the correct permissions. The super user or policy set administrator sets these permissions in the document security administrator interface.

• If the policy has a watermark configured that the administrator deleted since the policy was created, this watermark will no longer be applied to documents if you edit and save the policy. Deleted watermarks remain in effect only for existing policies as long as you do not edit the policy. If you edit the policy, you must select another watermark to replace the deleted one.

• You cannot grant anonymous access to a document by editing the policy that is currently applied. If you edit the policy, users must still log in to access the document. To apply anonymous access to this document, first remove the policy in the client application and then apply another policy that permits anonymous access.

• Policies that Acrobat auto-generates for the recipients of a document that is attached to an email message in Microsoft Outlook do not appear in the policy list. To access this policy, locate the document on the Documents page, open the Document Detail page, and click the policy name in the list of document details.

In the Users and Groups area, you specify the users who have access to documents protected with the policy. For each user or group you specify, you also set the document usage privileges.

Add User or Group:

To add a user or group of users, click Add User or Group and then click Advanced Search to find users or groups. Users include your organization’s internal users and invited users who have registered with document security. When you select this option, the Add User or Group page appears:

• In the Find box, type the user or group name or email address.

• In the Using list, select Name or Email.

• In the Type list, select User or Group.

• Select the domain you want to search from the In list, and click Find.

• When the results are returned, select the user or group to add, and click Add.

Note: If you enter a correct invited user name or email address and no result is returned, the user may not have registered yet, or the account may be deleted. You can try adding the user as an invited user type or contact your administrator.

Invite New User:

To add an invited user, click Invite New User, type the user’s email address in the box that appears, and click Invite. This option is available only if the administrator enabled it. When you add new invited users to a policy, document security sends a registration invitation email if the users are not already invited to register. The users must use the link in the email to create an account, and then they must activate the account.

After registering, invited users can use policy-protected documents that they have authorization for. Depending on the capabilities that the administrator enables, the external users may have permission to apply policies to documents, create, edit and delete policies, and add other external users to policies.

The General Settings area contains the following settings:

Validity Period:

The time period during which the policy-protected document is accessible to authorized recipients. You can choose from these validity period options:

Document will not be valid after:

The document is accessible for the specified number of days from when the document was secured.

Document will not be valid after this date:

The document is valid from the date the policy is applied to the document until the end date that is specified.

Valid from, to:

The document is valid during the dates you specified. You can use the calendar to select a date, where applicable, by clicking the calendar icon.

Document is always valid:

The document validity period does not expire.

Note: The validity dates are based on the time zone of the document security system, not on the time zone of your local computer.

Auditing:

Enable or disable auditing of the events that are associated with a policy-protected document. For example, document security can record events such as attempts to open a document. Audited events appear in the list on the Events page. If you do not select this option, document security does not record events for documents that are associated with the policy.

Extended Usage Tracking:

Enable or disable Extended Usage Tracking. document security supports tracking of user events associated with various operations performed on a PDF file. The document security object can be accessed using a Java Script. A button click, a multimedia file being played, or the saving of a file are some examples of events that can fired from a policy protected PDF. Using the document security object, you can also retrieve user information. The tracking of events may be enabled from the document security server at the global level or at a policy level.

Auto-Offline Lease Period:

The maximum number of days the recipient can use the policy-protected document offline (without an active Internet or network connection). When the lease period expires, the recipient must synchronize the document again to continue using it.

Select the external authentication providers if you have already configured any. Available providers are listed.

You can override the authentication settings that you configured on the server and specify the authentication options relevant for this policy. Select Override Global Authentication Settings and then select the authentication options relevant for this policy. The following authentication options are available:

If you are overriding the global authentication settings, you can choose the authentication options relevant for this policy. For example, if you had enabled three authentication options (username and password, client certificate, and extended authentication) on the server, you can override that global setting and select only extended authentication for this policy. You must ensure that the authentication option that you select here is already configured on the server. In this example, you cannot select Kerberos as the authentication option because it is not configured on the server.

The Advanced Settings area contains the following settings:

Dynamic Watermark:

Select a watermark to be dynamically displayed on the pages of a document (for example, when a recipient prints the document). Dynamic watermarks uniquely identify a document, therefore helping to ensure the confidentiality of the document and preventing copyright infringement. For example, the administrator can configure a dynamic watermark that displays the current date, the user name or identifier of the person who is using the document, or the name of the policy used to protect the document. A watermark can also display custom text or graphic elements if configured. Administrators configure the watermarks options, and administrators and users can apply them to policies.

If you are editing a policy and the administrator deleted a configured watermark that you previously selected for this policy, a note appears on the Edit Policy page. In this case, if you are saving the edited document, select a new watermark if you want one to appear on the document.

Note: For policies that provide anonymous user access, the user name and identifier of an anonymous user is not displayed as a watermark even if you select this type of watermark.

Use Only Certified Acrobat Plug-ins for PDF:

When selected for a policy, this option specifies that Acrobat 8.0 and later must run in certified mode when opening documents that are secured with the policy. When Acrobat runs in certified mode, it will not load any third-party plug-ins.

Select this option if you are concerned about a document recipient writing a plug-in that can circumvent any of the document protections in Acrobat 8.0 and later. Do not select this option if your document recipients need to use third-party plug-ins in Acrobat to interact with documents.

This option enables only the certified mode in Acrobat 8.0 or later; the administrator must disable access for Acrobat 7.0.

This option does not apply to Adobe Reader.

Access Denied Error Message:

A message that appears to anyone who attempts to open a policy-protected document without permission. This message appears in Acrobat. Clients that cannot display this message display a default message to indicate that access is denied.

The Unchangeable Advanced Settings area contains the following settings. You cannot change these settings after you save the policy.

Encryption Algorithm and Key Length:

Used to protect your documents. You can choose from these options:

• AES 128-bit

• AES 256-bit. Only Acrobat 9.0 and later supports this option. To use AES 256 encryption for PDF files, obtain and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy files. These files replace the local_policy.jar and US_export_policy.jar files in the [JAVE_HOME]/lib/security folder. For example, if you are using Sun JDK 1.6, copy the downloaded files to the [dep root]/Java/jdk1.6.0_26/lib/security folder. You can download these files from Java SE Downloads .

• No encryption. Acrobat 9.0 and later currently support this option. If you select this option, the Document Restrictions options are disabled. This option may be useful if you want to use document security for document auditing or version control but to not want to encrypt the document.

Document Restrictions:

Select the PDF document components to encrypt. Other client applications encrypt the entire document but not linked or embedded files. You can choose from these options:

• The entire document, including its attachments and metadata. Metadata is information about the document and its content that you can view through the document Properties dialog box or the Acrobat Advanced menu. In Acrobat, you can attach files of different types (for example, text, audio, and video files) to PDF documents.

• The document and its attachments but not the metadata.

• The document attachments only. You can encrypt the attachments to a PDF file without encrypting the document content.