TCPDF PDF forms, signing certificates and how to enable user's rights

Question

This is driving me completely and utterly nuts... Basically I have a PDF form generated by TCPDF and want to set the user rights (using setUserRights) for that PDF so that users can save the form with the data they inputted. The TCPDF manual isn't really helpful at this particular point and states that you need a "signing certificate" to enable saving and other extended features.

So I generated an SSL certificate and private using OpenSSL and "imported" them using the setSignature method. Without using that method Adobe Reader moans:

This document enabled extended features in Adobe Reader. The document has been changed since it was created and use of extended features is no longer available. Please contact the author for the original version of this document.

When the required setSignature method is set that message doesn't appear, but Reader still can't save the PDF.

$this->Pdf->setSignature("file:///certificates/forms.crt", "file:///certificates/forms.key", "somepassword", "", 3);

And then I set full user rights:

$this->Pdf->setUserRights(true, '/FullSave', '/Create/Delete/Modify/Copy/Import/Export', '/Add/Delete/FillIn/Import/Export/SubmitStandalone/SpawnTemplate', '/Modify');

Has anybody worked with this particular feature and is able to point out what I'm doing wrong here?

Update

TCPDF includes an example using a demo certificate. But it's unclear to me how to obtain such a certificate. Using the demo version still doesn't allow me to set the user's rights properly.

Answer 1

Have you tried without the setUserRights call? According to the docs that last parameter sets the rights. Perhaps the second call modifies the pdf and thus the signature no longer matches the PDF because it's changed?

Answer 2

I hope it's appropriate to answer my own question. I've asked this question on the TCPDF forums and got an answer of one of the maintainers of TCPDF.

Basically the answer is that it can't be done. Although the documentation states that:

Names specifying additional document-wide usage rights for the document. The only defined value is "/FullSave", which permits a user to save the document along with modified form and/or annotation data.

But this is apparently outdated information. It worked in Acrobat Reader 8 using a workaround, but now not anymore. So the only solution is generating your PDF with TCPDF and passing it through Adobe Acrobat and set the user rights there. As my application is a server-side PDF form generator I don't have that option... Or does anybody have a brilliant solution for this?

Answer 3

The setUserRights() was working in the past with old Acrobat Reader versions because a bug on these versions. AFAIK, only official Acrobat products can release user rights using the Adobe Private key. This means that the setUserRights() doesn't work anymore unless you are Adobe!

Check the TCPDF website at http://www.tcpdf.org and consult the official forum for further information.