Server-based security policies overview

Server-based security policies, also known as organizational policies, manage access to PDFs at the organizational level. These policies are stored on Adobe Experience Manager – Forms Server (Document Security) and enforced whenever a protected document is opened. Centralized management allows organizations to expire or revoke documents and track usage without redistributing files.

Understanding how these policies work helps you choose the right policy type and manage protected documents.

Authentication of organizational policies

Organizational policies use a server-based authentication model to ensure that access permissions are always validated against current policy rules.

In a server-based authentication model:

• Policies are stored on a server rather than on a local computer.
• Policies are applied to a PDF before distribution.
• Policies determine whether users can open, edit, or print a document.

When a protected PDF is opened, the server verifies the user’s identity and permissions before granting access. If access is denied or revoked, the document remains encrypted and unavailable.

Stages of server-based security policies

Server-based security policies follow a consistent lifecycle that spans administration, document protection, user access, and ongoing management.

• Configuring the Forms Server
  An administrator configures Adobe Experience Manager – Forms Server (Document Security) for the organization. This setup includes managing users and making organizational policies available to authorized authors.
• Publishing protected documents
  An author applies an organizational policy to a PDF. The server generates a license that governs access permissions, along with a unique encryption key that Acrobat embeds in the document to enforce those rules. The author or administrator can use this license to track and audit the PDF.
• Accessing protected documents
  When a recipient opens a protected PDF, the server authenticates the user. If access is approved, the document opens with the permissions defined by the policy.
• Managing access and auditing
  Authorized users can track document activity, audit usage, and change or revoke access through the Forms Server. These changes take effect without requiring the document to be redistributed.