Posts tagged "PDF"

AEM Assets workflow for automatic PDF generation from InDesign files

Many of my Enterprise customers ask how they can use Adobe Experience Manager (AEM) to automate the production of common derivative files from their InDesign files. Derivative files, you ask? InDesign files often represent the “source of truth” for many business documents, from manuals to data sheets to publications and many more types. These documents must be transformed from InDesign into something else (hence the term derivative) in order to be made available on a web site, for instance. The usual method is to export a PDF from InDesign and then upload the PDF as a new asset into the repository. This puts added burden on the author of the InDesign file as well as introducing the possibility of error due to incorrectly set PDF job options. This gets even more complicated if the author must make versions suitable to send to a commercial printer as well as a version that’s optimized for reading online as a PDF. This article provides techniques to automate the production of a web-optimized and print-optimized PDF from any InDesign file that appears in AEM Assets.

This article assumes that you have access to Adobe Experience Manager Assets and InDesign Server. In this example, I use AEM 6.1 and InDesign CC Server 2015, but the technique should work with AEM 5.6.1 and higher and ID Server CS6 and higher. You need to ensure that you have configured your AEM Author environment to work with InDesign server according to the documentation found here. The foundation of any successful integration (beyond configuration!) is the combination of Scripts, Workflow Models, and Workflow Launchers.

You can download a package that contains the scripts and a workflow model you can use today. When you install the package, you will have new scripts located at /etc/dam/indesign/scripts and /etc/workflow/scripts. You will also see a new Workflow Model located at /etc/workflow/models/dam/. The Workflow Launcher must be reconfigured, since I didn’t want to disrupt your existing workflows after you install the package.


Scripts tell AEM or external applications what to do, and they form the basis of any InDesign Server-based solution. There are two sets of scripts used here: one set for InDesign Server to generate the PDFs and the other for AEM to move the resulting files. First, let’s look at the JavaScript to tell InDesign Server what we want it to do and how we want it to respond to the request.

There are a number of InDesign Server scripts included in the basic AEM installation, and I’ve modified /etc/dam/indesign/scripts/PDFExport.jsx to request specific kinds of PDF from InDesign Server.  In addition, the script writes the new PDF files into the InDesign file’s /renditions node. These two scripts are located at /etc/dam/indesign/scripts/PDFExport_Print.jsx and at /etc/dam/indesign/scripts/PDFExport_Web.jsx. I could have easily combined these two operations into one script, but I wanted to leave you the option to easily enable or disable each one according to your requirements. You can also combine them yourself or make them fancier, responding to properties you set on the InDesign file in AEM (via XMP) and read out with InDesign Server. Here is the code for PDFExport_Web.jsx, which is almost identical to PDFExport_Print.jsx. The difference is in the value of pdfExportPreset in line 31, the filename set in line 56, and the function return value set in line 57.

// Export any Indesign document as PDF

//==== get soap arguments ====
if (app.scriptArgs.isDefined("credentials")) {
 var credentials = app.scriptArgs.getValue("credentials");
} else {
 throw "CQ host credentials argument is missing";
if (app.scriptArgs.isDefined("cqHost")) { 
 var host = app.scriptArgs.getValue("cqHost");
} else {
 throw "cqHost argument is missing";
if (app.scriptArgs.isDefined("resource")) { 
 var resourcePath = app.scriptArgs.getValue("resource");
} else {
 throw "resource argument is missing";

try {
 //==== create a temporary folder under InDesign server tmp directory to fetch and export ====
 // added randomness to the folder name
 var exportFolder = new Folder("tmp-" + (new Date().getTime() - Math.floor((Math.random()*10000)+1) ));
 fileName = resourcePath.substring (resourcePath.lastIndexOf ('/'), resourcePath.lastIndexOf ('.'));
 var sourceFile = new File(exportFolder.fullName + fileName + '.indd');
 var outputFile = new File(exportFolder.fullName + fileName + '_web.pdf');
 var pdfExportPreset = "[Web Preset]" // Set your PDF Web-ready Export Preset (joboption) here.
 // You can use any joboption file installed in InDesign Server

 app.consoleout('Fetching resource from CQ: '+resourcePath);
 fetchResource (host, credentials, resourcePath, sourceFile);

 var document =;

 with (app.pdfExportPreferences) {
 viewDocumentAfterExport = false;
 var myPDFExportPreset = app.pdfExportPresets.item(pdfExportPreset);
 document.exportFile(ExportFormat.pdfType, outputFile,myPDFExportPreset);

 // close the document
 //==== remove the original resource and send the export back to CQ ====

 //==== send file to CQ ====
 var target = resourcePath.substring (0, resourcePath.lastIndexOf ('/')) + "/renditions";
 app.consoleout('Posting this file to CQ: '+outputFile);
 app.consoleout('Posting to location: ' + target);
 putResource (host, credentials, outputFile, fileName + '_web.pdf', 'application/pdf', target);
 returnValue = "PDF for Web exported and posted successfully";
} finally {
 //==== remove the temp folder ====
app.consoleout('Finished PDF for Web export using '+pdfExportPreset+' joboptions');

To use these scripts, you need to have a PDF Joboptions file installed in InDesign Server to export your PDF. When you install the package, you will find a new folder at /content/dam/InDesign Server joboptions that contains two PDF Export Presets for InDesign Server. Move these two files to Applications/Adobe InDesign CC Server 2015/Resources/Adobe PDF/settings/mul and then restart InDesign Server to load the new settings.

Now that we have the InDesign Server pieces in place, let’s look at the AEM script. This is an ECMA script, which is very much like JavaScript, and it’s located at /etc/workflow/scripts/move-pdf-renditions.ecma. I’ve written it as a function that’s called twice, once for each PDF rendition, so it’s easy to add or remove other renditions as you see fit. This script will be called from the Workflow Model, which we’ll look at next. Here’s the script code.

var renditionExtension = "pdf";
var mimeType = "application/pdf";

var workflowData = graniteWorkItem.getWorkflowData();


function movePDF (renditionPostfix) {
 if (workflowData.getPayloadType() == "JCR_PATH") {
 var path = workflowData.getPayload().toString();
 var resourceResolver = graniteWorkflowSession.adaptTo(;
 var resource = resourceResolver.getResource(path);
 if (resource !== null) {
 var asset =;
 if (asset !== null) {
 var name =, ".");
 var renditionName = name + "_" + renditionPostfix + "." + renditionExtension;
 var rendition = asset.getRendition(renditionName);
 if (rendition !== null) {
 var renditionResource = resourceResolver.getResource(rendition.path);
 var stream = renditionResource.adaptTo(;
 var targetPath = asset.adaptTo( + "/" + renditionName;
 var assetManager = resourceResolver.adaptTo(;
 assetManager.createAsset(targetPath, stream, mimeType, true);
 } else {
 log.debug("rendition " + renditionName + " cannot be found on asset " + path);
 } else {
 log.debug("Item is not an asset: " + path);
 } else {
 log.debug("Item does not exist: " + path);

Workflow Model

There will be a new Workflow Model in your Workflows list called DAM Update Asset with PDF move located at /etc/workflow/models/dam/update_asset_pdf/. It is similar to and derived from the standard DAM Update Asset workflow that comes with every AEM installation. I have changed one existing step (Media Extraction) and added a new step (a Process step called “Move PDFs from Renditions”).

These two workflow steps are different from the standard DAM Update Assets workflow

These two workflow steps are different from the standard DAM Update Assets workflow

The Media Extraction step is designed to convert InDesign documents to other formats required by AEM Assets for a number of key functionalities. These include generating sub-assets (images that are embedded within the InDesign file), page images, extraction of text, and metadata synchronization, among other things. Media Extraction sends the script (and a pointer to the InDesign file) as its payload to InDesign Server. InDesign Server then runs the script and returns something to AEM. It is important that you do not remove any of the existing scripts that Media Extraction launches, but you can always add additional steps. Here, we added two additional scripts to the workflow step: PDFExport_Print.jsx and PDFExport_Web.jsx

The Print and Web PDF Export scripts have been added to the Media Extraction Workflow Step.

The Print and Web PDF Export scripts have been added to the Media Extraction Workflow Step.

Immediately after Media Extraction, I added a new Process step that executes an ECMA script in AEM. For many users, they will access AEM Assets via their desktop using the AEM Assets Companion tool or the Creative Cloud Desktop tool, so this workflow ensures that they get the renditions they need in a place that’s easy to find. Also, users of AEM Assets will be able to search for these PDFs like any other asset under management. This script copies the PDFs from /renditions as new assets adjacent to the InDesign file. It is best to leave the PDFs in /renditions so that they can be used by components that might offer the PDF as a download, for instance.


The new Process step executes an ECMA script that copies the new PDF files so that they are accessible on the desktop.

Workflow Launcher

Lastly, it is necessary to change the Workflow Launcher that is triggered whenever a file appears in the repository or whenever a file is modified in the repository. I did not include this change in the package so that you can install the package with no impact on your running system. When you are ready and have tuned the scripts for your workflow, then you can enable the Workflow in the Workflow Launcher panel.

In your AEM Author instance, click on Tools>Workflow>Launchers or visit http://localhost:4502/libs/cq/workflow/admin/console/content/launchers.html (of course, point at your Author instance!). Select the /content/dam(/.*/)renditions/original that has no condition on it (see screenshot below) and click on View Properties, and then on Edit.

Select the proper Launcher and view its properties

Select the proper Launcher and view its properties

The Launcher is designed to run a workflow when a specific condition is met. This workflow looks for any file that appears in the repository and then runs the DAM Update Asset workflow on it. You need to change the workflow to DAM Update Asset with PDF Move and then Save the changes.

Change the workflow that is triggered by the Launcher

Change the workflow that is triggered by the Launcher

Once you’ve saved the Launcher, you are ready to test. Upload an InDesign document into AEM using your preferred method. You can use drag and drop in a Browser window, AEM Assets Companion, or CC Desktop Tool. If you happen to catch the InDesign Server console, you will see new entries that report on whether IDS was successful at exporting PDF renditions. In a short while, your new PDF  files will magically appear next to the InDesign file. Now, go ahead an edit that InDesign file and save it back to AEM Assets. Again, the workflow will run and new PDF files will replace the existing ones, ensuring that you always have access to the latest versions. And, since they are assets under management, you can always revert to earlier versions of the PDF by looking at the asset timeline in a browser.


This new workflow and the scripts that support it expose a new behavior for AEM Assets. While convenient for the user, since it automatically generates useful and necessary derivatives of the source InDesign asset, it enforces known good business processes by encapsulating approved PDF Export settings into he workflow. It also reduces errors by automating a task that otherwise would require several configuration steps in InDesign before they could export the PDF.

I hope that you find this useful, and that you use it as a starting point for further InDesign Server automation using AEM Assets.

Share on Facebook

Establishing Trust in an ad hoc Electronic Signature Workflow with Acrobat

I had a customer ask me about why signatures in their PDFs that they had signed with Acrobat would not verify. Doing a little digging, it became apparent that while the group had created and begun using signatures in Acrobat, they had not established trust within the group.

An electronic signature, like a pen-and-ink signature, is only as good as your belief that the signature is genuine. In a paper workflow, we can witness someone applying their mark to the paper. We use ink because it is hard to remove from the paper. How, then, do we trust an electronic signature when we can’t witness the signature being applied to the PDF?

There are several mechanisms to establish and maintain trust in the context of Adobe PDF workflows. In this article, we’ll look at the ad hoc signature workflow. In order to for a signature workflow to work, we need two elements: signatures and Identities. In this workflow, all of the parties create electronic signatures and Identities with Acrobat, and all of the parties must exchange Identities in advance of using the signatures.

Digital Identities

In Acrobat X, signatures depend on digital identities, so we must start with creating an identity. When you have a document open, you can click on the Tools panel and then choose Sign & Certify>More Sign & Certify>Security Settings… At any time, you can find these controls under Edit>Protection>Security Settings…

Note: Click on these or any of the following images to view them full size.

You create a Digital Identity in the Security Settings Panel. A Digital Identity is a file that contains information specific to you, such as your name, email address, and company contact information. In addition, it contains half of a key that can be used to decrypt content that you have encrypted. This is important, because the person with whom you are sharing a signed PDF needs this key in order to be able to decrypt your signature and verify that you are who you say you are. Without this key, we don’t have trust in the workflow, so the key is how we establish this trust.

Let’s make a Digital Signature. In the Digital Signatures panel, click the Add ID button and then choose A new digital ID I want to create now and then click Next.

Now, you need to enter your personal information, select an encryption strength, and also make a choice about how you’ll be using this ID. In this example, I have entered my personal information, chosen my region, and have chosen 2048-bit RSA encryption. The default is 1024-bit RSA for backwards compatibility, but in this age of WikiLeaks and other data security compromises, I’ll opt for more modern protection. I’ve also chosen to use this digital ID for Digital Signatures and for Data Encryption. This is the default setting, but you can choose to use this ID exclusively for either Digital Signatures or Data Encryption.


A note about Unicode Support: if you need to use this signature in a region that uses Unicode characters, such as many parts of the Middle East and Asia, then you will want to enable Unicode support here as well. Enabling Unicode Support will expose another set of fields that allow you to enter Unicode data in addition to the Western characters.

Having made your choices, click Next.

Now, choose your password. This is a tricky business, since once you create the signature, you will need to know this password in order to use it. Ah, yes, in order to use it, you need to know its key to entry. This protects you from anyone else using the signature to impersonate you. To this end, choose a strong password. Acrobat X provides a thermometer that lets you know how strong your password is, or how hard it would be to guess. It bases this strength on a number of factors, including use of upper and lower case, use of special characters, apparent randomness of the string, and length of the string.


When you’re done, click Finish to complete the ID creation process, then close the Security Settings panel.

Establishing trust

Now that we have an ID, we can share it with people with whom we want to exchange signed documents. In a paper workflow, we can compare an ink signature against a government-issued ID, such as a passport or a driver’s license. In an electronic signature workflow, we exchange Digital IDs in advance of exchanging signed documents. This establishes the trust between the participants and allows Acrobat to verify the signatures on documents as having come from trusted sources.

There are several ways to exchange Digital IDs in Acrobat X, and I’ll focus on the two easiest ways to do it.

Let’s pause a moment to consider what’s being shared when you export an ID. An ID is an encrypted token that contains your personal information. The encryption scheme depends on two very large prime numbers. When you encrypt a signature (or any electronic content), the encryption routines use the key in your ID to do the encryption. Under this scheme, if someone has one of your two prime numbers, known as a public key, they can use it to decode your encrypted content. Sharing the public part of your ID is critical to establishing trust, because it enables the person with whom you are exchanging signatures to read the encrypted information in your signature.

Having that out of the way, let’s go back to the workflow. From the Security Settings panel, choose the ID you want to share and then click the Export button.

Here you’ll have to decide whether you want to email the ID to someone or save it somewhere on your computer. If you choose to email, then Acrobat will compose an email containing instructions as to how to import the ID. It will also include the ID as an attachment to the email. If you choose to save to a file, then Acrobat will save the ID as a file to the location of your choice. You will then be able to send it to whomever needs it without having to return to Acrobat. Make a choice, and click Next.

Acrobat creates an email message that explains what to do with the attached ID

In either case, Acrobat exports the ID as an FDF file. The recipient just needs to double click on the FDF file to install in either Reader or Acrobat.

You can also request that someone send you their ID. In Acrobat X, click on Sign & Certify>More Sign & Certify>Manage Trusted Identities and then choose Request Contact…

Enter your name, email address and phone number. Enable the Include my Certificates option, and choose Email request. Then, click Next…

In the following screen, select the ID you want to send and click Next. Then, enter the email address of the person with whom you want to exchange IDs. Click Send for Acrobat to compose the email and send it with your computer’s email program.

Making your digital mark

Now that we have created an ID and established trust, it is time to sign a document.

Open the PDF you want to sign. This PDF could be a PDF with a special form field for signatures or it could be a document with no signature field. If you have permission to sign the document, then you will be able to apply an electronic signature. The Sign & Certify panel has several options in it, including Sign Document and Place Signature. There is a subtle difference between these options: if the document is an electronic form and there is an existing signature field, then Sign Document will put the signature into the signature field. If there is no signature field on the document, then it behaves the same as Place Signature. Place Signature asks you to draw a box on the PDF where you’d like the signature to be.

Note: There is also an option called Apply Ink Signature, but that makes an annotation that looks like you signed the document with a pen. It is not an electronic signature like we’ve been discussing up to now and should not be used in an electronic signature workflow unless both parties agree that the annotation-type signature is acceptable as a signature. I want to take advantage of the work we’ve put in up to now, so we’ll be talking about Signing and Placing a Signatures.

I’ll assume that you are signing a document that does not have a signature field. Choose Sign & Certify>Place Signature. Acrobat will ask you to draw a box where you want the signature to go. Once you release the mouse from drawing the box, you’ll be able to determine which ID to use and also how the signature looks.

Choose the ID you want to use from the Sign As drop-down menu. Choose the ID that you used when you established trust earlier and enter the password for that ID.

You have options as to how the signature will appear on the document. By default, Acrobat includes your name and some of your personal information from the certificate. It is common to add a photo or scan of an ink signature to an electronic signature. To change the appearance, click on the Appearance menu and choose Create New Appearance…

Enter a name for the new appearance and configure the graphic option. You can have no name, choose to show your name, or choose the Imported graphic option and then browse to an image file. You can select just about any image file type that Acrobat can convert to PDF and have it appear in the signature. In this example, I chose a jpeg. You can also enable or disable different fields from the certificate. Make your choices and click OK.

When you have set all of your options, then you can click the Sign button to sign the document. You must save the signed PDF immediately. You may want to establish a naming convention for your signed documents, such as original_filename_SIGNED.pdf for signed PDFs. Having saved the PDF, you are done.

Final appearance of the digital signature with image

Final appearance of the digital signature with image

Note: If you are the last person in the workflow who needs to sign a document, then you may want to lock the document after you sign it. You can enable that option before you apply the signature.

Once signed, you can validate signatures in the Signature panel. This panel appears in any PDF that has a signature applied. You can also hover your mouse over a signature, and the tooltip will tell you whether the signature is valid. You can also click on a signature to check its validity.

There are times when you would want to remove a signature from a document. If you are the signer, then you can right-click on the signature and choose Clear Signature from the contextual menu.

Extending signature workflows to Reader users

You can include Reader users in your signature workflow by saving your PDF as a Reader Extended PDF. From the File menu, choose Save As>Reader Extended PDF>Enable Additional Features… A notice will appear letting you know what features will be enabled for Reader. Click Save Now to save the Reader Extended PDF. Give the Reader Extended PDF a name like original_name_Reader_Extended.pdf.


Once you create a Digital ID, then you can establish trust with someone else and exchange signed documents with them. Remember that you’ll need to establish trust by exchanging IDs with the other person in order to validate signatures.

Share on Facebook