Apache PDFBox Encrypt
CertifiedPassword protect a PDF
Apache PDFBox Encrypt
Password protect a PDF
Encrypts an unencrypted PDF with AES-256 (or AES-128); an already encrypted input fails, decrypt it first. The user password is needed to open the file; the owner password unlocks every permission. Permissions such as printing or copying are enforced by PDF readers, not by the encryption itself.
type: io.kestra.plugin.pdfbox.security.EncryptExamples
Protect a PDF and only allow printing
id: pdf_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.pdfbox.security.Encrypt
from: "{{ inputs.file }}"
userPassword: "{{ secret('PDF_USER_PASSWORD') }}"
ownerPassword: "{{ secret('PDF_OWNER_PASSWORD') }}"
canPrint: true
canCopy: false
canModify: false
Properties
from *string
The PDF to encrypt, as an internal storage URI
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
ownerPassword *string
Password that unlocks every permission
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150canAnnotate booleanstring
falseAllow adding or changing annotations
Default false.
canAssemble booleanstring
falseAllow inserting, rotating or deleting pages
Default false.
canCopy booleanstring
trueAllow copying or extracting text and images
Default true.
canFillForms booleanstring
trueAllow filling in form fields
Default true.
canModify booleanstring
falseAllow modifying the content
Default false.
canPrint booleanstring
trueAllow printing
Default true.
keyLength string
AES_256AES_128AES_256Encryption key length in bits
Default AES_256.
userPassword string
Password required to open the PDF
Leave empty to let anyone open the file while still restricting permissions.
Outputs
uri string
uriInternal storage URI of the encrypted PDF
