Reader caching credentials?

[Jackson_Wilson]

Maybe this belongs in a Reader forum somewhere but I arrived at the issue / question through testing LiveCycle Rights Management so I'm starting here ...

I'm seeing some odd behavior accessing policy-protected documents.

Adobe Reader appears to cache the username / password to make it easier for you to open multiple policy-protected pdfs in the same session.  There appears to be a problem, however, if you use more than one valid username / password combination to open documents secured by the same LiveCycle server.

Say you Person A routinely use both User A and User B for opening policy protected documents that have been protected by LiveCycle server A.

If you open Document A that only allows User A to access it and you provide your User A username and password, you can open the document just fine.  If you then try to open Document B that only allows User B to access it, you will not be given an opportunity to enter User B's username and password.  Instead you receive the "This document is locked.  You do not have permission to open it.  Contact the person who sent you this document and ask them to give you permission to open it." error message.

You will not have an opportunity to enter User B's username and password until you 1) forcibly terminate AcroRd32.exe OR reboot your PC.

I'm using LiveCycle 8.2 SP2 and Reader 8.1.4 (KB 408682).

Can anyone replicate this behavior?  Is this to be expected?

[Former Community Member]

The behavior you are experiencing is expected.

Acrobat\Reader does establish a session with the RM server once a user successfully authenticates to a rights managed document (i.e. the document opens).

For the duration of the session, the user id and password is retained and used when another rights managed PDF is opened.  The session is ended when a) Acrobat or Reader is closed or B) the session times out (session length is determined by a configuration value on the server)

In your scenario, even though User A and User B are the same person, Rights Management only knows about the currently logged in user (User A), for the session duration.  This is why the document protected for User B will not open until you authenticate as User B.

Regards

Steve

[Jackson_Wilson]

I suspect that reducing the server timeout for authenticated sessions would have a negative effect on users viewing documents that do not allow offline access (e.g., they will be prompted to re-authenticate each time the sessions is expired.)

Is there any way to configure the Reader / server to prompt the user for an alternate username / password in the event that the cached credentials, while valid, are not authorized to perform the requested action (e.g., open the document)?

This would seem to me a functional issue that would prevent large enterprises from rolling out LiveCycle Rights Management if they didn't already have an enterprise-wide "single sign-on" facility available for authentication.