How To Securely Encrypt PDF With Password in ABAP?

When sensitive information is frequently shared electronically, then protecting the confidentiality, integrity, and authenticity of documents is very crucial. Having said that, Password Encrypted PDFs play a pivotal role in securing digital information.

Strangely, there is no direct way to perform file encryption using ABAP, so we have to rely on third-party software (PDFtk Server, which is free) to accomplish the task.

So in this ABAP tutorial, we’ll be using PDFtk Server to do the PDF encryption using ABAP.

What is PDFtk Server software?

This software is a command-based tool that gives you a lot of functionalities when working with PDF file. It offers a wide range of abilities to manipulate PDF file such as encrypting PDF files with password, join pdf files into one file, compressing, rotate pdf content and much more, find out more on PDFtk server examples.

In this tutorial we will focus on encrypting the PDF file with a password and demonstrate how easy it is to do the encryption and show you how to integrate it seamlessly with ABAP.

Okay now let’s get started.

Steps To Install The PDFtk Server In Your Local System

Step 1. Download the software PDFTKServer

Step 2. Install the software.

Step 3. Now let’s check if the software has been installed successfully. Open the Command Prompt and type pdftk, press Enter.

Step 4. Next, prepare some files in your local folder to do some testing.

How To Encrypt PDF file using PDFtk Server?

Here’s the basic syntax for PDF encryption. The encryption process creates two passwords:

1. Owner Password (OWNER_PW): This acts as the admin-level password. If a user forgets their password, the document can still be accessed using the owner password.
2. User Password (USER_PW): This password is required to open and view the PDF. Users with this password will have access only to the permissions set by the owner.

pdftk 1.pdf output 1.128.pdf owner_pw owner_pw user_pw user_pw

Now let’s test the encryption using the windows command first. You must supply different password for owner_pw and user_pw.

pdftk d:\doc\pdftest.pdf output d:\doc\pdftest_128.pdf owner_pw owpwd123 user_pw usrpwd123!

Now the encrypted PDF will be created as shown below

And it can only be opened using the passwords we have defined earlier.

You can also try other commands, such as merging (joining) multiple PDFs into a single file. In the example below, we combine file_1.pdf and file_2.pdf into a single file named pdfjoin.pdf.

pdftk d:\doc\file_1.pdf d:\doc\file_2.pdf cat output d:\doc\pdfjoin.pdf

Pretty cool right?

Now here come the fun part, integrating PDFtk server with SAP and ABAP.

Install PDFtk Server In Your SAP System And Execute It Using ABAP

Step 1. If you don’t have the permission to install the software then you can ask the basis team to install the software for you in the SAP’s system, just like you did here in your local system. For this lesson, we’ve installed pdftk software in /usr/bin/pdftk

Step 2. Now to execute the PDFtk encryption script, we will use a shell script. Since I am running on Linux, I will create a shell script ( let’s called it zpdfencrypt.sh ) for this purpose as shown below.

#!/bin/
exec "/usr/bin/pdftk" $1 output $2 owner_pw $3 user_pw $4h

As you can see, we have 4 parameters defined in the shell script file ($1 : source file, $2 : output file, $3 : owner_pw, $4 : user_pw ).

Step 3. Execute TCODE: CG3Z to upload the shell file ( zpdfencrypt.sh ) into your SAP application directory.

Step 4. Execute TCODE: SM69. This is where we create a customer external command to execute OS level command in your SAP system. Click the Create Button.

Step 5. Go to the operating system command section and enter the file path name for your shell script file (Defined in Step 3). For this lesson let’s name the customer external command as ZPDFENCRYPT. Click the Save Button.

Step 5. Create a new ABAP program and copy this ABAP code example.

*&---------------------------------------------------------------------*
*& Report ZPDFENCRYPT
*&---------------------------------------------------------------------*
*&
*&---------------------------------------------------------------------*
report zpdfencrypt.
* Encrypt PDF file with password

data: lv_param type sxpgcolist-parameters,
      lv_stat  type btcxpgstat,
      lv_ex    type btcxpgexit.

data: s_path      type eseftappl,
      source_file type eseftappl,
      output_file type eseftappl,
      own_pw      type eseftappl,
      usr_pw      type eseftappl.
      
* in our shell script file, we have defined 4 parameters as follow:
* exec "/usr/bin/pdftk" $1 output $2 owner_pw $3 user_pw $4h
* so we will assign these parameters using below syntax
* example
* source_file= /usr/sapdoc/doc/pdffile.pdf ( $1 )
* output_file = /usr/sapdoc/doc/pdf_128.pdf ( $2 )
* own_pw = OwnPwd123 ( $3 )
* usr_pw = UsdPwd123 ( $4 )

lv_param = source_file && | | && output_file && | | && own_pw && | | && usr_pw.

*this function will execute the shell script with its parameters,
*resulting an output encrypted PDF file in your SAP application directory folder
call function 'SXPG_COMMAND_EXECUTE'
  exporting
    commandname                   = 'ZPDFENCRYPT' "your customer external command name (SM69)
    additional_parameters         = lv_param
  importing
    status                        = lv_stat
    exitcode                      = lv_ex
  exceptions
    no_permission                 = 1
    command_not_found             = 2
    parameters_too_long           = 3
    security_risk                 = 4
    wrong_check_call_interface    = 5
    program_start_error           = 6
    program_termination_error     = 7
    x_error                       = 8
    parameter_expected            = 9
    too_many_parameters           = 10
    illegal_command               = 11
    wrong_asynchronous_parameters = 12
    cant_enq_tbtco_entry          = 13
    jobcount_generation_error     = 14
    others                        = 15.

Step 6. When you’ve successfully executed the program, you will see the output file in your SAP directory folder and after that you can download (using open dataset ) and send the encrypted file via email to your user.

Step 7. Don’t forget the house cleaning work and remove (delete) the file after you’ve sent it. Create another customer external command (ZDELETEFILE) by using rm Linux command.

Step 8. Add this code below in your ABAP program.

    lv_param = output_file.

    call function 'SXPG_COMMAND_EXECUTE'
      exporting
        commandname                   = 'ZDELETEFILE'
        additional_parameters         = lv_param
      importing
        status                        = lv_status
        exitcode                      = lv_exitcode
      exceptions
        no_permission                 = 1
        command_not_found             = 2
        parameters_too_long           = 3
        security_risk                 = 4
        wrong_check_call_interface    = 5
        program_start_error           = 6
        program_termination_error     = 7
        x_error                       = 8
        parameter_expected            = 9
        too_many_parameters           = 10
        illegal_command               = 11
        wrong_asynchronous_parameters = 12
        cant_enq_tbtco_entry          = 13
        jobcount_generation_error     = 14
        others                        = 15.

Download PDF Encryption ABAP Code Example

You can download the full ABAP code example for this lesson right here Github: PDF Encryption Code.

You can also browse other ABAP Source Code.