Flattening removes signatures

Hi Andrew,

Thanks for reporting this to us! I will try to reproduce the issue at my side. At the same time, could you provide below information:
(1)Which OneSpan Sign environment?

(2)Does it happen to all completed packages since a certain time? Or just in few cases?

(3)Can you provide some of the package and document IDs of those failed ones?

I will also let you know if I can find anything.

Duo

1) It's happening in both US2 and US2 sandbox environments.

2) It seems to be all completed packages and it seems to have started when the latest release was rolled out to the respective environments.

3) Here is a production guid from US2 that we had the issue with and it seems to be all documents which had signatures. rBq_0q4yEpH6Y3TVEstH0flRtoo=

Thanks for the sharing! BTW, by "signature get removed", do you mean the image layer get removed, or the sealed certificate? Because flattened document, by its nature, contains no evidence and is akin to images. Another question is, have you upgraded the iText recently? What version are you using?

Duo

I mean it was visibly removed.  Viewing the pdf showed just a blank field where signature was supposed to be.  If the document was truly flattened that shouldn't be possible right?  We are using a pretty old version of itext though, we've tried with 5.5.8 and 5.5.13 and both have the same issue.  Nothing in our process has changed, it's been working fine for a long time up until the last OneSpan release.  We were using the same process prior to OneSpan in a onsite install of Silanis.

Hi Andrew,

Thanks for the clarification, now I can reproduce the issue using the  code around below, with iText 5.5.13:

    public static void manipulatePdf(String src, String dest) throws DocumentException, IOException {
        PdfReader reader = new PdfReader(src);
        PdfStamper stamper = new PdfStamper(reader, new FileOutputStream(dest));
        stamper.setFormFlattening(true);
        stamper.close();
    }

I am consulting our DocEngine expert if there's some code changes done recently. At the same time, since you should be able to directly merge the PDFs downloaded through API (GET /api/package/{package_id}/documents/{document_id}/pdf?flatten=true), could you work around this by removing the flatten logic?

Duo

That's what we're doing right now.  Our code looks just like what you posted, except I just changed the setFormFlattening to false.  I had to do an emergency prod push and then resubmit over 300 of our policies to make sure the signatures stayed in place.  We have some other pdfs that get merged in that still have some fields, which is why we have the flattening there in the first place.  For now, we'll just have to live with some fields still being there in our system.

Thanks

Sorry about the inconvenience caused. Just got some feedback from our developer -

Today, when OneSpan Sign flattens a signature, we keep the annotation almost intact and left it read-only and locked. Some PDF libraries (includes iText 7, with below code) allow to remove the annotation from the document and keep its visual representation, however it seems not the case for iText 5.

        PdfDocument pdfDoc = new PdfDocument(new PdfReader("src"), new PdfWriter("dest"));
        PdfAcroForm form = PdfAcroForm.getAcroForm(pdfDoc, true);
        form.flattenFields();
        pdfDoc.close();

Why previously flattening with iText 5 won't remove the signature is because on top of the annotation, we also create a copy of the visual appearance and put it inside the page. This visual appearance copy was recently removed due to PDF accessibility concern.

Back to your integration, besides upgrading the PDF lib, if you could tell which PDFs are coming from OneSpan Sign and avoid the flattening step, I think it might also solve the issue.

Duo

So with iText 5, is there a good way to tell if the pdf has been flattened already?  Meaning, as I'm looping through all of our pdfs, how can I tell if it's a OneSpan pdf that was already flattened?  Will the list of AcroFields be empty?

Hi Andrew,

Codewise, it would be better if you could use an additional flag or parameter to indicate if the PDF was downloaded from OneSpan Sign. However I think it also works if you simply consider the list of AcroFields is empty for those PDFs downloaded from OSS with codes around below lines:

        PdfReader reader = new PdfReader(src);
        PdfStamper stamper = new PdfStamper(reader, new FileOutputStream(dest));
        AcroFields acroFields = stamper.getAcroFields();
        if (acroFields.getFields().size() > 0) {
            stamper.setFormFlattening(true);
        }
        stamper.close();

Duo