adobe / adobe-license-decoder.rs

Decoder for FRL and SDL license files found on client machines.

Adobe License Decoder

Anyone who has worked with FRL or SDL licensing is familiar with the adobe-licensing-toolkit command-line tool for Mac and Windows. This tool runs on client machines in the context of a particular user account and provides information about the state of FRL and SDL licenses that are installed on the machine, including:

• the so-called "npdId" (also known as the "package id") of the license;
• whether the license is activated for the given user; and
• if activated, what the expiration date is of the license.

While this information is invaluable, it's specific to the user account it is run in, and it doesn't give any general information about the licenses that are installed on the machine that haven't been used.

Enter the adobe-license-decoder, a different command-line tool that can tell you about FRL and SDL license files both before and after installation. This tool can examine globally-installed SDL and FRL license files and tell you which apps they are for, which packages they are from, when they were installed, when they expire, and so on. It's like a "secret decoder ring" for the licenses!

Installation

The adobe-license-decoder is a command line tool that doesn't require any special privileges. So to install it on a given machine, just download the appropriate Mac or Win binary from the latest release page, rename it without the platform suffix (to adobe-license-decoder or adobe-license-decoder.exe), and put it somewhere in your command-line search path. It can then be invoked as adobe-license-decoder from any command line (examples below).

Usage

If invoked without any command-line arguments, the adobe-license-decoder will look for a globally installed OperatingConfigs directory, and decode all the license files found in that directory.

If you have some other directory that you want it to look in for license files (for example, if your customer zipped up their OperatingConfigs directory and sent the zip to you), just name that directory on the command line, as in:

adobe-license-decoder customer-license-files

If you have a package, you can invoke the decoder on the package directory (the root of the expanded zip file) as well. This works both for packages that include apps and for license-only packages. For example:

adobe-license-decoder online-illustrator_en_US

Finally, if you have a single license file (a file whose name ends in operatingconfig), a single preconditioning file (a JSON file that can be installed by the adobe-licensing-toolkit), or a single package description file (a file whose name ends in .ccp) that you want decoded, you can specify the name of the file itself instead of a directory, as in:

adobe-license-decoder ngl-preconditioning-data.json

In addition to the (optional) directory or file argument, the decoder takes an optional -v flag that causes the report it produces to give more information about packages, such as showing the specific census codes in FRL Isolated packages. If you specify this flag more than once (-vv), then the decoder will look in the current user's credential store to find locally cached licenses for installed packages. The next section shows some examples of the additional information.

How to Read the Decoder's Reports

The following is a sample run of the adobe-license-decoder tool on a FRL Online package. It shows the common data for the package at the top, followed by a list of the applications licensed by the package. You can see immediately that it's an FRL Online package, that it was built against the standard server endpoint, that it's for a CC All Apps license, and so on.

$ adobe-license-decoder online-default-allapps
Preconditioning data for npdId: NzBjZmVlYWItNzc2Ni00ZTNiLTk4NjQtNjczYjc5ZDM2ZGRk
    License type: FRL Online (server: https://lcs-cops.adobe.io/)
    License expiry date: controlled by server
    Precedence: 90 (CC All Apps)
Application Licenses:
 1: App ID: AcrobatDC1
 2: App ID: AfterEffects1
 3: App ID: Animate1
 4: App ID: Audition1
 5: App ID: Bridge1
 6: App ID: CharacterAnimator1
 7: App ID: Dreamweaver1
 8: App ID: Illustrator1
 9: App ID: InCopy1
10: App ID: InDesign1
11: App ID: LightroomClassic1
12: App ID: MediaEncoder1
13: App ID: Photoshop1
14: App ID: Prelude1
15: App ID: PremierePro1

Suppose we were to install the package above, using this command line (on Mac):

$ sudo adobe-licensing-toolkit -p -i -f online-default-allapps/ngl-preconditioning-data.json

Then we could run the decoder with no arguments, and it would find the installed operating config files (as shown in the run below). Since all the license files are for the same package, it still groups the package-specific information at the top of the list (but notice it now says "License files for" instead of "Preconditioning data for"). Then it shows the license-file-specific info for each of the licenses that are installed, giving the filename of the relevant operating configuration file (elided so it doesn't repeat the npdId segment of the filename each time), the specific application that license file is for, and the install date of the license file. The install date is important, because on a machine that has multiple packages installed, and thus has multiple license files of the same precedence for the same application, it's the most recently installed license file that will be used by the app when it launches. (You may notice that the install dates don't match the order in which the files are listed: that's because the listings are always sorted by Application ID, but the adobe-licensing-toolkit installation is done in the order the app entries happen to appear in the preconditioning file.)

$ adobe-license-decoder
License files for npdId: NzBjZmVlYWItNzc2Ni00ZTNiLTk4NjQtNjczYjc5ZDM2ZGRk:
    License type: FRL Online (server: https://lcs-cops.adobe.io/)
    License expiry date: controlled by server
    Precedence: 90 (CC All Apps)
Filenames (shown with '...' where the npdId appears):
 1: QWNyb2JhdERDMXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: AcrobatDC1
    Install date: 2020-12-27 16:26:19 -08:00
 2: QWZ0ZXJFZmZlY3RzMXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: AfterEffects1
    Install date: 2020-12-27 16:26:18 -08:00
 3: QW5pbWF0ZTF7fTIwMTgwNzIwMDQ-...-90.operatingconfig
    App ID: Animate1
    Install date: 2020-12-27 16:26:06 -08:00
 4: QXVkaXRpb24xe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: Audition1
    Install date: 2020-12-27 16:26:11 -08:00
 5: QnJpZGdlMXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: Bridge1
    Install date: 2020-12-27 16:26:17 -08:00
 6: Q2hhcmFjdGVyQW5pbWF0b3Ixe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: CharacterAnimator1
    Install date: 2020-12-27 16:26:12 -08:00
 7: RHJlYW13ZWF2ZXIxe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: Dreamweaver1
    Install date: 2020-12-27 16:26:09 -08:00
 8: SWxsdXN0cmF0b3Ixe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: Illustrator1
    Install date: 2020-12-27 16:26:05 -08:00
 9: SW5Db3B5MXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: InCopy1
    Install date: 2020-12-27 16:26:07 -08:00
10: SW5EZXNpZ24xe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: InDesign1
    Install date: 2020-12-27 16:26:16 -08:00
11: TGlnaHRyb29tQ2xhc3NpYzF7fTIwMTgwNzIwMDQ-...-90.operatingconfig
    App ID: LightroomClassic1
    Install date: 2020-12-27 16:26:13 -08:00
12: TWVkaWFFbmNvZGVyMXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: MediaEncoder1
    Install date: 2020-12-27 16:26:08 -08:00
13: UGhvdG9zaG9wMXt9MjAxODA3MjAwNA-...-90.operatingconfig
    App ID: Photoshop1
    Install date: 2020-12-27 16:26:10 -08:00
14: UHJlbHVkZTF7fTIwMTgwNzIwMDQ-...-90.operatingconfig
    App ID: Prelude1
    Install date: 2020-12-27 16:26:15 -08:00
15: UHJlbWllcmVQcm8xe30yMDE4MDcyMDA0-...-90.operatingconfig
    App ID: PremierePro1
    Install date: 2020-12-27 16:26:14 -08:00

Next, let's look at the information given about an FRL Isolated license. Here we run the toolkit before installing the package, then install the package, then run the toolkit again afterwards. Notice that, since this license doesn't contact a server, its expiration date is built into the package, so the decoder can tell you when the license will expire - this date includes the one-month grace past contract end we always give; it's the date that the apps will actually stop working. Also, notice that this is a single-app license, as revealed by its precedence. Finally, notice that we have specified the -v command-line flag so as to get additional information printed about the license (the Package UUID, the list of census codes for licensed machines, and the IDs of the certificate group in each license).

$ adobe-license-decoder -v isolated-photoshop/
 Preconditioning data for npdId: ZGQzMjhhY2MtZTE2Yy00NTI0LTgzOWItZGRkMDUwNTIzNGU0
     Package UUID: dd328acc-e16c-4524-839b-ddd0505234e4
     License type: FRL Isolated (2 codes)
     License codes: BB7BAC-WXJ2KG-366ZHJ, BBEFWI-B79KPQ-DUIEZI
     License expiry date: 2021-11-04
     Precedence: 80 (CC Single App)
 Application Licenses:
  1: App ID: Bridge1, Certificate Group: 2018072004
  2: App ID: Photoshop1, Certificate Group: 2018072004
$ sudo adobe-licensing-toolkit -p -i -f isolated-photoshop/ngl-preconditioning-data.json 
 Adobe Licensing Toolkit (1.1.0.91)
 Operation Successfully Completed
$ adobe-license-decoder -v
License files for npdId: ZGQzMjhhY2MtZTE2Yy00NTI0LTgzOWItZGRkMDUwNTIzNGU0:
    Package UUID: dd328acc-e16c-4524-839b-ddd0505234e4
    License type: FRL Isolated (2 codes)
    License codes: BB7BAC-WXJ2KG-366ZHJ, BBEFWI-B79KPQ-DUIEZI
    License expiry date: 2021-11-04
    Precedence: 80 (CC Single App)
Filenames (shown with '...' where the npdId appears):
 1: QnJpZGdlMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Bridge1, Certificate Group: 2018072004
    Install date: 2020-12-27 21:01:40 -08:00
 2: UGhvdG9zaG9wMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Photoshop1, Certificate Group: 2018072004
    Install date: 2020-12-27 21:01:39 -08:00

Next, let's look at a run where we have installed a LAN package on top of the Isolated package. (As above, we run the decoder over the package, then we install it, then we run the decoder to see what license files are on the machine.). Because the LAN package and the Isolated package are both single-app packages, their licenses have the same precedence, so where there are two license files for the same application (in this case, Bridge), the LAN package will win because it has the later installation date. It's in situations like these - where customers have installed two different packages on top of each other, that the decoder tool can really come in handy in understanding what's happened and in getting it fixed.

$ adobe-license-decoder lan-illustrator
Preconditioning data for npdId: OTUzZTViZWYtYWJmMy00NGUxLWFjYjUtZmZhN2MyMDY4YjQx
    License type: FRL LAN (server: https://test:123)
    License expiry date: controlled by server
    Precedence: 80 (CC Single App)
Application Licenses:
 1: App ID: Bridge1
 2: App ID: Illustrator1
$ sudo adobe-licensing-toolkit -p -i -f lan-illustrator/ngl-preconditioning-data.json 
Adobe Licensing Toolkit (1.1.0.91)
Operation Successfully Completed
$ adobe-license-decoder
License files for npdId: OTUzZTViZWYtYWJmMy00NGUxLWFjYjUtZmZhN2MyMDY4YjQx:
    License type: FRL LAN (server: https://test:123)
    License expiry date: controlled by server
    Precedence: 80 (CC Single App)
Filenames (shown with '...' where the npdId appears):
 1: QnJpZGdlMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Bridge1
    Install date: 2020-12-27 21:04:14 -08:00
 2: SWxsdXN0cmF0b3Ixe30yMDE4MDcyMDA0-...-80.operatingconfig
    App ID: Illustrator1
    Install date: 2020-12-27 21:04:13 -08:00
License files for npdId: ZGQzMjhhY2MtZTE2Yy00NTI0LTgzOWItZGRkMDUwNTIzNGU0:
    License type: FRL Isolated (2 codes)
    License expiry date: 2021-11-04
    Precedence: 80 (CC Single App)
Filenames (shown with '...' where the npdId appears):
 3: QnJpZGdlMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Bridge1
    Install date: 2020-12-27 21:01:40 -08:00
 4: UGhvdG9zaG9wMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Photoshop1
    Install date: 2020-12-27 21:01:39 -08:00

Finally, let's look at a case where we have installed a Online package that uses an FRL proxy, and let's specify the -vv flag to look for locally cached licenses. As you can see, the Photoshop application has been activated (and its expiration date is listed), but the Bridge application has not. (On Mac, this command will typically pop up a dialog asking for permission to read each license in the login keychain. Specify Always Allow in this dialog to prevent the dialog from appearing again.)

$ adobe-license-decoder -vv
License files for npdId: ODU0YjU5OGQtOTE1Ni00NDZiLWFlZDYtMGQ1ZGM2ZmVhZDBi:
    Package UUID: 854b598d-9156-446b-aed6-0d5dc6fead0b
    License type: FRL Online (server: https://frl-proxy.brotsky.net:8443)
    License expiry date: controlled by server
    Precedence: 80 (CC Single App)
Filenames (shown with '...' where the npdId appears):
 1: QnJpZGdlMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Bridge1, Certificate Group: 2018072004
    Install date: 2021-02-17 22:49:32 -08:00
    No cached activation
 2: UGhvdG9zaG9wMXt9MjAxODA3MjAwNA-...-80.operatingconfig
    App ID: Photoshop1, Certificate Group: 2018072004
    Install date: 2021-02-17 22:49:31 -08:00
    Cached activation expires: 2021-10-05

Support

This tool is maintained by the Adobe DME Premium Onboarding team. If you need support or just have questions about the adobe-license-decoder, please file an issue against this project.

Contributing

Contributions are welcomed! Read the Contributing Guide for more information.

License

This project is licensed under the MIT License. See LICENSE for more information.

adobe-license-decoder.rs's Issues

Unable to check license on SDL packages

Describe the bug
I've run the tool on both an SDL, license-only package, and on a package with both Photoshop with the SDL and the too doesn't seem to be able to detect the license inside. When the package/s are deployed to a device, the tool detects the install licenses fine.

To Reproduce
Steps to reproduce the behavior:
SDL-only package:

1. Create a package from the Adobe Admin web console with Shared Device Licensing chosen, but no other applications
2. Download the Adobe Downloader App, use this to download the zipped package/s
3. Unzip the packages
4. Run the adobe-license-decoder on the parent directory, build directory or the package itself, e.g.:
5. ./adobe-license-decoder /Users/darren/Downloads/Photoshop-SDL-Test/
6. ./adobe-license-decoder /Users/darren/Downloads/Photoshop-SDL-Test/Build/
7. ./adobe-license-decoder /Users/darren/Downloads/Photoshop-SDL-Test/Build/SDL-Test_Install.pkg
8. Output:

thread 'main' panicked at 'No license files found in '/Users/darren/Downloads/SDL-Test/Build/SDL-Test_Install.pkg'', src/descriptions.rs:29:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

SDL and application package:

1. Repeat the above, but for step 1, also select the latest version of Photoshop
2. Rest of the testing and output is the same.

Observed behavior
Output shows the binary is unable to find a license:

thread 'main' panicked at 'No license files found in '/Users/darren/Downloads/SDL-Test/Build/SDL-Test_Install.pkg'', src/descriptions.rs:29:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Expected behavior
Command line output as shown on the project readme

Operating System
macOS Big Sur (11.2.2)

Additional context
I'm unsure if I'm holding it wrong, but please let me know if so!
Thanks

Show local activations for FRL apps (with expiration dates)

Why do you need this feature? Please describe.
Customers often want to know whether a particular user has a cached license for an app, and when it will expire. This is especially helpful for FRL Online and LAN licenses where the expiration date is set on the server side so the only local expiration data is in the cached license

Describe the solution you'd like
When run in verbose mode, the decoder should look for cached licenses in the credential store and report on their existence and expiration date. This needs to be invoked explicitly with -v or another option, because it prevents the decoder from being run without interaction.

Additional context
This request came in via Slack from an SE working with customers.

Package UUID in output does not match PACKAGE ID field in Admin Console

Describe the bug
Creating a license package on the Adobe Admin Console and deploying it, then running the Adobe License Decoder, it was noted that the ID did not match in the output with that shown for the package on the Admin Console

To Reproduce
Steps to reproduce the behavior:

1. Create a package on the Adobe Admin Console which is licensed via FRL
2. Deploy the package or apply the license (in the case of a license-only package) using the licensing toolkit: adobe-licensing-toolkit.exe -p -i -f ngl-preconditioning-data.json
3. download the latest Adobe License Decoder and execute it with the maximum verbosity option: adobe-license-decoder.windows_x86_64.exe -vv
4. Observe the line in the output described as "Package UUID" and compare with the field in the package details on the Admin Console named "PACKAGE ID".

Security note: do not attach license files.

Observed behavior
The ID in the Adobe License Decoder output does not match that of the corresponding package shown in the Admin Console, although both values appear to be the same format of 8, 4, 4, 4 and 12 alphanumerics separated by dashes in both instances.

Expected behavior
The IDs should match to allow an installed license to be matched to an Admin Console package and/or org ID.

Operating System

• Tested on Windows
• OS version Windows 10 20H2

Additional context
Add any other context about the problem here.

Distinguish Offline from Isolated packages

Why do you need this feature? Please describe.
I need to know whether my machine's licenses are Offline or Isolated. If they are Isolated, I would like to know how many different census codes are in the license. (Ideally, I'd like to be able to see the list of codes.). That way I can know which machines the ilcense can work on.

Describe the solution you'd like
The basic output should specify whether the license is Isolated or Offline, and give the number of census codes. In addition, there should be an option to output all the census codes.

Apple Silicon Support

Why do you need this feature? Please describe.
With Apple releasing devices running their own chips instead of Intel, and the unknown time that the Rosetta 2 translation layer will work, any software or tools written for macOS would have version run natively on arm64 devices, or ideally universal binaries. From what I understand, the ALD may be Intel only, requiring the installation of Rosetta 2 to be used on these newer devices.

Describe the solution you'd like
Any software or tools written for macOS would have version run natively on arm64 devices, or ideally universal binaries.

Describe alternatives you've considered
N/A

Additional context
I may be wrong here but it looks like ADL is intel only. I'm not a 'proper' developer so I'm not sure on the exact steps this project will need in order to be universal, but I thought it worth putting this on your radar 😊

Look at Windows registry for Acrobat licensing info

Why do you need this feature? Please describe.

On Windows, there are a pair of registry keys that enforce either NGL (next-gen licensing) or serialized licensing. We should add hooks to these keys in the decoder. I'm not sure if it makes sense to add the ability to manipulate these keys, but we should at least check for the presence of these keys in the registry and report their status.

Describe the solution you'd like

TBD - I assume for reporting we would include it with the rest of the license reports, but it could make more sense to implement a subcommand or something similar.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context about the feature request here.

I want to check the expiration date of SDL

This is a very useful tool. Thank you.
Please tell me how to use this tool.

I installed SDL on my PC.
The following command will tell you the installation date and time of the installed product.

adobe-license-decoder.windows_x86_64.exe

For FRL, you can find the expiration date with "-vv" as an option.
Is there a way in SDL to check for such an expiration date?

I'm sorry if the posting location is wrong.

Clearer error message when no Adobe Apps are installed

Why do you need this feature? Please describe.
When running the binary on a version of macOS without an OperatingConfigs file/directory, this shows the below error:

thread 'main' panicked at 'No such file or directory (os error 2): /Library/Application Support/Adobe/OperatingConfigs', src/main.rs:24:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Describe the solution you'd like
Instead it would be nice if it could return a clearer output, perhaps something like:

Error: Item not found at /Library/Application Support/Adobe/OperatingConfigs
Confirm device has an Adobe application and licenese installed 

Describe alternatives you've considered
N/A

Additional context
I fully appreciate that the onus is on the administrator to understand the output and it may not make sense to run this on devices without an Adobe application installed, but there is a possibility of using this tool within a reporting solution and a nicer output would be cool 😊

Thanks again for this!

Cached activation data must match package ID and license type

Describe the bug
When invoked with -vv, the decoder will report a cached activation against a package whose package ID doesn't match that package. Additionally, only FRL online licenses are reported, even if other types have a cached license.

Package mismatch
Steps to reproduce the behavior:

1. install package P1 for Photoshop
2. activate Photoshop against that package
3. run adobe-license-decoder -vv and see the cached license expiration date
4. deactivate the package with adobe-licensing-toolkit -t -n P1 and then remove the installed operatingconfig. (NOTE: This will not remove the cached activation.)
5. install package P2 for Photoshop
6. run adobe-license-decoder -vv

Observed behavior
The decoder will report one installed license with a cached activation.

Expected behavior
The decoder should notice that the installed package has a different ID than the cached license and so it should not report the cache license against that data.

Additional context
If you deactivate but do not remove package P1, then the cached license should be reported against P1 but not P2.

Unreported cache entries
Steps to reproduce the behavior:

1. Install an FRL Isolated license package.
2. Launch a licensed app to activate the package.
3. run adobe-license-decoder -vv

Observed behavior
The decoder will not report the cached license.

Expected behavior
The decoder will report the cached license.

Operating System

• Mac
• Big Sur (11.1.2)