Skip to main content

​
After this article

You will be able to connect Adobe Acrobat Sign to Lumos to sync users, groups, and roles, and to provision that access from Lumos.

​
Capabilities

Provisioning behavior:
  • Create: Lumos creates the user via POST /users. Email, first name, and last name are all required.
  • Assign or remove a role: only the ADMIN role can be assigned or removed. Lumos updates the user’s admin flag via PUT /users/{user_id}. The MEMBER role can’t be assigned or removed, since it’s the baseline every user has.
  • Assign or remove a group: Lumos sets the group membership to ACTIVE or DELETED via PUT /users/{user_id}/groups. A user’s primary group can’t be removed, because every user needs at least one. Change the primary group in the Adobe Acrobat Sign dashboard first.
  • Activate: sets the user’s status back to ACTIVE.
  • Deactivate: account admins can’t be deactivated. Remove the ADMIN role first, then deactivate.
Activity tracking is supported. Lumos reads the /users/{user_id}/events endpoint to record when a user last logged into Adobe Acrobat Sign.

​
Required plan and roles

  • Adobe Acrobat Sign role: you need access to the Adobe Acrobat Sign account admin area to create an API application and read the account settings.
  • OAuth scopes: the integration authenticates with OAuth. Enable the user_read and user_write scopes with the account modifier when you configure the app.
    • user_read:account syncs user information into Lumos.
    • user_write:account covers all provisioning: creating users, activating and deactivating them, and managing group and role access. Leave it out if you want a read-only connection.
    • user_login:account syncs extra information about the user.

​
Read-only access vs provisioning

Is read-only possible? Yes. The OAuth application controls read and write through separate scopes, and leaving out the write scope provides a read-only connection. What read-only requires. An OAuth application configured with only the user_read:account scope (add user_login:account if you also want login activity synced). Follow the steps below, and when you reach the scope step in Phase 1, enable only user_read with the account modifier. What full provisioning requires. The same OAuth application with the user_write:account scope also enabled, which lets Lumos create users, activate and deactivate them, and manage group and role membership. Watch out for. Adding or removing the user_write scope means editing the existing OAuth application in Adobe Acrobat Sign (Phase 1, step 6, Configure OAuth for Application) and reconnecting, not creating a new one. Deactivation is the only deprovisioning action, account deletion is not supported.

​
Instructions

Phase 1: Create an OAuth application in Adobe Acrobat Sign
  1. Log in to your Adobe Acrobat Sign account.
  2. From the Home page, open the API page using the top navigation menu.
  3. In the API Application section, click the + button to create a new application.
  4. Fill in the Name and Display Name fields.
  5. Select the CUSTOMER domain and save.
  6. Click your new application and choose Configure OAuth for Application.
  7. Set the redirect URL to https://app.lumosidentity.com/integrations/ics_oauth2_callback.
  8. Enable the user_read and user_write scopes with the account modifier, then save.
  9. Click the application again, select View / Edit, and copy the Application (Client) ID and Client Secret. You can return and edit the application later if you need to fix a step.
Phase 2: Gather your Account ID, Domain, and Shard
  1. From the Home page, open the Account page using the top navigation menu. Your Account ID is in the Global Settings section.
  2. Note your Adobe Domain, either the legacy echosign.com or the newer adobesign.com.
  3. Note your URL Shard, the regional subdomain segment in your account URL. For https://secure.na1.adobesign.com, the shard is na1.
Phase 3: Connect in Lumos
  1. Click the Adobe Acrobat Sign card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Paste the Client ID, Client Secret, Account ID, Adobe Domain, and URL Shard into their fields.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. Recheck the redirect URL (https://app.lumosidentity.com/integrations/ics_oauth2_callback), confirm the user_read and user_write scopes are enabled with the account modifier, and verify the Account ID, Domain, and Shard match your account. You can reopen the API application in Adobe Acrobat Sign and correct any of these. Provisioning actions fail on a read-only connection. The user_write:account scope is required to create, activate, and deactivate users and to manage groups and roles. Add it to the OAuth app and reconnect. Deactivating a user fails. Account admins can’t be deactivated. Remove the user’s ADMIN role first, then retry the deactivation. Removing a group fails. The group is the user’s primary group, which can’t be removed. Change the user’s primary group in the Adobe Acrobat Sign dashboard, then retry.