Handling of Floating Licenses (borrow / renewal intervals, ...)

[TrinityTonic]

We are using FNE (C-SDK) and FNO with node-locked licenses and do offline provisionning of the licenses on our devices. As a new product of ours will most likely run inside a virtualized enviroment we are thinking about extending our licensing capabilities to support floating licenses. We will most probably implement FlexNet's license server within a local network or reachable from the internet. However we wanted to clarify a few topics, thus my questions.

Can an FNE - enabled device work with both node-locked licenses and floating licenses in parallel?

Assuming we have a node-locked license with activation ID XXX that allows to run some app of ours. Can we use the same license with the same activation ID XXX for the floating use-case as well? Or will we need two licenses per application, the node-locked one with activation ID XXX and the floating licenses with activation ID YYY?

Do floating licenses get node-locked once they are provisionned on the client? Does the capability response contain the host id of the client the license will be node-locked to?

We currently have licenses with specific entitlement and activation ids available inside FNO. I would like to understand the fundamental difference in creating floating licenses that can be retrieved from the license server - not beyond a maximum quantity (counted license?).

Furthermore I read about the concept of the borrow and renewal interval. These values will be availble to the client when the capability response is parsed. Who is responsible to act according to these values? Is there any code / callbacks automatically called on the client when these times are reached or does the client need to implement own handling in case the renewal / borrow intervals are reached? If so, what would the client need to do once the borrow / renewal times have been reached? Is it possible to call any specific API functions to renew a license - however not by return + new acquisition but by other means without returning it?

What should happen when borrow and renewal intervals have passed and the license server is not reachable for renewal. Is that completely on the client to decide?

Do you have any documentation that describes how to implement floating / network licenses in more detail. Is there any reference you could recommend here (guides, etc.)? 

[jberthold]

Hi @TrinityTonic ,

Responses to your questions below ...

Can an FNE - enabled device work with both node-locked licenses and floating licenses in parallel?

• FlexNet Embedded (FNE) is a regenerative or replacement license technology.  When a client activates a nodelocked license with FlexNet Operations (FNO) using an Activation ID, the license features for the entitled Product are returned to the client and placed in Trusted Storage.  If the client then requests and receives license features from a local or Cloud FNE Server, the existing licenses in Trusted Storage will be overwritten/replaced.
• With that said there is way to manage multiple trusted storage segments, each containing license rights from separate sources.  Please refer to the section “Advanced Topic: Multiple-Source Regenerative Licensing” in the FNE XT User Guides.

Assuming we have a node-locked license with activation ID XXX that allows to run some app of ours. Can we use the same license with the same activation ID XXX for the floating use-case as well? Or will we need two licenses per application, the node-locked one with activation ID XXX and the floating licenses with activation ID YYY?

• Yes, you can activate a counted license with Activation ID XXX on either a device or an FNE License server.

Do floating licenses get node-locked once they are provisioned on the client? Does the capability response contain the host id of the client the license will be node-locked to?

• Yes to both.  When a client requests a license from an FNE Server, the capability response returned by the server contains the client host id and is placed into Trusted Storage on the client.

We currently have licenses with specific entitlement and activation ids available inside FNO. I would like to understand the fundamental difference in creating floating licenses that can be retrieved from the license server - not beyond a maximum quantity (counted license?).

• For floating license use on a license server you want to ensure you are using a counted license model so the server can enforce the entitled quantity.

Furthermore I read about the concept of the borrow and renewal interval. These values will be available to the client when the capability response is parsed. Who is responsible to act according to these values? Is there any code / callbacks automatically called on the client when these times are reached or does the client need to implement own handling in case the renewal / borrow intervals are reached?

• If available on the server, licenses will automatically be returned to the client with an expiration equal to the default borrow interval defined in the license model (or the borrow interval requested by the client, whichever is less).  It is you (the software producer) who is responsible to read the renewal interval returned in the capability response to determine when the client will next refresh it’s served licenses.  There are no automatic callbacks to make this happen.  

If so, what would the client need to do once the borrow / renewal times have been reached? Is it possible to call any specific API functions to renew a license - however not by return + new acquisition but by other means without returning it?

• The client sends a capability request to the server for the desired features.  It is the same action whether it is requesting licenses that have expired or renewing existing licenses.  Alternatively, if the client currently has existing served license features that have not expired it can perform an incremental capability request without specifying any features.   An incremental request without specifying any features will return all features the client has in use with a new borrow interval.

What should happen when borrow and renewal intervals have passed and the license server is not reachable for renewal. Is that completely on the client to decide?

• Yes

Do you have any documentation that describes how to implement floating / network licenses in more detail. Is there any reference you could recommend here (guides, etc.)? 

• The XT kit User Guides and License Server Guides are the best bet.

Thanks,

Jim

[TrinityTonic]

Thank you @jberthold for the detailed answer!

A few more quesitons came up while setting up a prototype for the floating license use case.

What would a license model in FNO look like in case we wanted it to support floating licenses that can be concurrently used up to a maximum count and to be used within FlexNet Embedded. Could you ellaborate the settings in regard to "embedded", "counted", "sharable", "unlimited checkouts" and "activatable" (see picture for example setting)?

The client / license server / FNO setup requires certain identity files that can be created with the provided tool (pubidutil) or within FNO. From the documentation I saw that the publisher and client server (license server) identity files contain sensitive information. Do we need the client server (license server) identity - especially the private key contained herein - during operation of the license server, e.g. to generate valid capability responses? If that's the case we would have to take extra measures to protect the client server identity especially when considering that is directly derived from our master (publisher identity) key and shipped to / provided to customers.

I see that the provided java-based license server comes with a rich feature set of functionality, REST API and administration / helper tools. The C-based server example however contains a bare metal example of a license server that can process capability requests and generates capability responses. Do we understand it correctly that - if we went for the C-based license server - we would have to implement a good portion of the server functionality, REST API and administration / helper tools ourselves which would require a good understanding of the functionality offered by the C SDK? Is that the only way to  be able to use the same license server base code both on a dedicated hardware product used within the customer's network and as an internet facing license server hosted in our cloud while not using java?

What's the fundamental difference or advantage - if any - in using the CLS hosted by Revenera and using a LLS hosted on our cloud and reachable by devices over the internet.

There is the possibility to enable incoming HTTPS for tls-secured communication between clients and the license server. What's best practices for authorization on the license server, especially if it's internet faced? We understand that on a C-based license server we would need to implement the user authorization ourselves. Does the FlexNet java-based library implement custom user management or can it be attached to the underlying os's user management? 

[jberthold]

Hi @TrinityTonic 

I'll provide some brief responses here, however you may want to contact your sales representative to coordinate time with our professional services organization who can guide you through implementation best practices. 

For a FlexNet Embedded floating license model on a Local License Server the primary license model attributes are shown below (Embedded, Counted, Not Metered):

There is a Getting Started Video available on the Learning Center for Cloud License Servers here:  https://learning.revenera.com/cloud-licensing-with-flexnet-operations-and-flexnet-embedded/383860

You don't provide the identity files when providing the local license server to your customers.  You provide them with a producer-settings.xml file which gets created from your Client-Server Identity.  The server will handle authentication for clients requesting licenses from your licensed application.

I would only recommend use of the Java-based FlexNet Embedded License Server (Cloud/Local).  The C-based "Server Application" was replaced by the Java-based server in 2013.

For internet-connected clients the CLS would be advantageous over a cloud-hosted Local License Server.  Its HTTPS  communication by default, can be automatically provisioned following the entitlement creation and has built-in failover. 

Thanks,
Jim

[TrinityTonic]

Thank you Jim - things have become alot clearer now. However I got one last question here regarding authentication. 

How can we make sure that only entitled clients can upload a capability request to and retrieve a capability response from the license server?  As far as I understand, these operations (binary exchanges between license server and clients, etc.) are exempt from security thus no credentials are ever needed to perform these operations.

If that was the case - could  ANY client that knows the URL of the CLS (device registration excluded) ask for a valid license? How can we ensure that only certain devices can request a license from a license server?

[jberthold]

Hi @TrinityTonic ,

Device registration can be enabled to only allow feature requests to Cloud License Servers from registered devices.  Please refer to the following video in the learning center for further details:  https://learning.revenera.com/cloud-licensing-with-flexnet-operations-and-flexnet-embedded/601720 

Thanks,

Jim