Flexera One Customer Action -   Safelist Update in North America In order to support the proper functioning of Flexera One, we ask that Flexera One North American customers update URLs and endpoints from their environments to the trusted sites of the browsers they are using with Flexera One. An engineering update to the Organization and User Privileges endpoints will occur on April 7th, at 1pm UTC time zone. (NOTE: This is in 2 weeks) Please ensure your IT administrators are aware and have the following safe listed for this timeline. REQUIRED: This is required for all North American users. The base endpoint for organizations, users, and privileges information including users, groups, and accounts in the Administration section should include the revised endpoints listed below. Organization/User Privileges North American users now require: global-services-lb0.rightscale.com grs-front.iam-us-east-1.flexeraeng.com acl-front.iam-us-east-1.flexeraeng.com This is also documented on Flexera One Safelist page here:   https://docs.flexera.com/flexera/EN/Common/safelist.htm ... View more

Summary This document provides alternative ways to configure the Flexera Analytics Cognos server to mitigate security vulnerabilities caused by Apache Log4j.  Apache Log4j is used by IBM Cognos Analytics as part of its logging infrastructure.  These fixes address the exposure to the Apache Log4j vulnerabilities: CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832.   Note: The configuration change is applicable to FlexNet Manager Suite on-premises versions from 2017 R2 to 2021 R1 (which included Cognos Analytics versions 11.0.6 – 11.0.13). Method Broadly speaking, you may choose any one of these three ways to remove the security vulnerabilities: Run-time patch: This approach uses a file sourced from IBM to modify the behavior of Cognos Analytics, mitigating the Apache Log4j vulnerability without requiring any upgrade to Flexera Analytics (powered by Cognos). The log4jSafeAgent file provided for Cognos Analytics modifies the class byte code at Java startup time. It disables the vulnerable JndiLookup class, and enforces the StrSubstitutor recursion limit, without altering the installed product. If you choose this option, see Downloading the resources and 1. Run-time patch to Analytics (Cognos) Server below for step-by-step instructions. Removal/Replacement: Two options for removal or replacement of the JndiLookup class have been proposed by IBM. The original advice from IBM (for removal) was made available to our Flexera Community customers in https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/Flexera-Analytics-Cognos-mitigation-for-Apache-Log4j-2/ta-p/217655. If you wish to follow the removal path, please refer to that article for instructions.  Since then, IBM has released a patch that replaces the JndiLookup class with updated code that does not include the vulnerability. Replacement is achieved by running a provided installation patch on your existing Cognos server within your FlexNet Manager Suite implementation. If you choose this path, see Downloading the resources and 2. Replacing the JndiLookup file below for step-by-step instructions. Reinstallation: This approach is more thorough-going, in that it replaces the entire installation of Flexera Analytics (powered by Cognos). This includes running the Flexera installation script in PowerShell, where the script installs an updated version of Log4j that removes the vulnerability. If you choose this path, see Downloading the resources and 3. Reinstalling Flexera Analytics below. In that set of step-by-step instructions, you may also choose either of the following fully-tested scenarios: Remove and replace: This follows the standard upgrade path of removing the previous installation and installing the patched version of IBM Cognos. Over-the-top installation: This is a slightly simplified approach where you leave the current installation untouched, and run the installer to replace it. Choose the approach that best aligns with your security policies and practices. Next, collect the necessary resources. Downloading the resources All files required for any of the above approaches are included in one zip archive available from the Product and License Center. Follow these steps to secure the materials you need. To download the resource file for log4j mitigation of Flexera Analytics: In your preferred web browser, on your Flexera Analytics server (or a convenient alternative), navigate to the Flexera Product and License Center (available through the Product Access drop-down in the top right corner of the Flexera Community web page). Tip: Log in with your Flexera Community account is required. Locate and download Flexera Analytics (Cognos) Log4j mitigation update.zip, saving to a working folder such as C:\temp\Log4jFix. Unzip the archive to reveal the three folders inside: 1 Run-time patch 2 Replace JndiLookup 3 Reinstall Flexera Analytics Each of the following approaches uses the resources within the matching folder. You may ignore folders that do not match your chosen approach. Now step forward to the approach you have selected from the introduction to Method. Each approach assumes that you are logged into your Cognos server using an account with administrator privileges. 1. Run-time patch to Analytics (Cognos) Server  This approach installs the log4jSafeAgent file (provided by IBM) that modifies the class byte code at Java startup time. It disables the vulnerable JndiLookup class, and enforces the StrSubstitutor recursion limit, without altering the installed product. To install the Analytics (Cognos) Server run-time patch: Launch the IBM Cognos Configuration tool as an administrator, and stop the Cognos service if it is running. Navigate to the Cognos installation directory. Note: This is typically located in  C:\ProgramFiles\ibm\cognos\analytics .  Your path is identified as “install-path” through this process. Take a backup of the files that need to be modified in this procedure: install-path\bin64\bootstrap_wlp_os_version.xml install-path\configuration\xqe.config.custom.xml. In your downloaded and unzipped archive, navigate into the 1 Run-time patch folder. From this folder, copy the log4jSafeAgent2021.jar file, and save the copy to the folder  install-path\webapps\p2pd\WEB-INF\lib. Navigate to the install-path\bin64 folder, and in your preferred plain text editor, open the bootstrap_wlp_os_version.xml file. In the <start> section of the file only, add a new javaagent parameter that refers to the log4jSafeAgent2021.jar file. You may copy the sample code shown below this process, and be sure to replace three instances of {install-path} with the installation path on your system. Navigate to the install-path\configuration folder: If there is no xqe.config.custom.xml file present, save a copy of the xqe.config.xml as xqe.config.custom.xml in the configuration folder. In your preferred plain text editor, edit the xqe.config.custom.xml file to specify the javaagent parameter that refers to the log4jSafeAgent2021.jar file in the IBM Java Runtime Environment (JRE), as follows (some line wrapping has been applied here): <vendor name="IBM Corporation" options="-Xscmx100m -Xshareclasses:cachedir=     ../javasharedresources^name=cognos10%u^nonfatal -Xmso512K -XX:+HeapManagementMXBeanCompatibility -Xjit:dontInline={gnu/trove/*}^{gnu/trove/*}     (disableLoopVersioner) -Dcom.ibm.jsse2.overrideDefaultTLS=true -javaagent:../webapps/p2pd/WEB-INF/lib/log4jSafeAgent2021.jar" compressedrefs="-Xcompressedrefs" max="27000"/> Save the modified file, and restart the Cognos service. Verify that the mitigation process worked: From the install-path/logs directory, open the p2pd_messages.log file. Search for the following two entries. If these two entries are logged, the patch is applied and bootstrap_wlp_os_version.xml is configured correctly: SystemOut O Modified class org.apache.logging.log4j.core.lookup.JndiLookup to empty method lookup Note: This entry applies to CVE-2021-44228 and CVE-2021-45046. SystemOut O Modified class org.apache.logging.log4j.core.lookup.StrSubstitutor to check currentRecursionCount Note: This entry applies to CVE-2021-44832 and CVE-2021-45105. From the install-path/logs directory, open the dq_messages.log file, and search for the following two entries. If these entries are logged, the patch is applied and the xqe.config.custom.xml is configured correctly: SystemOut O Modified class org.apache.logging.log4j.core.lookup.JndiLookup to empty method lookup Note: This entry applies to CVE-2021-44228 and CVE-2021-45046. SystemOut O Modified class org.apache.logging.log4j.core.lookup.StrSubstitutor to check currentRecursionCount Note: This entry applies to CVE-2021-44832 and CVE-2021-45105. If the log files don't show the expected entries, use the following steps to verify the process: From the Windows Start menu, run PowerShell as administrator. Run the following command (all on one line): wmic path win32_process get commandline | findstr "log4jSafeAgent2021" For the Analytics (Cognos) server, two processes should be returned. Each process must include one of the following entries: -javaagent:install_path/webapps/p2pd/WEB-INF/lib/log4jSafeAgent2021.jar -javaagent:../webapps/p2pd/WEB-INF/lib/log4jSafeAgent2021.jar   Here is the sample code for step 7 in the above process. Important: Ensure that the new javaagent parameter is added within the <start> section of the file only, and not anywhere else in the file. Otherwise, the process will not be successful even if the verification step (10 b) returns the expected entry.   <start>........ <param>"-javaagent:${install-path}/webapps/p2pd/WEB-INF/lib/log4jSafeAgent2021.jar"</param> <param>"-javaagent:${install-path}/wlp/bin/tools/ws-javaagent.jar"</param> <param>-jar</param> <param>"${install-path}/wlp/bin/tools/ws-server.jar"</param> <param>cognosserver</param> </spawn> </start>     2. Replace the JndiLookup file  This approach removes the affected contents of the JndiLookup file by running a downloaded installation patch on your existing Cognos server within your FlexNet Manager Suite implementation. To install the IBM Cognos Server patch that replaces the JndiLookup file: Launch the IBM Cognos Configuration tool as an administrator, and stop the Cognos service if it is running. Navigate to the Cognos installation directory. Note: This is typically located in C:\ProgramFiles\ibm\cognos\analytics. Your path is identified as “install-path” through this process. In a separate directory, make a backup copy of the Cognos installation folder, and name it as cognos_backup. In SQL Server, make a backup copy of the Content Store database. Without restarting the Cognos service, close the IBM Cognos Configuration tool. Important! Do not reopen the IBM Cognos Configuration tool until instructed to do so. In your downloaded and unzipped archive (from Downloading the resources), navigate into the 2 Replace JndiLookup folder. Copy and replace the preserve.txt file under your Cognos installation directory, by default: C:\Program Files\ibm\cognos\analytics\configuration\preserve Also from your 2 Replace JndiLookup folder, extract the ca_srv-11.0.13-2201052300-winx64h.zip file to a convenient working directory, and identify the following three components: A lightweight installer (.exe) A server repository (.zip) somewhat confusingly with the same name An executable batch file (.bat) used to begin the installation process. Run the ca_srv_win64_11.0.13.2201052300.bat file as an administrator. The .bat file runs the installer, upgrading your existing Analytics environment by installing Cognos 11.0.13 over the top. A GUI interface to install IBM Cognos Analytics launches. Click Next to proceed with the installation. Ensure that the installation location is the same as the previous installation. This will overwrite files in the existing installation directory. Click Install to install the application. Note: A message may pop up indicating some folders are in use. Ensure that the Cognos Configuration tool is still closed. Click OK to continue the installation. Once the upgrade is complete, click Done. Navigate to the following Cognos installation directory and launch the Cognos Configuration tool (if you have used a custom installation path, adjust as required): C:\ProgramFiles\ibm\cognos\analytics\bin64\cogconfig.exe Restart Cognos services. Click Yes to save the configuration when prompted. 3. Reinstalling Flexera Analytics This process includes the steps both for a complete reinstallation, and also for a simplified, over-the-top installation.  To complete this process, you must use an account on your Flexera Analytics server that has administrator permissions (to install a service). Remember: The Flexera Analytics server must be accessible by its host name, rather than just its IP address. Do not use IP addresses anywhere in the Flexera Analytics settings. This article assumes that you are reinstalling on an existing system, such that you already have: Your chosen web server, correctly configured The SQL Server login account, which does not contain any of the greater-than, less-than, or ampersand characters (< > &) Microsoft® SQL Server® 2012 Native Client installed on the host server (where this is separate from the Cognos database server) The C:\FNMSCognosAnalytics\Support directory on the Flexera Analytics server Up-to-date license terms for Flexera Analytics. To reinstall Flexera Analytics:  Best practice is to take a full backup of your existing Flexera Analytics content store database and save it securely. (If there are any database problems in your upgrade, you can restore this protective copy to recover.) Stop the IBM Cognos service, and ensure that the IBM Cognos Configuration program is not running. From the downloaded and unzipped archive (from Downloading the resources), navigate into the 3 Reinstall Flexera Analytics folder. From this folder, copy the following files into your C:\FNMSCognosAnalytics\Support folder (if prompted that existing files will be overwritten, accept this, as the replacements are required): analytics-installer-1.2.2-win ca_srv_11.0.13-2201052300-winx64h.zip InstallCognos.ps1 CognosFlipperConfig.psm1 ConfigureCognos.psm1 CognosIISConfig.template.xml CognosConfigProperties.xml Tip: The installation script automatically handles extracting the contents of the archive at b.; and the executable that is extracted automatically installs 32-bit software on 32-bit systems, and 64-bit software on 64-bit operating systems. Locate your copy of CognosConfigProperties.xml from your previous installation. (Typically, this is in the C:\FNMSCognosAnalytics\Support folder; but it may be stored elsewhere if it contains plain-text passwords.)  This already contains all the required properties configured for your implementation. If required, you may review in Notepad, or your preferred text editor.  If you need guidance on the properties, refer back to your Installation Guide, available through docs.flexera.com for your installed release. Prepare to run the PowerShell script: Open a PowerShell command-line window with administrator privileges. If you have not done so already, set the PowerShell permissions with the following command: set-ExecutionPolicy AllSigned -Force Respond to the warning text with the default Y. For an over-the-top installation of Cognos Analytics version 11.0.13: In your PowerShell window, navigate to the Cognos installation directory. Tip: The typical path is C:\ProgramFiles\ibm\cognos\analytics. In a separate directory, make a backup copy of the Cognos installation folder, and name it cognos_backup. Run the following command in the PowerShell window: .\InstallCognos.ps1 This script updates the build containing the log4j mitigation. (Skip the next step for a complete installation.) For a complete upgrade: Optionally, uninstall Cognos from your Cognos server. In your PowerShell window, navigate to the directory where you copied the support directory. For example: C:\FNMSCognosAnalytics\Support Run the following command in the PowerShell window: .\InstallCognos.ps1 A dialog box opens, prompting you to run the installer. Click Run to proceed with the installation. Tip: Installation in either process may take some time to complete. After updating the configuration, the PowerShell script restarts the IBM Cognos service. If the script reports any difficulties restarting the service, it may be because of environmental issues, such as memory pressure. In this case, it is not necessary to run the PowerShell script again: you can try restarting the IBM Cognos service manually in Windows Service Manager. Navigate to the root install-path of the Cognos Analytics installation directory and open the cmplst.txt file in a text editor. Verify that the kit_version has changed to 11.0.13.2201052300. Confirm that you are able to access Flexera Analytics with FlexNet Manager Suite. ... View more

Introduction This article is for anyone who uses FlexNet Manager Suite to inventory Citrix XenApp and/or XenDesktop. Note that Citrix has re-branded these from Citrix XenApp to Citrix Virtual Apps, and from Citrix XenDesktop to Citrix Virtual Apps and Desktop. However, for the sake of matching the current FlexNet Manager Suite user interface terminology, this article retains the XenApp/XenDesktop terminology.  The article applies to FlexNet Manager Suite cloud implementations and on-premises implementations. And it is designed to help you properly set up FlexNet Manager Suite in order to inventory XenApp and/or XenDesktop. Most questions relating to XenApp or XenDesktop evidence recognition within FlexNet Manager Suite will most likely be answered or resolved by properly configuring FlexNet Manager Suite so that it can correctly inventory XenApp or XenDesktop within your organization. One of the most basic questions some users have is, what is the difference between XenApp and XenDesktop? The easiest answer is this: if you just want to use an individual application and nothing more, XenApp is the choice. Conversely, XenDesktop lets users access physical machines (and have access to all applications on that machine) from anywhere. You just login to the Citrix from your device in either case. Related Information For more information, refer to the “XenApp Server Adapter” chapter of the FlexNet Manager Suite Inventory Adapters and Connectors Reference PDF, available on HelpNet. Also see the “Discovery and Inventory Rules” topic within the online help. How to Inventory Citrix XenDesktop and XenApp using FlexNet Manager Suite Delivery of XenDesktop is backed by machines, physical or virtual, that exist in a data center. End users remotely log into one of these machines and have access to all applications on that machine. Delivery of XenApp is through applications installed on machines that exist somewhere in a data center. When users launch an application, a session on these machines is launched, and the application is then delivered to the client device and users can use it just as if the app were installed on their own machine. Users can launch multiple applications assigned to them but do not always have access to all the applications installed on the machine. Quick Steps This section provides quick steps about how to configure FlexNet Manager Suite to inventory XenDesktop and XenApp. Most of the steps include a hyperlink to a section providing more details.   Important! These steps are not required as long as you are collecting inventory from the machines. FlexNet Manager Suite needs to receive inventory data, but the mechanism itself is not important. With respect to inventory of the Citrix servers "serving up" the applications, FlexNet Inventory, SCCM, and ADDM are the most common. These steps provide one way to collect the inventory.  Note: If you only need to inventory XenDesktop (and not XenApp), perform steps 1 through 3. If you need to inventory XenApp only or both XenDesktop and XenApp, perform steps 1 through 4. To configure FlexNet Manager Suite to inventory XenDesktop and XenApp: Create a discovery and inventory rule to inventory XenDesktop. Import all Active Directory data. This import provides FlexNet Manager Suite with AD group GUIDs that provide a mapping of users assigned to each AD group. Create a discovery and inventory rule to inventory all delivery groups. For XenApp inventory collection only—In addition to completing the previous three steps, you must also do the following to collect XenApp inventory: Create the staging database. For more information, refer to the “Creating the Staging Database” section of the “XenApp Server Adapter” chapter in the FlexNet Manager Suite Inventory Adapters and Connectors Reference PDF, available on HelpNet. Install XenAppAgent and define its schedule. Note: The XenAppAgent was released in 2019 R1.3 for cloud implementations and will be released in FlexNet Manager Suite 2019 R2 for on-premises implementations. For more information, refer to the “Installing the XenApp Server Agent” section of the “XenApp Server Adapter” chapter in the FlexNet Manager Suite Inventory Adapters and Connectors Reference PDF, available on HelpNet. Also see XenAppAgent Information in this document. Create a scheduled task. For more information, refer to the “Installing the XenApp Server Agent” section of the “XenApp Server Adapter” chapter in the FlexNet Manager Suite Inventory Adapters and Connectors Reference PDF, available on HelpNet. Connect the XenApp Server connector to the staging database. This will send XenApp inventory data to FlexNet Manager Suite. For more information, refer to the “Create Connections for Data Upload” section of the “XenApp Server Adapter” chapter in the FlexNet Manager Suite Inventory Adapters and Connectors Reference PDF, available on HelpNet. Important! Keep in mind that FlexNet Manager Suite’s discovery and inventory rules are static, so when something changes within your Citrix server farm, you must update the corresponding discovery and inventory rules within FlexNet Manager Suite in order to keep your XenApp or XenDesktop evidence recognition accurate.  Also keep in mind that in order for the Discovery and Inventory rules to work, you must add  a Citrix admin account to the FlexNet Beacon.     Create a discovery and inventory rule to inventory XenDesktop Inventorying XenDesktop requires creating a discovery and inventory rule comprising: A Target defining the XenDesktop Delivery Controller server. An Action corresponding to its XenDesktop environment. Ensure that you click the Discover Citrix XenDesktop environments and Gather Citrix XenDesktop environment inventory checkboxes. A Rule that can target a specific machine or set of machines. The rule performs the action you created on the target you created. The XenDesktop inventory discovery rule is then triggered on the FlexNet Beacon by remotely executing commands on the delivery controller.     Import all Active Directory data An Active Directory (AD) typically consists of a list of all users as well as a list of all AD groups. In the case of AD groups, FlexNet Manager Suite needs a way to determine which users are in which groups. Consequently, FlexNet Manager Suite requires an import of all Active Directory data. This import provides FlexNet Manager Suite with AD group GUIDs that provide a mapping of users assigned to each AD group.     Create a discovery and inventory rule to inventory all delivery groups This section contains information about creating a discovery inventory rule to inventory delivery groups. For information about creating delivery groups, refer to the Citrix Delivery groups product documentation. At a minimum, each unique machine from every delivery group must be inventoried. In FlexNet Manager Suite, a discovery and inventory rule can be created to perform this; however, keep in mind that the machines to target are dependent upon how the machines were derived, as follows: Machines derived from a base image—If a catalog contains multiple machines from the same base image, then just one of those machines needs to be inventoried (assuming all machines derived from the base image are not unique). Any unique machine needs to be inventoried. Machines NOT derived from a base image—If a catalog contains multiple machines not derived from a base image, then each unique machine needs to be inventoried. Inventorying machines from every machine catalog can be done in FlexNet Manager Suite by creating a discovery and inventory rule comprising: A Target containing all unique machines that need to be scanned for installed software. Note : In this example, the Adoption options section is set to Allow these targets to be adopted . If you do not want to allow the targets to be adopted, there is no need to adopt and install the agent on these machines because the inventory can be done remotely (zero touch). In that scenario, you would choose the Do not allow these targets to be adopted radio button in the Adoption options section. An Action for general hardware and software inventory. A Rule that can target a specific machine or set of machines. Note: There is no need to adopt and install the agent on these machines, because the inventory can be done remotely (zero touch).       XenAppAgent Information This section provides supplemental information regarding the XenAppAgent. For information about how to set up FlexNet Manager Suite to inventory XenApp, refer to How to Inventory Citrix XenDesktop and XenApp using FlexNet Manager Suite. Note: The XenAppAgent was released in 2019 R1.3 for cloud implementations and will be released in FlexNet Manager Suite 2019 R2 for on-premises implementations. Beginning with FlexNet Manager Suite R1.3 (for cloud implementations) and FlexNet Manager Suite R2 (for on-premises implementations), support for XenApp Applications Groups was added. To take advantage of support for Application Groups and the collection of user filters, you must use the new XenApp server agent, XenAppAgent. In addition, a one-time staging database update is required to use XenAppAgent to collect Application Group data and user filters from Application Groups. Note: The XenAppAgent installer can be found within the XenAppAgent folder of the Citrix XenApp Server Agent subdirectory that is provided in the Adapter Tools for FlexNet Manager Suite archive. For on-premises implementations, the Adapter Tools for FlexNet Manager Suite is available in a zip archive in the Product and License Center. For cloud implementations, the zip archive can be downloaded from the Flexera Community. FlexNet Manager Suite’s XenApp server agent, XenAppAgent, is run on a Delivery Controller, which reads application assignment and populates a staging database. Then XenApp server adapter on FlexNet Beacon reads data from this staging database and uploads it to FlexNet Manager Suite, where it is processed with data from other components. The XenAppAgent requires that the machines in the machine catalog are power-managed (so they can be powered on), and their Windows Admin share is not disabled (by default it is enabled). ... View more

Note the following important information regarding upgrading to macOS 10.15 (Catalina).   If you have machines that have FlexNet inventory agents already installed, these need to be upgraded to version 14.0 of the   FlexNet inventory agent   before the OS is upgraded   to macOS 10.15. If the OS is upgraded without first upgrading the installed   FlexNet inventory agent s, the existing   FlexNet inventory agent   will no longer be able to run on the inventory device. As a result it would not be possible to use policy to upgrade the   FlexNet inventory agent   in this scenario. Such a case would require manually upgrading the   FlexNet inventory agent .   In the event a Mac is updated to 10.15, and it has a 13.0.x or older inventory agent installed, the agent can be manually removed using the following command from the Terminal: /opt/managesoft/bin/uninstall-managesoft.command -force   Note: The above command will encounter an error when attempting to remove agent configuration data.  To completely remove the agent configuration, also run: sudo rm -rf /var/opt/managesoft     ... View more

With FlexNet Manager Suite 2019 R2, after a 14.0.x or later version of the FlexNet Beacon or inventory agent is installed, attempting to then downgrade to an earlier version (13.8.x or earlier) will result in the  application unexpectedly quitting, related to FlexNet Beacon or inventory agent processes after the downgrade completes. To work around this behavior, remove the following file from the machine: 32-bit machines: C:\Windows\System32\mgscmn.dll 64-bit machines: C:\Windows\SysWOW64\mgscmn.dll After removing this file, repair the FlexNet Beacon or inventory agent installer though Add or Remove Programs, or by launching the MSI installation again and selecting Repair. ... View more

Summary This article applies to FlexNet Manager Suite cloud and on-premises implementations and provides help with utilizing the Unified Spend Analytics feature. Specifically, this article is tracking evolving details about how to obtain OAuth tokens for both cloud and on-premises implementations in order to export data to Unified Spend Analytics, and also provides information for obtaining a new license file for on-premises implementations that is required for using Unified Spend Analytics. Note : Contact Flexera Support to initiate the onboarding process in order to use Unified Spend Analytics.  Cloud implementation details Note: Unified Spend Analytics is available starting with the FlexNet Manager Suite 2019 R2.1 release. For cloud implementations, the  following prerequisites must be met in order to export spend data to Unified Spend Analytics:   You must generate an OAuth token and paste it into the Unified Spend Analytics section on  the  Integrations   tab (of the  System Settings  page) .  You will be provided a script to generate the OAuth token. A license file will be automatically added for you. Note : Contact Flexera Support for the license file and the script to generate the OAuth token.  On-premises implementation details Note: Unified Spend Analytics is available in a FlexNet Manager Suite 2019 R2 special feature release that was made available on December 31, 2019 in the Product and License Center as FlexNet Manager Suite Update 2019R2-02. When you complete the installation of FlexNet Manager Suite Update 2019R2-02, the following prerequisites must be met in order to export spend data to Unified Spend Analytics: You must install FlexNet Manager Suite Update 2019R2-02 or later. You must obtain and install a new license file. You must obtain an OAuth token and paste it into the Unified Spend Analytics section on  the  Integrations   tab (of the  System Settings  page) .  You will be provided a script to generate the OAuth token. Note : Contact Flexera Support for the license file and the script to generate the OAuth token.  This article will be updated as new details become available.   ... View more