About TrinityTonic

TrinityTonic · ‎Jan 31, 2023

We are using the Flexnet C SDK for licensing on our clients. We mostly perform offline licensing scenarios, where we upload a capability response manually to the device in order to distribute the required licenses. We have encountered a problem that we wanted to discuss. In case we upload a capability response file that has already been successfully used once a second time the internal C API function returns an error, namely FLXERR_RESPONSE_STALE. We want to adapt the functionality so that we only return an error inside our function if the capability response would change to a state of the licenses inside trusted storage, i.e. if licenses are removed / added. In case the capability response has already been processed, but if the response would not change (add or remove licenses) we do not want to return an error. Could you make a suggestion on how to implement this in a most efficient way using the C SDK API?

TrinityTonic · ‎Jan 31, 2023

We currently use the FlexNet C SDK on our embedded devices. These currently work either with the internal trusted storage on the device as the license source (using the device's serial number as host and binding id) - or using a license dongle as the license source (using the dongle's serial number as host and binding id). However in future we plan to use both license sources at the same time. While discussing this use-case some questions arose which we hope you can answer. Is it technically possible / feasible use two 'trusted storage'-based license sources such as the internal trusted storage and the trusted storage on a license dongle simultaneously? In my understanding we would have two separate trusted-storage-based license sources which we need to initialize. Each trusted storage itself has an anchoring and storage file bound to the specific device's or dongle's serial number respectively. I don't fully understand how we would need to set the host id and binding id callouts in case we wanted to use both storages simultaneously. Does the 'capabiality response processing' functionality automatically determine if a capability response has been created for internal storage / license dongle and update the corresponding trusted storage? Or do I need to 'manually' determine which specific trusted storage source it was created for (e.g. by trying to upload to each available source in a defined order and checking which one succeeds first). When 'aquiring' a license, we assume that the FlexNet Embdedded code internally queries all available sources in a defined order? If we created two trusted-storage based sources, it would search both of these to check wheter the to-be-acquired license exists?

TrinityTonic · ‎Jan 08, 2023

Thank you Jim - things have become alot clearer now. However I got one last question here regarding authentication. How can we make sure that only entitled clients can upload a capability request to and retrieve a capability response from the license server? As far as I understand, these operations (binary exchanges between license server and clients, etc.) are exempt from security thus no credentials are ever needed to perform these operations. If that was the case - could ANY client that knows the URL of the CLS (device registration excluded) ask for a valid license? How can we ensure that only certain devices can request a license from a license server?

TrinityTonic · ‎Dec 12, 2022

Thank you @jberthold for the detailed answer! A few more quesitons came up while setting up a prototype for the floating license use case. What would a license model in FNO look like in case we wanted it to support floating licenses that can be concurrently used up to a maximum count and to be used within FlexNet Embedded. Could you ellaborate the settings in regard to "embedded", "counted", "sharable", "unlimited checkouts" and "activatable" (see picture for example setting)? The client / license server / FNO setup requires certain identity files that can be created with the provided tool (pubidutil) or within FNO. From the documentation I saw that the publisher and client server (license server) identity files contain sensitive information. Do we need the client server (license server) identity - especially the private key contained herein - during operation of the license server, e.g. to generate valid capability responses? If that's the case we would have to take extra measures to protect the client server identity especially when considering that is directly derived from our master (publisher identity) key and shipped to / provided to customers. I see that the provided java-based license server comes with a rich feature set of functionality, REST API and administration / helper tools. The C-based server example however contains a bare metal example of a license server that can process capability requests and generates capability responses. Do we understand it correctly that - if we went for the C-based license server - we would have to implement a good portion of the server functionality, REST API and administration / helper tools ourselves which would require a good understanding of the functionality offered by the C SDK? Is that the only way to be able to use the same license server base code both on a dedicated hardware product used within the customer's network and as an internet facing license server hosted in our cloud while not using java? What's the fundamental difference or advantage - if any - in using the CLS hosted by Revenera and using a LLS hosted on our cloud and reachable by devices over the internet. There is the possibility to enable incoming HTTPS for tls-secured communication between clients and the license server. What's best practices for authorization on the license server, especially if it's internet faced? We understand that on a C-based license server we would need to implement the user authorization ourselves. Does the FlexNet java-based library implement custom user management or can it be attached to the underlying os's user management?

TrinityTonic · ‎Dec 07, 2022

We are using FNE (C-SDK) and FNO with node-locked licenses and do offline provisionning of the licenses on our devices. As a new product of ours will most likely run inside a virtualized enviroment we are thinking about extending our licensing capabilities to support floating licenses. We will most probably implement FlexNet's license server within a local network or reachable from the internet. However we wanted to clarify a few topics, thus my questions. Can an FNE - enabled device work with both node-locked licenses and floating licenses in parallel? Assuming we have a node-locked license with activation ID XXX that allows to run some app of ours. Can we use the same license with the same activation ID XXX for the floating use-case as well? Or will we need two licenses per application, the node-locked one with activation ID XXX and the floating licenses with activation ID YYY? Do floating licenses get node-locked once they are provisionned on the client? Does the capability response contain the host id of the client the license will be node-locked to? We currently have licenses with specific entitlement and activation ids available inside FNO. I would like to understand the fundamental difference in creating floating licenses that can be retrieved from the license server - not beyond a maximum quantity (counted license?). Furthermore I read about the concept of the borrow and renewal interval. These values will be availble to the client when the capability response is parsed. Who is responsible to act according to these values? Is there any code / callbacks automatically called on the client when these times are reached or does the client need to implement own handling in case the renewal / borrow intervals are reached? If so, what would the client need to do once the borrow / renewal times have been reached? Is it possible to call any specific API functions to renew a license - however not by return + new acquisition but by other means without returning it? What should happen when borrow and renewal intervals have passed and the license server is not reachable for renewal. Is that completely on the client to decide? Do you have any documentation that describes how to implement floating / network licenses in more detail. Is there any reference you could recommend here (guides, etc.)?

TrinityTonic · ‎Aug 08, 2022

Would both ways depicted under following pictures be viable solutions for my problem? If so what should be preferred if everything is to be done in a manual (download from ..., upload to ..., etc.) way - what way should be preferred if everything was to be done automatically without user interaction.

TrinityTonic · ‎Aug 08, 2022

So If I understood correctly there's two ways: The host triggers the return by starting a capability request with the reduced quantity and uploads it to the portal The portal processes this capability request and adds up the licenses accordingly How does the portal / back-end server know that the licenses have actually been removed from the device? Is there some capability response involved here? Alternatively: License is derectly removed from the device in the FlexNet FNO Portal Then a sync is performed ... what does sync stand for here? As far as I understand it would mean that a reduced capability response is generated which is downloaded onto the device The processes the reduced capability response and submits another request to the back-office so that the back-office can be sure that the device has been removed I'm implementing everything manually so I have to assume that there is (most of the time) no direct connection between host and FNO Portal --> the functionality of uploading and downloading the corresponding requests need to be available in the host's backend and the FNO's backend.

TrinityTonic · ‎Aug 05, 2022

Hi Daniel, do you have any sources where I could dig a little bit deeper into this?

TrinityTonic · ‎Aug 04, 2022

I am using the Flexera Embedded in my device in conjunction with the Flexera FNO Portal as the licensing back-office. I have a use case in mind and would like to know how this could be best achieved and if there's more than one way to do so. My use-case is that I would like to securely return licenses that were previously acquired by my device so that they could reappear inside the portal and be used by other devices. Typical use-cases would be decomissioning a device or if a device is somehow defect. In the first step I would like the solution to be manually triggerable, later on I would like to automate it. Any links to corresponding documentation on how this could be achieved would be much appreciated.

Online Status	Offline
Date Last Visited	‎Feb 02, 2023 08:39 AM

Checking if a capability response would alter the device state

Multiple trusted storage sources (internal, dongle, ...)

Re: Handling of Floating Licenses (borrow / renewal intervals, ...)

Re: Handling of Floating Licenses (borrow / renewal intervals, ...)

Handling of Floating Licenses (borrow / renewal intervals, ...)

Re: Secure Return of Licenses

Re: Secure Return of Licenses

Re: Secure Return of Licenses

Secure Return of Licenses

Checking if a capability response would alter the device state

Multiple trusted storage sources (internal, dongle, ...)

Re: Handling of Floating Licenses (borrow / renewal intervals, ...)

Re: Handling of Floating Licenses (borrow / renewal intervals, ...)

Handling of Floating Licenses (borrow / renewal intervals, ...)

Re: Secure Return of Licenses

Re: Secure Return of Licenses

Re: Secure Return of Licenses

Secure Return of Licenses