How to Configure RCDevs License Server
In this short How-To, we will explain how to configure RCDevs License Server. The license server is now the default RCDevs model for licensing. This documentation is addressed to every new customer who is subscribing for an enterprise license. For others, the license server can be used with at least WebADM 1.6.8-2.
Once the license server is configured with WebADM, a license cache is available for 10 days. That means, if your WebADM servers are not able to communicate with RCDevs license servers, WebADM will continue to work as expected during 10 days. Once the offline cache is expired, WebADM services will stop working. To renew the license cache, WebADM needs to communicate again with license servers.
2. First Steps
2.1 Only Applicable for WebADM 1.x versions
After subscribing an RCDevs enterprise license, a license file will be provided to you by the RCDevs sales team.
You have to import this file on your WebADM server. To do it, 2 ways are possible, import the license file from the WebADM Administrator portal or copy the file on the server through SSH/WinSCP in
To enable the license server configuration, you have to edit WebADM servers file
Login on the WebADM server through SSH and edit the following file:
In this file, you should find the license server section. If the following bloc is not available in your servers.xml file, please add it. It looks like below:
<!-- <LicenseServer name="License Server" host="license.rcdevs.com" port="7001" ca_file="" /> -->
You have to uncomment it like below:
<LicenseServer name="License Server" host="license.rcdevs.com" port="7001" ca_file="" />
Configuration is done, you can save and quit this file. To changes takes effect, you have to restart WebADM services:
During the restart, if the communications with the license servers work fine, you should see:
Connected License server: License Server (184.108.40.206)
Checking License service access... Ok
If during the services restarting you see:
Connected License server: ERROR (no server available)
That means that WebADM is not able to contact the license server. Or the new license hasn’t been imported yet. We will see how to troubleshoot this issue in the Troubleshoot section of this documentation.
2.1 Only Applicable for WebADM 2.x
On WebADM v2.x there is no modification to perform in
You just need to enable RCDevs cloud services in
Your WebADM server(s) must be able to reach
[root@webadm1 ~]# telnet cloud.rcdevs.com 443 Trying 220.127.116.11... Connected to cloud.rcdevs.com. Escape character is '^]'.
Have a look on RCDevs Cloud Service documentation for more information.
Restart WebADM services to changes takes effect.
3. Import the License from the WebADM Administrator Portal
In that scenario, you have to log in on the WebADM Admin GUI, click on the
Admin tab and click on
Software License Details in
Licensing and Configurations section.
You are now in the
Software License Details menu. Through this menu, a blue button named
Import New License is available to import the license file provided by the RCDevs sales team. Click on the
Import New License button.
And you are now in the following menu:
Click on the
Browse File button and select your license file locally.
Or for Method 2, copy the content of the license file and past it below.
Click on the appropriate
Import button according to the method you choose.
You will now see the license details and another blue button to upload the license.
Update License button.
The license file is now imported on your WebADM server. Please, restart WebADM to activate the license.
Finally, you will see the imported license under
Admin tab and click on
Software License Details.
4. Troubleshooting License Server Connection
4.1 License Server (no server available)
This error can occur when starting WebADM services.
[root@webadm1 ~]# /opt/webadm/bin/webadm restart Stopping WebADM HTTP server... Ok Stopping WebADM Watchd server..... Ok Stopping WebADM Session server... Ok Stopping WebADM PKI server... Ok Checking libudev dependency... Ok Checking system architecture... Ok Checking server configurations... Ok Found Trial Enterprise license (RCDEVSSUPPORT) Licensed by RCDevs Security SA to RCDevs Support Licensed product(s): OpenOTP,SpanKey,TiQR Starting WebADM PKI server... Ok Starting WebADM Session server... Ok Starting WebADM Watchd server... Ok Starting WebADM HTTP server... Ok Checking server connections... Connected LDAP server: LDAP Server (192.168.3.60) Connected SQL server: SQL Server (192.168.3.68) Connected PKI server: PKI Server (127.0.0.1) Connected Mail server: SMTP Server (18.104.22.168) Connected Push server: Push Server (22.214.171.124) Connected Session server: Session Server (::1) Connected License server: License Server (no server available) Checking LDAP proxy user access... Ok Checking SQL database access... Ok Checking PKI service access... Ok Checking Mail service access... Ok Checking Push service access... Ok Checking License service access... ERROR
Possible reason/Solution :
- WebADM can not communicate with RCDevs license services. Check with telnet if license.rcdevs.com and destination port are reachable from WebADM server(s).
4.1.1 DNS Resolution
Fist, check that the DNS resolution from your WebADM server works correctly for
[root@webadm1 ~]# ping license.rcdevs.com PING license.rcdevs.com (126.96.36.199) 56(84) bytes of data. 64 bytes from 188.8.131.52 (184.108.40.206): icmp_seq=1 ttl=54 time=17.5 ms 64 bytes from 220.127.116.11 (18.104.22.168): icmp_seq=2 ttl=54 time=16.8 ms 64 bytes from 22.214.171.124 (126.96.36.199): icmp_seq=3 ttl=54 time=17.1 ms ^C --- license.rcdevs.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2001ms rtt min/avg/max/mdev = 16.890/17.194/17.510/0.295 ms
As you can see, the resolution works here. If it’s not your case, add an entry in your DNS system or configure the public IP of RCDevs license servers in
license.rcdevs.com is a DNS name for redundant infrastructure. The actual resolved IP for license.rcdevs.com can change, so it is recommended to use the DNS name instead of the IP. If your firewall does not allow using DNS names and you have to use IP addresses, we advise you to allow traffic to the following three IP addresses :
4.1.2 Communication on port 7001
Here we will try if WebADM is able to access to license.rcdevs.com on 7001 port using telnet tool:
[root@webadm1 ~]# telnet license.rcdevs.com 7001 Trying 188.8.131.52... Connected to license.rcdevs.com. Escape character is '^]'.
Communication on port 7001 is allowed. If WebADM is not able to communicate on port 7001, please check your firewall.
Please note that the protocol is pure TCP and not HTTPS. Some firewalls (e.q. Palo Alto) block the connection if the rule is defined with HTTPS.
4.2 Checking License service access… ERROR
This error can occur when starting WebADM services.
[root@webadm1 ~]# /opt/webadm/bin/webadm restart Stopping WebADM HTTP server... Ok Stopping WebADM Watchd server..... Ok Stopping WebADM Session server... Ok Stopping WebADM PKI server... Ok Checking libudev dependency... Ok Checking system architecture... Ok Checking server configurations... Ok Found Trial Enterprise license (RCDEVSSUPPORT) Licensed by RCDevs Security SA to RCDevs Support Licensed product(s): OpenOTP,SpanKey,TiQR Starting WebADM PKI server... Ok Starting WebADM Session server... Ok Starting WebADM Watchd server... Ok Starting WebADM HTTP server... Ok Checking server connections... Connected LDAP server: LDAP Server (192.168.3.60) Connected SQL server: SQL Server (192.168.3.68) Connected PKI server: PKI Server (127.0.0.1) Connected Mail server: SMTP Server (184.108.40.206) Connected Push server: Push Server (220.127.116.11) Connected Session server: Session Server (::1) Connected License server: License Server (18.104.22.168) Checking LDAP proxy user access... Ok Checking SQL database access... Ok Checking PKI service access... Ok Checking Mail service access... Ok Checking Push service access... Ok Checking License service access... ERROR
Possible reasons/Solutions :
After connections checks during WebADM services start, WebADM will try to perform an authentication to RCDevs license services. The authentication is done through your entreprise license. New licenses are pushed every hours on RCDevs licenses servers. Your license needs to be pushed on RCDevs licenses servers first in order to be used with RCDevs license services. You can encountered this issue if your license has been generated by RCDevs Sales team at 3:10 pm for example and your tried to use it before 4:00 pm. If the problem persists after 1 hour, contact RCDevs support.
4.3 How can I be sure that WebADM and License Server are synchronized?
To be sure that communications between WebADM and Licence Servers working fine, log in on the WebADM GUI and click on the
You should see Active License Server: License Server (22.214.171.124) like below:
Always under the
Admin menu, another check must be done. Click on
Software License Details:
And you should see something similar if everything works fine.
If you have ‘Active License Server: None’ as below after performing every check we previously did, please contact RCDevs support.
4.4 WebADM snapshot restore, Error (Given Token is out of Sync)
When you restore a snapshot, you will also restore the previous One-Time License Token which will in most cases be invalid. The rotation of that license Token happens every time WebADM connect to license services. If you re-use an old token (after a snapshot restore for e.g), then the token in use between license services and WebADM is out of sync. If your pool is full (2 nodes by default) WebADM is not able to reconnect to license service and perform the resync automatically. In that situation, you need to manually unbind the old client to liberate a license client slot for the restored version of WebADM be able to connect to the license service. To do this, login on the GUI of your restored WebADM server, click on ‘Admin’ tab and ‘Software License Details’. Scroll down until ‘License Server client’ section and click ‘Unbind’ buttons.
4.5 Server Pool
The licensing model is based on the number of users and the number of WebADM instances that you want to configure.
WebADM Servers IPs doesn’t matter anymore with license servers. You have now a pool with x servers allowed according to the license you ordered. If your pool is full and you want to connect another WebADM instance in this pool, you need to unbind one server to free up one slot in your pool. To remove an instance from your server pool, log into the WebADM Admin GUI, click on the
Software License Details and in License Server Client, find the client in question and click
Unbind Client to remove the client from your pool.
A slot is now available for another server:
4.6 WebADM cannot contact License Servers anymore
If for any reason, your WebADM server is not able to contact the license servers or if the license servers are down for maintenance, an offline cache will allow WebADM to continue working without problem during 10 days. After 10 days, WebADM will stop working if the communication with license servers have not been established in meanwhile.
4.7 License error for product OpenOTP (active users limit exceeded)
This error appears when you activated more users than allowed by your license. Freeware users are allowed to activate up to 40 users. Number of activated users can be checked through WebADM GUI > Admin > Software license details.
Activated users consuming license slots can be listed with report tool.
[2020-04-17 18:50:45] [192.168.3.64] [OpenOTP:RCKOG0P2] License error for product OpenOTP (active users limit exceeded)
- Contact RCDevs sales team to order/extend your license allowing you the amount of activated users.
- Deactivate enough accounts until the amount of authorized users by your license is reach.
After users deactivation, you can manually clear license cache to force a new counting of activated users and get activated users value updated.
To clear WebADM license cache, login on
WebADM GUI > Admin > Clear WebADM license cache or restart WebADM services.
5. Information transferred from WebADM to RCDevs License server
For the online license, the information transmitted is the following.
No private or individual user information at all is transmitted.
- Customer ID and instance ID (As in WebADM Software license details)
- Host ID Hash (not IP or MAC or any recognisable address)
- One time license token (generated locally)
- Number of activated users (for OpenOTP)
- Result of one way hash function of the user search base (used to verify the cluster member configs are same)
- Installed RCDevs software versions
- User and host count (for Spankey)