License Activation
The three blocks of the License Activation page: current status, machine fingerprint, .lic upload; what happens on upload and what each failure message means. Tiers and the three enforcement layers are in the install section.
IPA Server › License Activation is the only licence entry point in the UI. Tiers, modules and the read-only rules are in Licence; this page covers the page itself. It is not gated: it opens and accepts uploads in read-only state, otherwise read-only could never be lifted.
Current license status
Read from /var/lib/idmatrix-license/status.json, the same source as the top banner.
| Field | Meaning |
|---|---|
| status bar | green: valid. red: not activated / expired / fingerprint mismatch / revoked, with the reason. yellow: expires within 30 days |
| License ID | LIC-<date>-<8 chars>; quote it for renewals and support |
| Tier | standard / professional / enterprise / trial |
| Expiry date | with days remaining |
| Licensed modules | subset of hbac, pwpolicy, ssh-keys, cert-issue, krb-sso, dns, automount, ca, ad-trust; decides which navigation groups show |
The status is refreshed daily by idmatrix-license.timer; Refresh on the page only re-reads the file. To force a check: sudo systemctl start idmatrix-license.service.
Machine fingerprint
64 hex characters derived from the system's /etc/machine-id. The issuer signs the .lic for this fingerprint; licence and machine are one-to-one. The copy button puts it on the clipboard.
The fingerprint changes on an OS reinstall, on a cloned VM once machine-id is regenerated, and on a restore to another machine. The existing licence then becomes "fingerprint mismatch" read-only and a new one must be issued for the new fingerprint. Hardware swaps do not matter. Every replica has its own fingerprint and its own licence.
Upload license file
Pick a .lic; the page immediately:
- Verifies locally: signature by the RST issuing CA, expiry, fingerprint.
- On success writes
/var/lib/idmatrix-license/license.licand rewritesstatus.jsonat once; banner and navigation update without a service restart. - On failure writes nothing; the current licence stays as it was.
Failure messages (the product shows them in Chinese):
| Message | Cause |
|---|---|
| 许可证文件为空或过大 (empty or too large) | wrong file; a .lic is a few KB, cap 64 KB |
| 许可证文件不是有效文本 (not valid text) | a binary or compressed file was uploaded |
| 该文件不是有效的许可证文件 (not a valid licence file) | format or signature check failed: modified, not RST-issued, or mangled by a mail client. Have the issuer resend |
| 该许可证并非签发给本服务器 (not issued for this server) | fingerprint mismatch; send this page's fingerprint to the issuer |
| 该许可证已过期 (expired) | the expiry date has passed |
| Unable to read license status / Unable to obtain machine fingerprint | the backend is down: the licence WSGI inside httpd is not up, see journalctl -u httpd |
Boundaries
- One licence per server; a new upload replaces the old one. There is no rollback button, keep the old
.licyourself. - The page never talks to the network; online mode (heartbeat) is optional and described in the install section.
- Other browsers already logged in need a page reload to see the new navigation.
Configuration
Global defaults: search limits, default shell / home / group / e-mail domain for new users, default authentication type, user and group object classes, the SELinux user list, CA renewal and PKINIT masters. Changes affect objects created afterwards.
FAQ
Find the cause by symptom, grouped by install, login, AD trust, licence, clients and replication. Most problems are DNS or time.