Licence
Four tiers by feature module and managed host count. Offline activation by default, one .lic per IPA server; the console is read-only until activated.
The generic licence flow (online / offline, fingerprint, migration) is under Platform: licence activation. This page covers only what is specific to IDMatrix.
Tiers
Two axes: feature modules and managed hosts. Never per user.
| Standard | Professional | Enterprise | Trial | |
|---|---|---|---|---|
| For | Linux only, small | Linux only, full feature set | Windows AD + Linux unified identity | POC |
| Managed hosts | 100 | 500 | 1000, raisable | 20 |
| IPA servers | 1 | 2 | Unlimited | 1 |
| Term | 1 year | 1 year | 1 year | 30 days |
| HBAC, password policies, user SSH keys, certificate issuance | ✓ | ✓ | ✓ | ✓ |
| Built-in DNS, automount, certificate identity mapping, Kerberos ticket policy | – | ✓ | ✓ | ✓ |
| AD trust | – | – | ✓ | ✓ |
In every tier and unaffected by the licence: users, hosts, groups, sudo, RBAC, OTP, multi-master replication, backup and restore.
"Managed hosts" are hosts joined to the domain (objects created by ipa host-add), not machines on the AD side. "IPA servers" are FreeIPA servers running the IDMatrix console; each needs its own .lic. A plain FreeIPA replica without the console does not count.
Behaviour when not activated or out of bounds
| State | Console | API / CLI | Joined hosts |
|---|---|---|---|
| Not activated, expired, fingerprint mismatch, revoked | Red banner; every page readable, nothing editable | Writes return 403, code 4300 LicenseReadOnly | Login, sudo, SSH unaffected |
| Activated, module not licensed | That module's navigation entries hidden | Writes return 403, code 4301 LicenseModuleLocked | Unaffected |
| Managed host cap reached | ipa host-add fails | Server refuses new hosts | Unaffected |
| Expiring within 30 days | Yellow banner with days left | Unaffected | Unaffected |
The licence only governs what administrators can change. Policies already pushed to hosts, Kerberos tickets already issued and certificates already signed are untouched; the domain keeps serving when the licence lapses. Certificate auto-renewal is also unaffected (from 1.0.2; earlier versions failed renewals when the certificate issuance module was missing).
How the three layers fit
| Layer | Where | Does |
|---|---|---|
| Validation | idmatrix-license.timer runs phonehome.py daily | Verifies the .lic locally (signature, expiry, host fingerprint) and writes /var/lib/idmatrix-license/status.json |
| Gate | The WSGI entry for /ipa in httpd | Reads status.json on every JSON-RPC request: read-only state refuses all writes, module state refuses writes to unlicensed modules. FreeIPA's own service principals (certmonger renewals, replica traffic) bypass the gate |
| Hard cap | FreeIPA server plugin | Counts managed hosts on host_add and refuses beyond max_managed_hosts |
All three take status.json as the source of truth. Refresh it without waiting for the daily timer: sudo systemctl start idmatrix-license.service.
Activation
Offline by default; the IPA server needs no internet access.
Console → IPA Server → License Activation, copy the host fingerprint (64 hex characters) and send it to Reallysec.
Upload the returned .lic on the same page. The server verifies before writing: a bad file, another machine's file or garbage never overwrites the current licence.
Check cat /var/lib/idmatrix-license/status.json: valid is true, mods lists the purchased modules, expiry is the end date. The banner disappears and hidden navigation entries appear without a reload.
Command-line equivalent:
curl -sk -X POST https://<FQDN>/ipa/modern-ui/license/install --data-binary @<customer>.lic
# {"ok":true,"status":{...}}The fingerprint derives from /etc/machine-id. Reinstalling the OS, changing hardware, cloning a VM or restoring a backup onto another machine all change it and invalidate the licence; it must be reissued for the new fingerprint. Restoring onto the same machine is fine.
Renewal, more hosts, higher tier
All the same action: Reallysec signs a new .lic for the same fingerprint with the new expiry, host cap or modules; upload it on the License Activation page. No reinstall, no restart; the gate recalculates on upload.
Online mode (optional)
Offline mode has no heartbeat, no remote revocation and no grace period; expiry means read-only. Customers who need remote revocation or heartbeat monitoring can switch to online mode, provided the IPA server reaches license.reallysec.com:443 and Reallysec issues an online token instead of a .lic.
Edit /etc/systemd/system/idmatrix-license.service:
Environment=IDMATRIX_LICENSE_SERVER=https://license.reallysec.com
Environment=IDMATRIX_LICENSE_TOKEN=<online token>
Environment=IDMATRIX_LICENSE_GRACE_DAYS=3sudo systemctl daemon-reload && sudo systemctl start idmatrix-license.service
cat /var/lib/idmatrix-license/status.jsonIDMATRIX_LICENSE_GRACE_DAYS is how many days the licence stays valid after the server becomes unreachable, default 3, 7 on unreliable networks. Online mode only.
Troubleshooting
| Banner / symptom | Cause |
|---|---|
| "Not activated" | No .lic uploaded, or it is missing from /var/lib/idmatrix-license/ |
| "Not authorised on this server" | Fingerprint mismatch: machine changed or machine-id changed. Reissue |
| "Expired" | Renew |
Upload returns 许可证文件为空或过大 (file empty or too large) | Wrong path after curl --data-binary @; an empty body was sent |
| A page is still missing after activation | That module is not in mods. Check status.json; it is not a caching issue |
LicenseModuleLocked never appears in logs | The gate does not log refusals to httpd. Judge gating by valid and mods in status.json |
| Changed service env has no effect | Missing daemon-reload and systemctl start; the timer runs once a day |
AD trust prerequisites and setup
Five things to check before creating a one-way "AD users log in to Linux" trust, the commands, and how to verify lookups. Any one missing makes trust-add fail or user resolution silent.
Adding a second IPA server
Add a replica with ipa-replica-install for multi-master. Pre-flight checks, the install commands, which warnings to ignore, post-install checks, and how to clean up and retry after a failure.