Licence
Four tiers by feature module and managed host count. Offline activation by default, one .lic per IPA server; the console is read-only until activated.
Tiers
Licensing has two axes, feature modules and managed hosts. It is never per user.
| Item | Professional | Enterprise | Trial |
|---|---|---|---|
| For | Linux only, full feature set | Windows AD and Linux unified identity | POC |
| Managed hosts | 100 | 1000, raisable | 20 |
| IPA servers | 1 | Unlimited | 1 |
| Term | 1 year | 1 year | 14 days |
| HBAC, password policies, user SSH keys, certificate issuance | Included | Included | Included |
| Built-in DNS, automount, certificate identity mapping, Kerberos ticket policy | Included | Included | Included |
| AD trust | Not included | Included | Included |
In every tier and unaffected by the licence: users, hosts, groups, sudo, RBAC, OTP, multi-master replication, backup and restore.
Managed hosts are hosts joined to the domain (objects created by ipa host-add), not machines on the AD side. IPA servers are FreeIPA servers running the IDMatrix console; each needs its own .lic. A plain FreeIPA replica without the console does not count.
Behaviour when not activated or out of bounds
| State | Console | API and CLI | Joined hosts |
|---|---|---|---|
| Not activated, expired, fingerprint mismatch, revoked | Red banner. Every page readable, nothing editable | Writes return 403, code 4300 LicenseReadOnly | Sign-in, sudo and SSH unaffected |
| Activated, module not licensed | That module's navigation entries hidden | Writes return 403, code 4301 LicenseModuleLocked | Unaffected |
| Managed host cap reached | ipa host-add fails | Server refuses new hosts | Unaffected |
| Expiring within 30 days | Yellow banner with days left | Unaffected | Unaffected |
The licence only governs what administrators can change. Policies already pushed to hosts, Kerberos tickets already issued and certificates already signed are untouched; the domain keeps serving when the licence lapses. Certificate auto-renewal is also unaffected (from 1.0.2; earlier versions failed renewals when the certificate issuance module was missing).
How the three layers fit
| Layer | Location | Role |
|---|---|---|
| Validation | idmatrix-license.timer, daily | Verifies the .lic locally (signature, expiry, host fingerprint) and writes /var/lib/idmatrix-license/status.json |
| Gate | The WSGI entry for /ipa in httpd | Reads status.json on every JSON-RPC request: read-only state refuses all writes, module state refuses writes to unlicensed modules. FreeIPA's own service principals (certmonger renewals, replica traffic) bypass the gate |
| Hard cap | FreeIPA server plugin | Counts managed hosts on host_add and refuses beyond max_managed_hosts |
All three take status.json as the source of truth. To refresh it without waiting for the daily timer, run sudo systemctl start idmatrix-license.service.
Activation
Offline by default; the IPA server needs no internet access.
Under IPA Server in the console, open License Activation, copy the host fingerprint (64 hex characters) and send it to Reallysec.
Upload the returned .lic on the same page. The server verifies before writing: a bad file, another machine's file or invalid content never overwrites the current licence.
Run cat /var/lib/idmatrix-license/status.json and confirm that valid is true, mods lists the purchased modules and expiry is the end date.
After activation the banner disappears and hidden navigation entries appear without a reload. Command-line equivalent:
curl -sk -X POST https://<FQDN>/ipa/modern-ui/license/install --data-binary @<customer>.lic
# {"ok":true,"status":{...}}The fingerprint derives from /etc/machine-id. Reinstalling the OS, changing hardware, cloning a VM or restoring a backup onto another machine all change it and invalidate the licence; it must be reissued for the new fingerprint. Restoring onto the same machine is unaffected.
Renewal, more hosts, higher tier
All three are the same action: Reallysec signs a new .lic for the same fingerprint with the new expiry, host cap or modules, and it is uploaded on the License Activation page. No reinstall and no restart; the gate recalculates on upload.
Online mode
Offline mode has no heartbeat, no remote revocation and no grace period; expiry means read-only. Customers who need remote revocation or heartbeat monitoring can switch to online mode, provided the IPA server reaches license.reallysec.com:443 and Reallysec issues an online token instead of a .lic.
Edit /etc/systemd/system/idmatrix-license.service:
Environment=IDMATRIX_LICENSE_SERVER=https://license.reallysec.com
Environment=IDMATRIX_LICENSE_TOKEN=<online token>
Environment=IDMATRIX_LICENSE_GRACE_DAYS=3sudo systemctl daemon-reload && sudo systemctl start idmatrix-license.service
cat /var/lib/idmatrix-license/status.jsonIDMATRIX_LICENSE_GRACE_DAYS is how many days the licence stays valid after the server becomes unreachable, default 3, 7 on unreliable networks. Online mode only.
Troubleshooting
| Banner or symptom | Cause and remedy |
|---|---|
| Not activated | No .lic uploaded, or it is missing from /var/lib/idmatrix-license/ |
| Not authorised on this server | Fingerprint mismatch: machine changed or machine-id changed. Reissue |
| Expired | Renew |
Upload returns 许可证文件为空或过大 (file empty or too large) | Wrong path after curl --data-binary @; an empty body was sent |
| A page is still missing after activation | That module is not in mods. Check status.json; it is not a caching issue |
LicenseModuleLocked never appears in logs | The gate does not log refusals to httpd. Judge gating by valid and mods in status.json |
| Changed service env has no effect | Missing daemon-reload and systemctl start; the timer runs once a day |
AD trust prerequisites and setup
Five conditions to check before creating a one-way trust for AD users on Linux, the commands, and how to verify lookups. Any one missing makes trust-add fail or user resolution silent.
Adding a second IPA server
Add a replica with ipa-replica-install for multi-master. Pre-flight checks, the install commands, warnings to ignore, post-install checks, and how to clean up and retry after a failure.