Disponible en español: Control de Acceso en Licencias Concurrentes de Red

Applies to:
Concurrent Network software 6.x and Up

 

Background:

You can limit access to your Concurrent Network licenses by adding lines to the options file. 

First, consider which way you want to structure your permissions for a given product:

1. You can restrict the software so that only designated users can use it.

   1. This is done by using INCLUDE lines.
      1. Anyone not on an INCLUDE line is locked out from that product.
      2. See Method 1 below.
2. You can let anyone except specified users use it.
   1. This is done by using EXCLUDE lines.
      1. Anyone not on an EXCLUDE line is allowed to use the product.
      2. See Method 2 below.

In this Article:

• Features
• Method 1: Only Named Users Can Use a Feature
• Method 2: All Except Named Users Can Use a Feature
• User and Host Groups
• More Options for On-Network Use
• Options for Borrowing
• Troubleshooting License Denials

Features

You control access to some or all of your products by specifying the "feature name" on INCLUDE and EXCLUDE lines.

To find the feature name for a license, in Server Manager click Status and then look at the display for lines beginning "Users of". Those list the feature names of licenses on this server. 

• The feature names for 8.x software all contain 80
• The feature names for 7.x software all contain 70
• The feature names for 6.x software all contain 60

Here is the full list of feature names for version 8:

• DecisionTools80_Industrial, DecisionTools80_Professional
  The DecisionTools features allow use of all components of the Suite. If a DecisionTools Suite user has more than one application open at the same time, only one license is consumed.
  
  
• @RISK80_Industrial, @RISK80_Professional

Here is the full list of feature names for older versions:

• DecisionTools70_Industrial, DecisionTools70_Professional
  The DecisionTools features allow use of all components of the Suite. If a DecisionTools Suite user has more than one application open at the same time, only one license is consumed.
• @RISK70_Industrial, @RISK70_Professional, @RISK70_Standard
• BigPicture (no "70")
• Evolver70_Industrial, Evolver70_Professional
• NeuralTools70_Industrial, NeuralTools70_Professional
• PrecisionTree70_Industrial, PrecisionTree70_Professional
• StatTools70_Industrial, StatTools70_Professional
• DecisionTools60_Industrial, DecisionTools60_Professional
  The DecisionTools features allow use of all components of the Suite. If a DecisionTools Suite user has more than one application open at the same time, only one license is consumed.
• @RISK60_Industrial, @RISK60_Professional, @RISK60_Standard
• Evolver60_Industrial, Evolver60_Professional
• NeuralTools60_Industrial, NeuralTools60_Professional
• PrecisionTree60_Industrial, PrecisionTree60_Professional
• StatTools60_Industrial, StatTools60_Professional

If you misspell a feature name, or if you have no license on this server for that feature, when the options file is re-read, there will be a line in the log file diagnosing it as an invalid feature.

See the Troubleshooting License Denials section below to access the log file.

Access Method 1: Only Named Users Can Use a Feature

You can designate users by Windows user name or Windows computer name. If you have any INCLUDE lines for a feature, then everyone else is locked out from that feature.

Example:

# Stan can use @RISK Industrial from any computer,

# and anyone on computer Atlantis can use @RISK Industrial,

# but no one else can use @RISK Industrial.

INCLUDE @RISK80_Industrial USER Stan

INCLUDE @RISK80_Industrial HOST Atlantis

Only one user name or host name can appear on a line. If you are granting access to just a few users or computers, use multiple INCLUDE lines, like this:

INCLUDE @RISK80_Industrial USER Stan

INCLUDE @RISK80_Industrial USER Michelle

INCLUDE @RISK80_Industrial USER Fernando

INCLUDE @RISK80_Industrial HOST EC-Server

INCLUDE @RISK80_Industrial HOST Atlantis

If you need to grant access to a large number of users or hosts, you'll want to define a group rather than have many INCLUDE lines. See User and Host Groups.

In any conflict between INCLUDE and EXCLUDE lists, EXCLUDE wins. Consider this example:

INCLUDE @RISK80_Industrial HOST Atlantis

EXCLUDE @RISK80_Industrial USER Lucy

Lucy can't use Evolver from any computer, not even Atlantis. All other users can use Evolver from computer Atlantis, but not from any other computer.

According to FLEXnet documentation, "Anywhere a host name can be used in an options file, an IP address can be used instead."

Caution: If you have any INCLUDE...USER lines in your options file for a feature, and your network license is the activatable type, user access to run the software on network will follow the INCLUDE...USER lines, but no one will be able to borrow a license of that feature for off-network use. This does not apply to certificate-type licenses, and it does not apply to INCLUDE...HOST lines with either type of license.

Access Method 2: All Except Named Users Can Use a Feature

You can designate users by Windows user name or Windows computer name. If you have any EXCLUDE lines for a feature, then the named people or computers are locked out from that feature, but everyone else can use it.

Example:

# Stan cannot use @RISK Industrial from any computer,

# and no one on computer Atlantis can use @RISK Industrial,

# but everyone else can use @RISK Industrial.

EXCLUDE @RISK80_Industrial USER Stan

EXCLUDE @RISK80_Industrial HOST Atlantis

Only one user name or host name can appear on a line. If you are blocking access to just a few users or computers, use multiple EXCLUDE lines, like this:

EXCLUDE @RISK80_Industrial USER Stan

EXCLUDE @RISK80_Industrial USER Michelle

EXCLUDE @RISK80_Industrial USER Fernando

EXCLUDE @RISK80_Industrial HOST EC-Server

EXCLUDE @RISK80_Industrial HOST Atlantis

If you need to block access by a large number of users or hosts, you'll want to define a group rather than have many EXCLUDE lines. See User and Host Groups.

According to FLEXnet documentation, "Anywhere a host name can be used in an options file, an IP address can be used instead."

User and Host Groups

It’s cumbersome to list many INCLUDE or EXCLUDE entries in an options file. Instead, define user groups or host groups and reference those groups in your rules.

For example:

GROUP Lawyers Michelle Mark Doug Cristina Robson

GROUP Doctors Stan Sally

HOST_GROUP ThirdFloor Asus14132 Asus14133 Asus14134 \

    Asus14135 Asus14136

INCLUDE DecisionTools80_Industrial HOST_GROUP ThirdFloor

INCLUDE DecisionTools80_Industrial GROUP Doctors

INCLUDE DecisionTools80_Industrial USER Vince

INCLUDE @RISK80_Professional GROUP Lawyers

INCLUDE @RISK80_Professional USER Vince

• This configuration allows the ThirdFloor computer group, the Doctors user group, and user Vince to use a DecisionTools80_Industrial license—no one else can. \
• The Lawyers group and Vince can use a StatTools70_Professional license, and no others.
• ThirdFloor, Doctors, and Vince can still use StatTools Industrial through the DecisionTools Suite.
• If all DecisionTools70_Industrial licenses are taken, ThirdFloor and Doctors cannot fall back to StatTools70_Professional, but Vince and the Lawyers group can. (Vince may switch manually using Select License in License Manager.)

If your group contains too many members for one line, you can split it into multiple lines, like this:

GROUP giants many names

GROUP giants many more names

GROUP giants still more names

The license system will merge all the lists of users into the "giants" group.

Your HOST_GROUP can identify computers by name or by IP address. According to FLEXnet documentation, "Anywhere a host name can be used in an options file, an IP address can be used instead."

User names and computer names on INCLUDE and EXCLUDE lines are always case sensitive. But you can make them case insensitive on GROUP and HOST_GROUP lines by including this line in the options file:

GROUPCASEINSENSITIVE ON

If you EXCLUDE a group, you cannot then INCLUDE one user or computer from that group, because EXCLUDE always wins.

Caution: If your network license is activatable and you use INCLUDE…GROUP lines for a feature, users will be allowed to run the software on-network but no one will be able to borrow a license for off-network use.

This restriction does not apply to certificate-type licenses or to INCLUDE…HOST_GROUP lines.

More Options for On-Network Use

With MAX and RESERVE lines, you can allocate licenses among user groups.

MAX 2 DecisionTools80_Professional GROUP Muggles

Members of the Muggles group may not use more than 2 DecisionTools Professional licenses at a time. If two Muggles are already using licenses and a third member of that group tries to run the software, the request will be denied, even if some licenses are not in use.

RESERVE 2 DecisionTools80_Professional HOST_GROUP Wizards

Two DecisionTools Professional licenses are reserved for computers in the Wizards group.
Any other user can access a license only if the number of free licenses plus the number currently used by the Wizards group is greater than two.

RESERVE 1 DecisionTools80_Professional USER Frances

This setting is generally not recommended.

• Reserving a concurrent network license for Frances is inefficient, and a standalone license would be better.
• However, it can be useful temporarily, such as when she is teaching a class and needs guaranteed license access during that time.

Options for Borrowing

1. Borrowing works for both certificate and activatable concurrent network licenses, and all standard access-control options apply to either. However, the borrowing-control options in this section work only with certificate licenses.
   1. If used with an activatable license, they are ignored with no log warning.
      
   2. If you need these options and currently have an activatable license, contact Technical Support to surrender it and receive a certificate license. No software reinstall is required.
   3. Support can be reached by logging into the Lumivero Community Home Page and clicking on the Submit a Case button.
   4. Borrow Entry Examples:

Entry:  BORROW_LOWWATER DecisionTools80_Professional 4
Meaning: Authorized users may borrow licenses, but there will always be at least 4 unborrowed
licenses. This ensures that at least some users will still be able to run on network.

 

Entry 1: EXCLUDE_BORROW DecisionTools80_Professional USER Denise 

Entry 2: EXCLUDE_BORROW DecisionTools80_Professional HOST_GROUP Contractors
Meaning: Denise, and members of the Contractors group, can borrow a DecisionTools80_Professional
license for off-network use.
Other authorized users can use a license while on network but cannot borrow it. 

 

Entry 1: EXCLUDE_BORROW DecisionTools70_Professional USER Denise

Entry 2: EXCLUDE_BORROW DecisionTools70_Professional HOST_GROUP Contractors
Meaning: Denise, on any computer, and anyone on computers in the Contractors group,
cannot borrow a DecisionTools80_Professional license for off-network use, but
they can still run on network unless you have separate INCLUDE or EXCLUDE lines forbidding that.
Other authorized users can use a license while on network and can borrow it for off-network use.

2. Users are allowed to borrow only the license they are currently using.

1. 1. It's not possible to configure borrowing options so that a license CAN be borrowed for off network use but cannot be borrowed for on network use

3. If you have any INCLUDE_BORROW lines, any users not mentioned on those lines are prohibited from borrowing.

4. If the same user is covered by an INCLUDE_BORROW line and an EXCLUDE_BORROW line, explicitly or as part of a group, then EXCLUDE_BORROW wins.

5. If an unauthorized user tries to borrow, or if any user tries to borrow when no more borrowable licenses are left, the borrow operation will fail "for an unknown reason". The administrator can find the reason by looking at the log file. See the next section to access the log file.

Troubleshooting License Denials

If a user is locked out of a license, the client software will tell them only that there is no license.

• You can find specific reasons for a lockout in the log file on the server.
• The log file is PalisadeService.log, in the same folder where DTS Server Manager is installed.
• You can access it directly in Windows Explorer, or run Server Manager and click Open .LIC Folder. Either way, scroll to the bottom of the file and you'll see why the license was denied.

 

Related Articles:

Monitoring Network License Usage