License Management

Capabilities

Posit Connect uses a built-in license management system. A Posit Connect product license limits usage in the following ways:

• Number of user accounts that have signed into Posit Connect.

  Once the user account limit is reached, additional users will not be permitted to sign into Posit Connect. This limit is enforced the first time each user logs in.

  Locked users are not counted against this quota.

  Users not recently active on the server are not counted against this quota. Users are deemed “inactive” after 365 days without visiting Posit Connect, though this value may vary for certain licenses.

• Number of users that can access Shiny applications at one moment in time (legacy license feature).

  When this limit is exceeded, new anonymous users are unable to view the requested application. This limitation does not affect logged-in users. This limitation does not apply to licenses issued after March 2024, under our current product tiers.

• Restrictions on interactive content backed by a server component (e.g. FastAPI applications, Shiny applications).

  Log-in may be required to access interactive content. Licenses may permit public-access hosting of interactive content.

• Support for hosting of API content.

• Rendered and static content that does not require login may display a dismissible “Powered by Posit Connect” badge (e.g., rendered content such as Quarto projects, and static content such as HTML documents and pins).

• Support for branding customization.

• Support for current user execution (Applications.RunAsCurrentUser).

• Support for off-host execution.

The settings of each metric depend on the license purchased from Posit.

Contact Posit Sales (sales@posit.co) to purchase a Posit Connect product license.

Adjust the capabilities included in your existing Posit Connect license through your dedicated Posit Customer Success contact or email upgrade@posit.co.

Product tiers

Product tiers have been introduced for Posit Connect, called, Basic, Enhanced, Advanced. Additionally, Enhanced Public Access and Advanced Public Access licenses enable the hosting of public-access interactive content. Advanced Unrestricted licenses enable the hosting of anonymously-accessed, network-controlled content.

These tiers include different features, number of server activations, and pricing than our previous product tiers (called Base, Standard, and Enterprise).

Current license holders

Existing licenses remain valid and are not affected by the introduction of the Basic, Enhanced, and Advanced product tiers. You will continue to have access to the same product features for the length of that license.

Starting in 2024, renewals will receive an updated license that corresponds to one of the product tiers.

Product tier badges

• Features not labeled with a product tier badge are available to all product tiers, including Basic.
• Features which require the Enhanced tier are labeled with an Enhanced badge. (Enhanced features are also available in the Advanced tier.)
• Features which require the Advanced tier are labeled with an Advanced badge.

Evaluation

When Posit Connect is first installed on a system it operates in evaluation mode for a period of time and then subsequently requires activation for continued use. If you find that an automatic evaluation is not available on your system, speak to your dedicated Posit Customer Success contact or email Posit Sales (sales@posit.co) about your evaluation.

Public access content verification

To enable public access (“Anyone - no login required”, acl) for interactive content (e.g. Shiny applications, FastAPI APIs), you must have an Enhanced or Advanced license with the Public Access entitlement. Without this entitlement, interactive content is restricted to the “All users - login required” (logged_in) and “Specific users or groups” (acl) access types. Speak to your Posit Customer Success contact or email upgrade@posit.co for more information about a license which allows Public Access.

Note

If you own or have been approved to test a license that entitles you to unrestricted public access, the Advanced Unrestricted license type includes the Public Access entitlement, without requiring the public URL verification described below. This license allows you to share content with anonymous users on an internal or private network.

If there are questions about your license or license entitlement please contact your Posit account team.

Public Access content must be available on the public internet. When you use the “Anyone - no login required” access type to host public content, Posit Connect will verify that the content is publicly available online by reaching out to a Posit server at regular intervals.

Note

When using Posit Connect with a license that enables Public Access, but does not include Unrestricted access, the following must be configured:

• Connect must have outbound access to the URL validation server, which is located at https://verify.pct.posit.co/url-validator using port 443.
• The X-Content-Signature and Date headers must not be edited or removed from HTTP requests or responses by any proxies as they are required when communicating to the URL validation server.
• Connect’s configuration setting Server.Address must specify the server’s publicly-accessible URL.
• Content set to public access must be available on the public internet.

If there are questions about your license or license entitlement please contact your Posit account team.

Verification begins when a content item first uses the “Anyone - no login required” access type on a version of Connect supporting Public Access. Connect will periodically check the URLs for public access content.

The verification process allows for occasional network failures or temporary configuration issues and does not display a warning message in the dashboard if verification fails a few times (each failure is logged; see below). After an initial grace period, if Connect is unable to verify public access, the Connect dashboard access settings for the affected content displays a warning message. If verification problems continue, content is restricted to the “All users - login required” access type, and anonymous access to the content is prohibited.

Connect logs a warning each time a content item fails verification. Check your server logs for messages like this:

time="2024-09-25T13:51:33.458Z" level=warning msg="Content is configured for public access, but Connect failed to validate its public availability (checked at 2024-09-25 13:51:33 +0000 UTC)" content_guid=47f772c7-133a-4ad0-95db-b69f067d12cd

If content on your Posit Connect server has failed verification, your server’s network configuration may need adjusting. Please contact Posit customer support for assistance (support@posit.co).

Public Access content verification is designed to validate compliance with Posit EULA and SLD terms through the transmission of a minimal data packet.

We do not transmit any user data.

The only data sent from a customer server to Posit includes:

• the license key for Posit Connect,
• the current product (Posit Connect) version,
• and a list of public access interactive content, which includes: the content GUID, content type (e.g., Shiny, Plumber API), and the public URL.

Licensing status

Determine the current license status of your system with the command:

sudo /opt/rstudio-connect/bin/license-manager status

Offline licensing status check

You can perform an offline check of your current license status using the following command:

$ sudo /opt/rstudio-connect/bin/license-manager status-offline

Activation options

After purchasing a Posit Connect license, use the license file you receive to activate the product license on the system that runs Posit Connect.

• License file activation

  Almost all installations use license files. This is the recommended approach.

• License key activation

  Older installations may use license keys.

  • With direct internet access
  • Internet access through a proxy server
  • Offline activation

• Floating licensing with a persistent license server

  Older containerized installations may use floating license keys.

  • With direct internet access
  • Offline activation

License file

A license file is an encrypted text file with a name having the shape <expiration-date>_<product-code>_<organization>_<license-key>.lic.

The license file fully describes the purchased product license. It includes details such as the expiration date and entitlements permitted by the license. License files do not communicate with an external licensing provider, making them suitable for containerized, offline, and air-gapped environments. License files are the recommended way to provide a license to Posit Connect.

You must ensure that the license file is secured, used only in your environment, and within the bounds of your license agreement.

When a *.lic file exists in the /var/lib/rstudio-connect/ directory, other licensing methods are bypassed.

The Licensing FAQ provides information about common issues and questions that you may have when activating or switching your current activations to license files. If you are having issues using your license file, please speak to Posit customer support (support@posit.co).

Activation

Transfer the license file to the server hosting Posit Connect and activate it with the commands:

sudo chown root <license-file>.lic
sudo chmod 0600 <license-file>.lic
sudo cp -a <license-file.lic> /var/lib/rstudio-connect/
sudo systemctl restart rstudio-connect

These commands copy the license file into the /var/lib/rstudio-connect directory and ensure it is owned by root and cannot be read by other users.

The activated license takes effect after restarting Posit Connect.

Note

Your platform may use alternate commands to restart Posit Connect. Please see the Stopping and Starting section for instructions specific to your operating system version.

Deactivation

You must deactivate your license before moving it to another system. If you are using a license file in a container, there is no need to worry about deactivation when the container is terminated.

Deactivate your license file by removing it from the /var/lib/rstudio-connect/ directory:

rm /var/lib/rstudio-connect/*.lic
sudo systemctl restart rstudio-connect

Note

Your platform may use alternate commands to restart Posit Connect. Please see the Stopping and Starting section for instructions specific to your operating system version.

License key

A license key is a combination of letters and numbers with the shape AAAA-BBBB-CCCC-DDDD-EEEE-FFFF-GGGG.

In rare cases, you may need to activate a license key, as described below. However, most customers are best served by using license files. License files work well in all environments including ephemeral, container-based, or air-gapped environments.

Online activation

Connectivity requirements

Activating and deactivating a Posit Connect license key requires internet connectivity in order to communicate with the licensing server. More information on specific networking access is available on the Posit Networking page.

Additionally, your server should have a synchronized system clock, using ntp or some other clock syncing service. If the server clock is sufficiently incorrect, licensing verification fails.

If you have internet access and are not using an internet proxy, activate your license key with the commands below:

sudo /opt/rstudio-connect/bin/license-manager activate <license-key>
sudo systemctl restart rstudio-connect

Note

Posit uses LimeLM TurboActivate and TurboFloat by wyDay for license management as an approved part of our software delivery infrastructure. As such, for online license activation, you need to allow outbound access to wyday.com.

If needed, add the port number from where the activation key is being downloaded so it can be added to a safe sites list by your networking team:

Address	Port
https://www.wyday.com	443

Proxy servers

If your server is behind an internet proxy, you may need to add an additional command line flag indicating the address and credentials required to communicate through the proxy. This may not be necessary if either the http_proxy or all_proxy environment variable is defined (these are read and used by the license manager when available).

If you do need to specify a proxy server explicitly, use the --proxy command line parameter. For example:

sudo /opt/rstudio-connect/bin/license-manager \
    --proxy=http://127.0.0.1/ \
    activate <license-key>
sudo systemctl restart rstudio-connect

Proxy settings can include a host-name, port, and username/password if necessary. The following are all valid proxy configurations:

http://127.0.0.1/
http://127.0.0.1:8080/
http://user:pass@127.0.0.1:8080/

If the port is not specified, the license manager will default to using port 1080.

Online deactivation

If you want to move your license of Posit Connect to another system you should first deactivate it on the old system with the command:

sudo /opt/rstudio-connect/bin/license-manager deactivate

Then run the activation command on the new system.

Offline activation

If your system has no connection to the internet, it’s also possible to perform an offline activation. To do this, use our offline activation app, which will walk you through the process: Posit Offline Activation To activate your license offline, first generate an offline activation request:

sudo /opt/rstudio-connect/bin/license-manager \
    activate-offline-request <license-key>

Executing this command prints an offline activation request to the terminal. Copy and paste the entirety of this request into our offline self-service application, or send it to Posit customer support (support@posit.co). You will receive a reply with an XML file attachment that can be used to activate offline as follows:

sudo /opt/rstudio-connect/bin/license-manager \
    activate-offline <activation-file>
sudo systemctl restart rstudio-connect

The activated license takes effect after restarting Posit Connect.

Offline deactivation

If you are renewing your license or want to move your license of Posit Connect to another system, you can perform license deactivation offline by executing the following:

sudo /opt/rstudio-connect/bin/license-manager deactivate-offline

Executing this command prints an offline deactivation request to the terminal. Copy and paste that text into the offline activation application or send it to Posit customer support (support@posit.co).

After deactivating the license on the old system, run the activation command on the new system.

Floating licensing

In rare cases, you may need to activate a license key on a floating license server, described below. However, most customers are best served by using license files. License files work well in all environments including ephemeral, container-based, or air-gapped environments.

To use floating licensing, you run a small, lightweight server, which holds a license that grants you the right to run a certain number of concurrent Posit Connect instances.

When Posit Connect starts, it connects to the license server and obtains a temporary lease, releasing it when Posit Connect is stopped. Using this method, you can have any number of Posit Connect instances, as long as you don’t exceed the number of instances allowed by your license.

Floating license keys

A license key which distributes floating license leases is not the same as a traditional license key, and the two cannot be used interchangeably. If you have purchased traditional license keys and wish to exchange them for a floating license key, or vice versa, please get in touch with Posit customer support (support@posit.co).

The Posit Connect License Server

The Posit License Server site contains license server downloads for all Posit products. Download and install the license server for Posit Connect. You then activate your license key with the command:

sudo dpkg -i connect-license-server-1.0.9-x86_64.deb
sudo connect-license-server activate <license-key>
sudo connect-license-server start

The file /etc/connect-license-server.conf contains configuration settings for the Posit Connect License server, including the network port to listen on and any proxy settings required for connecting to the Internet.

License Server hardware requirements

While the license server is designed to distribute licenses to ephemeral virtual machines or containers, which may move freely between hosts, the license server itself must stay on the same physical host on which it was activated.

It is acceptable to run the license server inside a container or a virtual machine, as long as the container or the VM always runs on the same hardware. Stopping the license server, moving it to a different physical host, and starting it again will cause it to become deactivated. Because it’s often impractical to try to ensure that the server only runs on a particular host, we recommend running the license server outside containers and virtualization software.

Note that the system requirements for the license server are very low, so it can be run on almost any server. If your environment will not allow for ensuring that the server stays on a single physical host, please contact Posit customer support (support@posit.co) to discuss alternate licensing options.

License Server deactivation

If you are permanently decommissioning your license server, or need to transfer its license to a different license server, you should deactivate (remove) its license as follows:

sudo connect-license-server deactivate

License Server offline activation

The connect-license-server activate command requires an internet connection. If your license server has no connection to the Internet it’s also possible to perform an offline activation. The process for doing this on the license server is identical to the process used to activate Posit Connect offline. Generate an offline activation request as follows:

sudo connect-license-server activate-offline-request <license-key>

Executing this command prints an offline activation request to the terminal which you should copy and paste the entire response of into our self-service Offline Activation application activation application>, or send it to Posit customer support (support@posit.co). You will receive a reply with a file attachment that can be used to activate offline as follows:

sudo connect-license-server activate-offline <activation-file>
sudo connect-license-server restart

License Server offline deactivation

If you are renewing your floating license offline or if you want to move your floating license for Posit Connect to another system, then you can perform license deactivation offline.

To do this, run the following command:

sudo connect-license-server deactivate-offline-request <license-key>

Executing this command prints an offline activation request to the terminal which you should copy and paste the entire response of into our self-service Offline Activation application activation application>, or send it to Posit customer support (support@posit.co).

Using floating licensing

Once your license server is up and running, configure Posit Connect to use floating licensing instead of traditional licensing.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
LicenseType = remote

The value remote for Licensing.LicenseType indicates that Posit Connect should connect to a remote licensing server to obtain a license; the value local can be used to explicitly specify traditional (local) activation.

Then, tell Posit Connect which licensing server to connect to:

sudo /opt/rstudio-connect/bin/license-manager \
    license-server <server-hostname-or-ip>
sudo systemctl restart rstudio-connect

You only need to run the license-server command once; Posit Connect saves the server name and will use it on each subsequent startup.

Depending on your system configuration, it is possible that the Posit Connect service will be started before the service which allows hostname resolution (this is known to be the case for example on some Amazon EC2 systems). If this is the case, you’ll want to specify the license server using a private IP address rather than a hostname, so that Posit Connect can acquire a license immediately when starting up.

Specifying a License Server

Posit Connect supports three methods for connecting to a license server. You can select the method by specifying the license server as follows:

Connecting over TCP

sudo /opt/rstudio-connect/bin/license-manager \
    license-server <mylicensehost:8999>
sudo systemctl restart rstudio-connect

By default, the Posit Connect License Server listens via raw TCP on port 8999. If you specify only the hostname or IP address of the license server, this is the kind of license server you’ll get.

If you wish to use a different port, you will need to specify the port in /etc/connect-license-server.conf, and specify license-server to the license manager as <server-hostname-or-ip:port>.

Connecting over HTTPS

sudo /opt/rstudio-connect/bin/license-manager \
    license-server https://<mylicensehost>/
sudo systemctl restart rstudio-connect

You can also connect to the license server via HTTPS rather than raw TCP. This can be useful when using proxies or load balancers in front of the license server. Note that the license server does not use HTTPS by default, so you can only use this connectivity method if you have configured your license server to use HTTPS.

Configuring the license server for HTTPS support is outside the scope of this guide. You can read instructions here: Configuring TurboFloat Server for HTTPS Communication

Connecting to a hosted server

sudo /opt/rstudio-connect/bin/license-manager license-server <UUID>
sudo systemctl restart rstudio-connect

Finally, if you are connecting to a hosted license server, specify the UUID of the server rather than its hostname. Hosted license servers are run by our licensing vendor, WyDay, and do not require you to run anything in your own network. Read more about setting up a hosted license server and getting a UUID here: Creating a LicenseChest Server

Configuring license leases

When using floating licenses, you can optionally determine how long the license leases last by setting the lease length value on the licensing server. This value is in seconds, so for instance to make license leases last 30 minutes you would use the following syntax:

/etc/connect-license-server.conf

<lease length="1800"/>

The lease length controls how frequently the Posit Connect instances need to contact the licensing server to renew their license leases in order for the lease to remain valid.

A shorter lease length will increase tolerance to failures on Posit Connect instances by making leases available for reuse more quickly. Posit Connect will release its lease immediately if shut down normally, but if abnormally terminated, the lease will not be released until it expires.

A longer lease length will increase tolerance to transient failures on the network and the Posit Connect License Server. Any such issues that can be resolved before the lease is due for renewal won’t interrupt use of Posit Connect.

We generally recommend using a longer lease length. Use a short lease length only if your environment routinely encounters abnormal terminations of the server or the container/instance on which it runs.

Tip

If Posit Connect is running inside a container, gracefully stop that container. For example, use docker stop rather than docker kill. When the Connect container is gracefully terminated, floating license leases are released cleanly. License leases not returned to the license server need to wait for lease expiration before they can be reused.

License server downtime tolerance

Posit Connect does not wait until its lease has fully expired before it renews it. It renews its lease when it is halfway to expiry. For instance, if you use 30 minute leases, Posit Connect will actually renew its lease every 15 minutes.

This means that it is possible to take down the license server for a short period of time without affecting any running Posit Connect instances. Because of the aforementioned behavior, no existing lease will be more than halfway to expiry if the server goes down.You have a grace period of N/2 (where N is the length of the lease) during which the server can be offline without consequences. For instance, if you use 30 minute leases, your license server can be offline for 15 minutes.

Lease expiration and renewal

Under normal conditions Posit Connect will automatically renew its license lease in a configurable interval as described above. However, there are situations in which it will be unable to do so, such as a network problem, or an issue on the host running the license server.

When Posit Connect cannot obtain a license lease, either because there are no leases currently available or because it can’t reach the licensing server, it will begin automatically attempting to acquire a lease every 10 seconds. This interval is configurable through the Licensing.RemoteRetryFrequency setting. For example, to retry every 30 seconds, use the configuration:

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
RemoteRetryFrequency = 30s

If you don’t want Posit Connect to attempt to reestablish a license lease automatically, set the value to 0 to disable retries. In this case you will need to manually restart Posit Connect in order to reestablish the lease. This can be useful if you often run more instances than you have keys for, and wish to have more control over which Posit Connect instances receive license leases from the limited pool on the license server.

Troubleshooting floating licensing

To validate that the license server has been successfully activated, run the activation-status command. This will report the version of the server as well as the license key and the number of available slots.

sudo connect-license-server activation-status

If your server is activated but you’re still having trouble with floating licensing, you can tell the Posit Connect License Server to emit more detailed logs. Change the log level to notification:

<!-- /etc/connect-license-server.conf -->
<log file="/var/log/rstudio-licensing.log" level="notification"/>

Then, restart the license server, tail the licensing log, and start your Posit Connect instances.

sudo connect-license-server restart
tail -f /var/log/rstudio-licensing.log

At the notification level, the licensing log will tell you the total number of licenses associated with your key, and how many are currently in use. It will also notify you when Posit Connect instances acquire leases, and when those leases are released, renewed, or expired. No rotation is done for this log, so it’s recommended to use the warning level in production.

Expiration notification

Posit Connect attempts to send email to administrators when the license key is 60 days from expiration. You can disable this behavior with the Licensing.ExpirationEmail setting.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
ExpirationEmail = false

The Connect Dashboard displays a notification to administrators and publishers when the license is within 15 days of expiration. You can disable this behavior with the Licensing.ExpirationUIWarning setting.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
ExpirationUIWarning = false

End-of-support notification

Posit Connect product support is described by the Posit Support Program.

At startup, Connect logs when the product support window ends.

System checks indicate when the product version support window ends.

The Connect Dashboard documentation page indicates when the product support window ends.

The Connect Dashboard displays a warning banner to administrators when the product version support window has ended.

This notification can be disabled with Licensing.EndOfSupportUIWarning.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
EndOfSupportUIWarning = false

The dashboard is not able to present this warning or show information about the product support window when Server.HideVersion is enabled.

Licensing errors

Posit Connect uses the license-manager to determine if a valid license is available. Should an error occur when interacting with the license manager, Connect indicates that problem in the /var/log/rstudio/rstudio-connect/rstudio-connect.log log. The license manager sends details about the error to the system messages (syslog). You should consult both locations if Connect cannot obtain a license.

Connect also displays an error page with an appropriate message if a requested feature is not supported by your license. Adjust the capabilities included in your existing Posit Connect license through your dedicated Posit Customer Success contact or email upgrade@posit.co.