License Management

Capabilities

Posit Connect uses a built-in license management system. A Posit Connect product license limits usage in the following ways:

  • Number of user accounts that have signed into Posit Connect.

    Once the user account limit is reached, additional users will not be permitted to sign into Posit Connect. This limit is enforced the first time each user logs in.

    Locked users are not counted against this quota.

    Users not recently active on the server are not counted against this quota. Users are deemed “inactive” after 365 days without visiting Posit Connect, though this value may vary for certain licenses.

  • Number of users that can access Shiny applications at one moment in time (legacy license feature).

    When this limit is exceeded, new anonymous users are unable to view the requested application. This limitation does not affect logged-in users. This limitation does not apply to licenses issued after March 2024, under our current product tiers.

  • Restrictions on interactive content backed by a server component (e.g. FastAPI applications, Shiny applications).

    Log-in may be required to access interactive content. Licenses may permit public-access hosting of interactive content.

  • Support for hosting of API content.

  • Rendered and static content that does not require login may display a dismissible “Powered by Posit Connect” badge (e.g., rendered content such as Quarto projects, and static content such as HTML documents and pins).

  • Support for branding customization.

  • Support for current user execution (Applications.RunAsCurrentUser).

  • Support for off-host execution.

The settings of each metric depend on the license purchased from Posit.

Contact Posit Sales () to purchase a Posit Connect product license.

Adjust the capabilities included in your existing Posit Connect license through your dedicated Posit Customer Success contact or email .

Product tiers

Product tiers have been introduced for Posit Connect, called, Basic, Enhanced, Advanced. Additionally, Enhanced Public Access and Advanced Public Access licenses enable the hosting of public-access interactive content. Advanced Unrestricted licenses enable the hosting of anonymously-accessed, network-controlled content.

These tiers include different features, number of server activations, and pricing than our previous product tiers (called Base, Standard, and Enterprise).

Current license holders

Existing licenses remain valid and are not affected by the introduction of the Basic, Enhanced, and Advanced product tiers. You will continue to have access to the same product features for the length of that license.

Starting in 2024, renewals will receive an updated license that corresponds to one of the product tiers.

Product tier badges

  • Features not labeled with a product tier badge are available to all product tiers, including Basic.
  • Features which require the Enhanced tier are labeled with an Enhanced badge. (Enhanced features are also available in the Advanced tier.)
  • Features which require the Advanced tier are labeled with an Advanced badge.

Evaluation

When Posit Connect is first installed on a system it operates in evaluation mode for a period of time and then subsequently requires activation for continued use. If you find that an automatic evaluation is not available on your system, speak to your dedicated Posit Customer Success contact or email Posit Support () to speak about your evaluation.

Public access content verification

To enable public access (“Anyone - no login required”, acl) for interactive content (e.g. Shiny applications, FastAPI APIs), you must have an Enhanced or Advanced license with the Public Access entitlement. Without this entitlement, interactive content is restricted to the “All users - login required” (logged_in) and “Specific users or groups” (acl) access types. Speak to your Posit Customer Success contact or email for more information about a license which allows Public Access.

Note

If you own or have been approved to test a license that entitles you to unrestricted public access, the Advanced Unrestricted license type includes the Public Access entitlement, without requiring the public URL verification described below. This license allows you to share content with anonymous users on an internal or private network.

If there are questions about your license or license entitlement please contact your Posit account team.

Public Access content must be available on the public internet. When you use the “Anyone - no login required” access type to host public content, Posit Connect will verify that the content is publicly available online by reaching out to a Posit server at regular intervals.

Note

When using Posit Connect with a license that enables Public Access, but does not include Unrestricted access, the following must be configured:

  • Connect must have outbound access to the URL validation server, which is located at https://verify.pct.posit.co/url-validator using port 443.
  • The X-Content-Signature and Date headers must not be edited or removed from HTTP requests or responses by any proxies.
  • Connect’s configuration setting Server.Address must specify the server’s publicly-accessible URL.
  • Content set to public access must be available on the public internet.

If there are questions about your license or license entitlement please contact your Posit account team.

Verification begins when a content item first uses the “Anyone - no login required” access type on a version of Connect supporting Public Access. Connect will periodically check the URLs for public access content.

The verification process allows for occasional network failures or temporary configuration issues and does not display a warning message in the dashboard if verification fails a few times (each failure is logged; see below). After an initial grace period, if Connect is unable to verify public access, the Connect dashboard access settings for the affected content displays a warning message. If verification problems continue, content is restricted to the “All users - login required” access type, and anonymous access to the content is prohibited.

Connect logs a warning each time a content item fails verification. Check your server logs for messages like this:

time="2024-09-25T13:51:33.458Z" level=warning msg="Content is configured for public access, but Connect failed to validate its public availability (checked at 2024-09-25 13:51:33 +0000 UTC)" content_guid=47f772c7-133a-4ad0-95db-b69f067d12cd

If content on your Posit Connect server has failed verification, your server’s network configuration may need adjusting. Please contact Posit customer support for assistance ().

Public Access content verification is designed to validate compliance with Posit EULA and SLD terms through the transmission of a minimal data packet.

We do not transmit any user data.

The only data sent from a customer server to Posit includes:

  • the license key for Posit Connect,
  • the current product (Posit Connect) version,
  • and a list of public access interactive content, which includes: the content GUID, content type (e.g., Shiny, Plumber API), and the public URL.

Licensing status

Determine the current license status of your system with the command:

sudo /opt/rstudio-connect/bin/license-manager status

Activation options

After purchasing a Posit Connect license, you will receive a license key or license file that can be used to activate the license on a given system.

Using license files

A license file is an encrypted text file with a name having the shape <expiration-date>_<product-code>_<organization>_<license-key>.lic.

Using license keys

A license key is a combination of letters and numbers with the shape AAAA-BBBB-CCCC-DDDD-EEEE-FFFF-GGGG.

License file

A license file is an encrypted text file that fully describes the purchased product license. It includes details like the expiration date, number of users, and entitlements permitted by the license. Use of license files does not communicate with an external licensing provider, making it suitable for containerized, offline, and air-gapped environments.

If you are having issues with one of the other licensing methods, please speak to Posit customer support () about using license files.

Important

You must ensure that the license file is secured, used only in your environment, and within the bounds of your license agreement.

Activation

Transfer the license file to the server hosting Posit Connect and activate it with the commands:

sudo chown root <license-file>.lic
sudo chmod 0600 <license-file>.lic
sudo cp -a <license-file.lic> /var/lib/rstudio-connect/
sudo systemctl restart rstudio-connect

When a *.lic file is found beneath the /var/lib/rstudio-connect directory, other licensing methods are bypassed.

Note that you need to restart Connect after activation for licensing changes to take effect.

Note

Your platform may use alternate commands to restart Posit Connect. Please see the Stopping and Starting section for instructions specific to your operating system version.

Deactivation

Deactivate a license file by removing it from the /var/lib/rstudio-connect directory.

rm /var/lib/rstudio-connect/*.lic
sudo systemctl restart rstudio-connect
Note

Your platform may use alternate commands to restart Posit Connect. Please see the Stopping and Starting section for instructions specific to your operating system version.

Deactivate your license file before moving the license to another system.

If you are using a license file in a container, there is no need to worry about deactivation when the container is terminated.

License key

You can activate a license key locally or through a persistent server. This section describes local activation. You may want to use floating licensing with a persistent server if you frequently start and stop Connect instances.

Online activation

Connectivity requirements

Activating and deactivating a Posit Connect license key requires internet connectivity in order to communicate with the licensing server.

Additionally, your server should have a synchronized system clock, using ntp or some other clock syncing service. If the server’s clock is sufficiently incorrect, licensing verification fails.

If you have internet access and are not using an internet proxy, activate your license key with the commands below:

sudo /opt/rstudio-connect/bin/license-manager activate <product-key>
sudo systemctl restart rstudio-connect
Note

Posit uses LimeLM TurboActivate and TurboFloat by wyDay for license management as an approved part of our software delivery infrastructure. As such, for online license activation, you need to allow outbound access to wyday.com.

If needed, add the port number from where the activation key is being downloaded so it can be added to a safe sites list by your networking team:

Address Port
https://www.wyday.com 443

Proxy servers

If your server is behind an internet proxy, you may need to add an additional command line flag indicating the address and credentials required to communicate through the proxy. This may not be necessary if either the http_proxy or all_proxy environment variable is defined (these are read and used by the license manager when available).

If you do need to specify a proxy server explicitly, use the --proxy command line parameter. For example:

sudo /opt/rstudio-connect/bin/license-manager \
    --proxy=http://127.0.0.1/ \
    activate <product-key>
sudo systemctl restart rstudio-connect

Proxy settings can include a host-name, port, and username/password if necessary. The following are all valid proxy configurations:

http://127.0.0.1/
http://127.0.0.1:8080/
http://user:pass@127.0.0.1:8080/

If the port is not specified, the license manager will default to using port 1080.

Online deactivation

If you want to move your license of Posit Connect to another system you should first deactivate it on the old system with the command:

sudo /opt/rstudio-connect/bin/license-manager deactivate

Offline activation

If your system isn’t connected to the internet, then perform an offline activation.

To activate your license offline, first generate an offline activation request:

sudo /opt/rstudio-connect/bin/license-manager \
    activate-offline-request <product-key>

Executing this command prints an offline activation request to the terminal which you should copy and paste and enter into our offline activation application or send to Posit customer support (). You will receive a reply with a file attachment that can be used to activate offline as follows:

sudo /opt/rstudio-connect/bin/license-manager \
    activate-offline <activation-file>
sudo systemctl restart rstudio-connect

Offline deactivation

If you are renewing your license or want to move your license of Posit Connect to another system you can perform license deactivation offline by executing the following:

sudo /opt/rstudio-connect/bin/license-manager deactivate-offline

Executing this command prints an offline deactivation request to the terminal which you should copy and paste and enter into the offline activation application then send to Posit customer support ().

Floating licensing

If you stop and start Posit Connect instances frequently, for instance because you’re running them inside virtual machines or containers, you may wish to use floating licensing instead of traditional licensing.

To use floating licensing, you run a small, lightweight server, which holds a license that grants you the right to run a certain number of concurrent Posit Connect instances.

When Posit Connect starts, it will connect to the license server and obtain a temporary lease, releasing it when Posit Connect is stopped. Using this method, you can have any number of Posit Connect instances, so long as you do not run more instances at once than specified in your license.

Floating license keys

A license key which distributes floating license leases is not the same as a traditional license key, and the two cannot be used interchangeably. If you have purchased traditional license keys and wish to exchange them for a floating license key, or vice versa, please get in touch with Posit Support ().

The Posit Connect License Server

The Posit License Server site contains license server downloads for all Posit products. Download and install the license server for Posit Connect. You then activate your license key with the command:

sudo dpkg -i connect-license-server-1.0.9-x86_64.deb
sudo connect-license-server activate <product-key>
sudo connect-license-server start

The file /etc/connect-license-server.conf contains configuration settings for the Posit Connect License server, including the network port to listen on and any proxy settings required for connecting to the Internet.

License Server hardware requirements

While the license server is designed to distribute licenses to ephemeral virtual machines or containers, which may move freely between hosts, the license server itself must stay on the same physical host on which it was activated.

It is acceptable to run the license server inside a container or a virtual machine, as long as the container or the VM always runs on the same hardware. Stopping the license server, moving it to a different physical host, and starting it again will cause it to become deactivated. Because it’s often impractical to try to ensure that the server only runs on a particular host, we recommend running the license server outside containers and virtualization software.

Note that the system requirements for the license server are very low, so it can be run on almost any server. If your environment will not allow for ensuring that the server stays on a single physical host, please contact Posit Support () to discuss alternate licensing options.

License Server deactivation

If you are permanently decommissioning your license server, or need to transfer its license to a different license server, you should deactivate (remove) its license as follows:

sudo connect-license-server deactivate

License Server offline activation

The connect-license-server activate command requires an internet connection. If your license server has no connection to the Internet it’s also possible to perform an offline activation. The process for doing this on the license server is identical to the process used to activate Posit Connect offline. Generate an offline activation request as follows:

sudo connect-license-server activate-offline-request <product-key>

Executing this command prints an offline activation request to the terminal which you should copy and paste the entire response of into our self-service Offline Activation application activation application>, or send it to Posit Support. You will receive a reply with a file attachment that can be used to activate offline as follows:

sudo connect-license-server activate-offline <activation-file>
sudo connect-license-server restart

License Server offline deactivation

If you are renewing your floating license offline or if you want to move your floating license for Posit Connect to another system, then you can perform license deactivation offline.
To do this, run the following command:

sudo connect-license-server deactivate-offline-request <product-key>

Executing this command prints an offline activation request to the terminal which you should copy and paste the entire response of into our self-service Offline Activation application activation application>, or send it to Posit Support.

Using floating licensing

Once your license server is up and running, configure Posit Connect to use floating licensing instead of traditional licensing.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
LicenseType = remote

The value remote for Licensing.LicenseType indicates that Posit Connect should connect to a remote licensing server to obtain a license; the value local can be used to explicitly specify traditional (local) activation.

Then, tell Posit Connect which licensing server to connect to:

sudo /opt/rstudio-connect/bin/license-manager \
    license-server <server-hostname-or-ip>
sudo systemctl restart rstudio-connect

You only need to run the license-server command once; Posit Connect saves the server name and will use it on each subsequent startup.

Depending on your system configuration, it is possible that the Posit Connect service will be started before the service which allows hostname resolution (this is known to be the case for example on some Amazon EC2 systems). If this is the case, you’ll want to specify the license server using a private IP address rather than a hostname, so that Posit Connect can acquire a license immediately when starting up.

Specifying a License Server

Posit Connect supports three methods for connecting to a license server. You can select the method by specifying the license server as follows:

Connecting over TCP

sudo /opt/rstudio-connect/bin/license-manager \
    license-server <mylicensehost:8999>
sudo systemctl restart rstudio-connect

By default, the Posit Connect License Server listens via raw TCP on port 8999. If you specify only the hostname or IP address of the license server, this is the kind of license server you’ll get.

If you wish to use a different port, you will need to specify the port in /etc/connect-license-server.conf, and specify license-server to the license manager as <server-hostname-or-ip:port>.

Connecting over HTTPS

sudo /opt/rstudio-connect/bin/license-manager \
    license-server https://<mylicensehost>/
sudo systemctl restart rstudio-connect

You can also connect to the license server via HTTPS rather than raw TCP. This can be useful when using proxies or load balancers in front of the license server. Note that the license server does not use HTTPS by default, so you can only use this connectivity method if you have configured your license server to use HTTPS.

Configuring the license server for HTTPS support is outside the scope of this guide. You can read instructions here: Configuring TurboFloat Server for HTTPS Communication

Connecting to a hosted server

sudo /opt/rstudio-connect/bin/license-manager license-server <UUID>
sudo systemctl restart rstudio-connect

Finally, if you are connecting to a hosted license server, specify the UUID of the server rather than its hostname. Hosted license servers are run by our licensing vendor, WyDay, and do not require you to run anything in your own network. Read more about setting up a hosted license server and getting a UUID here: Creating a LicenseChest Server

Configuring license leases

When using floating licenses, you can optionally determine how long the license leases last by setting the lease length value on the licensing server. This value is in seconds, so for instance to make license leases last 30 minutes you would use the following syntax:

/etc/connect-license-server.conf

<lease length="1800"/>

The lease length controls how frequently the Posit Connect instances need to contact the licensing server to renew their license leases in order for the lease to remain valid.

A shorter lease length will increase tolerance to failures on Posit Connect instances by making leases available for reuse more quickly. Posit Connect will release its lease immediately if shut down normally, but if abnormally terminated, the lease will not be released until it expires.

A longer lease length will increase tolerance to transient failures on the network and the Posit Connect License Server. Any such issues that can be resolved before the lease is due for renewal won’t interrupt use of Posit Connect.

We generally recommend using a longer lease length. Use a short lease length only if your environment routinely encounters abnormal terminations of the server or the container/instance on which it runs.

Tip

If Posit Connect is running inside a container, gracefully stop that container. For example, use docker stop rather than docker kill. When the Connect container is gracefully terminated, floating license leases are released cleanly. License leases not returned to the license server need to wait for lease expiration before they can be reused.

License server downtime tolerance

Posit Connect does not wait until its lease has fully expired before it renews it. It renews its lease when it is halfway to expiry. For instance, if you use 30 minute leases, Posit Connect will actually renew its lease every 15 minutes.

This means that it is possible to take down the license server for a short period of time without affecting any running Posit Connect instances. Because of the aforementioned behavior, no existing lease will be more than halfway to expiry if the server goes down.You have a grace period of N/2 (where N is the length of the lease) during which the server can be offline without consequences. For instance, if you use 30 minute leases, your license server can be offline for 15 minutes.

Lease expiration and renewal

Under normal conditions Posit Connect will automatically renew its license lease in a configurable interval as described above. However, there are situations in which it will be unable to do so, such as a network problem, or an issue on the host running the license server.

When Posit Connect cannot obtain a license lease, either because there are no leases currently available or because it can’t reach the licensing server, it will begin automatically attempting to acquire a lease every 10 seconds. This interval is configurable through the Licensing.RemoteRetryFrequency setting. For example, to retry every 30 seconds, use the configuration:

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
RemoteRetryFrequency = 30s

If you don’t want Posit Connect to attempt to reestablish a license lease automatically, set the value to 0 to disable retries. In this case you will need to manually restart Posit Connect in order to reestablish the lease. This can be useful if you often run more instances than you have keys for, and wish to have more control over which Posit Connect instances receive license leases from the limited pool on the license server.

Troubleshooting floating licensing

To validate that the license server has been successfully activated, run the activation-status command. This will report the version of the server as well as the license key and the number of available slots.

sudo connect-license-server activation-status

If your server is activated but you’re still having trouble with floating licensing, you can tell the Posit Connect License Server to emit more detailed logs. Change the log level to notification:

<!-- /etc/connect-license-server.conf -->
<log file="/var/log/rstudio-licensing.log" level="notification"/>

Then, restart the license server, tail the licensing log, and start your Posit Connect instances.

sudo connect-license-server restart
tail -f /var/log/rstudio-licensing.log

At the notification level, the licensing log will tell you the total number of licenses associated with your key, and how many are currently in use. It will also notify you when Posit Connect instances acquire leases, and when those leases are released, renewed, or expired. No rotation is done for this log, so it’s recommended to use the warning level in production.

Expiration notification

Posit Connect attempts to send email to administrators when the license key is 60 days from expiration. You can disable this behavior with the Licensing.ExpirationEmail setting.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
ExpirationEmail = false

The Connect Dashboard displays a notification to administrators and publishers when the license is within 15 days of expiration. You can disable this behavior with the Licensing.ExpirationUIWarning setting.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
ExpirationUIWarning = false

End-of-support notification

Posit Connect product support is described by the Posit Support Program.

At startup, Connect logs when the product support window ends.

System checks indicate when the product version support window ends.

The Connect Dashboard documentation page indicates when the product support window ends.

The Connect Dashboard displays a warning banner to administrators when the product version support window has ended.

This notification can be disabled with Licensing.EndOfSupportUIWarning.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Licensing]
EndOfSupportUIWarning = false

The dashboard is not able to present this warning or show information about the product support window when Server.HideVersion is enabled.

Licensing errors

Posit Connect uses the license-manager to determine if a valid license is available. Should an error occur when interacting with the license manager, Connect indicates that problem in the /var/log/rstudio/rstudio-connect/rstudio-connect.log log. The license manager sends details about the error to the system messages (syslog). You should consult both locations if Connect cannot obtain a license.

Connect also displays an error page with an appropriate message if a requested feature is not supported by your license. Adjust the capabilities included in your existing Posit Connect license through your dedicated Posit Customer Success contact or email .