License Management

Overview

Posit Workbench uses a built-in license management system, which controls:

The number of users that can connect to Workbench
Feature enablement as outlined in the Product tiers section below

Product tiers

Product tiers for Workbench are Basic, Enhanced, and Advanced. These tiers include different features, number of server activations, and pricing than our previous product tiers (called Base, Standard, and Enterprise).

Note

Existing licenses remain valid and are not affected by the introduction of the Basic, Enhanced, and Advanced product tiers. You will continue to have access to the same product features for the length of that license.

Starting in 2024, renewals will receive an updated license that corresponds to one of the product tiers.

Product tier badges

Features not labeled with a product tier badge are available to all product tiers, including Basic.
Features which require the Enhanced tier are labeled with an Enhanced badge. (Enhanced features are also available in the Advanced tier.)
Features which require the Advanced tier are labeled with an Advanced badge.

Capabilities

Workbench uses a built-in license management system. A Workbench product license limits usage in the following ways:

Number of active user accounts in Workbench.

A user account is active starting the first time it signs in. A user account ceases to be active after a period of time without using Workbench or when it is locked. The inactivity time defaults to 365 days, but some licenses might use other values.

Once the user account limit is reached, additional users cannot sign in to Workbench.

Each unique user is counted only once toward this quota, even if they access multiple Workbench servers. See the Posit End User License Agreement for the formal definition of a named user.

Managed credentials and integrations

Enhanced

Support for Managed Credentials (AWS, Azure, Databricks, Snowflake) or Databricks Cluster Integration.

Workbench can manage and refresh short-lived OAuth tokens for seamless access to cloud data and services without personal access tokens.
Support for Custom OAuth Integrations.

User-specific OAuth credentials for sessions integrating with any OAuth 2.0-compliant service.

Auditing and compliance

Enhanced

Support for Session Auditing.

Capture historical audit records of every Workbench session and launcher job in a queryable audit database.
Support for Console Auditing.

Capture and audit user-run code in RStudio Pro and Positron Pro sessions.

High availability

Enhanced

Support for Load Balancing and High Availability.

Distribute incoming network traffic across backend servers for peak performance and minimum downtime.
Support for Enforced Configuration and Feature Limits.

Pre-set or enforce settings and feature limits in Positron Pro and RStudio Pro.

Off-host execution

Advanced

Support for Kubernetes Execution.

Native integration with Kubernetes clusters on-premise or in cloud, with container-backed sessions.
Support for Slurm and HPC Execution.

Native integration with Slurm (HPC). Includes Apptainer/Singularity for container-backed sessions.
Support for Workbench Jobs.

Offload long-running tasks to a separate session. Scale up in attached Kubernetes or Slurm clusters when present.
Support for Audited Jobs.

Track auditing information alongside Workbench job output, including digital signatures of output.
Support for Managed Cloud Deployments.

Offload Workbench administration to cloud partners including Snowflake Native Apps, AWS SageMaker, AzureML, and GCP Workstations.

The settings of each capability depend on the license purchased from Posit.

Contact Posit Sales (sales@posit.co) to purchase a Workbench product license.

Adjust the capabilities included in your existing Workbench license through your dedicated Posit Customer Success contact or email sales@posit.co.

License status

Workbench requires a license key or license file for continued use. To request a free 30-day trial license, visit posit.co/trial-license. For assistance, contact your Posit Customer Success representative.

How do I check the status of my current license?

To check the status of your current license, use the license status command:

Terminal

sudo rstudio-server license-manager status

Offline licensing status check

You can perform an offline check of your current license status using the following command:

Terminal

sudo rstudio-server license-manager status-offline

License details

The details presented when using the status and status-offline commands are part of the license. These values cannot be changed without purchasing a different license.

Key values displayed by these commands include the following:

Value	Meaning
Status	The current status of the license. Typically “Activated” or “Expired”.
Tier	The feature tier of the license. One of “basic”, “enhanced”, or “advanced”.
Sessions	The maximum number of concurrent sessions that can be run. (“0” means unlimited.)
Users	The maximum number of users that can connect to the server. (“0” means unlimited.)
Expiration	The date and time when the license will expire.
Days-Left	The number of days until the expiration date.

If you have questions about the most appropriate license for your use case, contact sales@posit.co for help.

License warnings

When the license is within 15 days of expiration, a warning displays to users inside RStudio Pro sessions. The warning indicates the number of days remaining in the license.

You can change the length of the 15-day warning period with the license-warning-days option, which can be set to 0 to disable license warnings altogether:

/etc/rstudio/rserver.conf

license-warning-days=0

Warning

Disabling license warnings will cause your license to expire without warning you or your users. Change this setting only if you have other processes in place to ensure you renew the license prior to expiration.

Activation options

After purchasing a Workbench license, Posit will send you a license file for your system. Activate your license file with the instructions described in the License file section below.

License file activation (recommended)

Almost all installations use license files. This is the recommended approach.
License key activation

Older installations might use license keys instead of license files. To switch from license keys to license files, see instructions in the Licensing FAQ.
Floating licensing with a persistent license server

Older containerized installations might use floating license keys instead of license files. To switch from a floating license key to license files, see instructions in the Licensing FAQ.
- With direct internet access
- Offline activation

License file

A license file is an encrypted text file with a name having the shape <expiration-date>_<product-code>_<organization>_<license-key>.lic.

The license file fully describes the purchased product license. It includes details such as the expiration date and entitlements permitted by the license. License files do not communicate with an external licensing provider, making them suitable for containerized, offline, and air-gapped environments. License files are the recommended way to provide a license to Workbench.

You must ensure that the license file is secured, used only in your environment, and within the bounds of your license agreement.

When a *.lic file exists in the /var/lib/rstudio-server/ directory, other licensing methods are bypassed.

The Licensing FAQ provides information about common issues and questions that you might have when activating or switching your current activations to license files. If the issue persists, contact Posit Support using the Posit Support form.

Activation

To activate Workbench using a license file:

Transfer the file to the server hosting Workbench.
Ensure the license file is owned by the Workbench service user and is not readable by other users, then copy the file into /var/lib/rstudio-server:
```
sudo chown rstudio-server <license-file>.lic
sudo chmod 0600 <license-file>.lic
sudo cp -a <license-file>.lic /var/lib/rstudio-server/
```

Note

The default Workbench server-user user is rstudio-server. If your installation is configured with a different server-user, ensure the file is owned by that user.

If the server uses SELinux in enforcing mode, update the security context on the license file:
```
sudo restorecon /var/lib/rstudio-server/<license-file>.lic
```
Restart Workbench for the license to take effect:
```
sudo rstudio-server restart
```

Deactivation

You must deactivate your license before moving it to another system. If you are using a license file in a container, there is no need to worry about deactivation when the container is terminated.

Deactivate your license file by removing it from the /var/lib/rstudio-server/ directory:

Terminal

sudo rm /var/lib/rstudio-server/<license-file>.lic
sudo rstudio-server restart

License key

Note

Posit recommends using license file activation rather than license key activation. License files work well in all environments including ephemeral, container-based, or air-gapped environments. See License activation methods for more details.

In rare cases, you might need to activate a license key as described below.

A license key is a combination of letters and numbers with the shape AAAA-BBBB-CCCC-DDDD-EEEE-FFFF-GGGG.

Online activation

Note

Connectivity requirements

To activate or deactivate Workbench, internet connectivity is required for communicating with the licensing server. More information on specific networking access is available on the Networking page in the Posit Getting Started documentation. If your server is behind an internet proxy or not connected to the internet at all, the sections below describe what is required to successfully activate via a license key. However, most customers are best served by using license files.

Additionally, your server must have a synchronized system clock, using ntp or some other clock syncing service. If the server’s clock is sufficiently incorrect, licensing verification fails.

If you have internet access and are not using an internet proxy, activate your license key with the commands below:

Terminal

sudo rstudio-server license-manager activate <license-key>
sudo rstudio-server restart

Note

Posit uses wyDay’s LimeLM TurboActivate and TurboFloat for license management as an approved part of our software delivery infrastructure. For online license key activation, allow outbound access to wyday.com.

If needed, add the port number from where the activation key is being downloaded so it can be added to a safe sites list by your networking team:

Address: https://www.wyday.com
Port: 443

Proxy servers

If your server is behind an internet proxy, you might need to add an additional command-line flag indicating the address and credentials required to communicate through the proxy. This might not be necessary if either the http_proxy or all_proxy environment variable is defined (these are read and used by the license manager when available).

If you do need to specify a proxy server explicitly, use the --proxy command line parameter. For example:

Terminal

sudo rstudio-server license-manager --proxy=http://127.0.0.1/ activate <license-key>
sudo rstudio-server restart

Proxy settings can include a host-name, port, and username/password if necessary. The following are all valid proxy configurations:

Terminal

http://127.0.0.1/
http://127.0.0.1:8080/
http://user:pass@127.0.0.1:8080/

If the port is not specified, the license manager defaults to port 1080.

Online deactivation

If you want to move your Workbench license to another system, first deactivate it on the old system with the command:

Terminal

sudo rstudio-server license-manager deactivate

Then run the activation command on the new system.

Offline activation

Note

If your system has no connection to the internet, activation can also be performed offline. To do this, use our offline activation app, which will walk you through the process: Posit Offline Activation

To activate your license offline, first generate an offline activation request as follows:

Terminal

sudo rstudio-server license-manager activate-offline-request <license-key>

Executing this command prints an offline activation request to the terminal. Copy and paste this request into our offline self-service application, or submit a request using the Posit Support form. You will receive a reply with an .xml file output that can be used to activate offline as follows:

Terminal

sudo rstudio-server license-manager activate-offline <activation-file>

After activation, restart the Workbench server:

Terminal

sudo rstudio-server restart

Offline deactivation

If you are renewing your license or want to move your Workbench license to another system, you can perform license deactivation offline by executing the following:

Terminal

sudo rstudio-server license-manager deactivate-offline

Executing this command prints an offline deactivation request to the terminal. Copy and paste the request into the offline activation application, or send it to Posit Support using the Posit Support form.

Then run the activation command on the new system.

Floating licensing

Note

In rare cases, you might need to activate a license key on a floating license server as described below.

To use floating licensing, you run a small, lightweight server, which holds a license that grants you the right to run a certain number of concurrent Workbench instances.

When Workbench starts, it will connect to the license server and obtain a temporary lease, releasing it when Workbench is stopped. Using this method, you can have any number of Workbench instances, so long as you do not run more instances at once than specified in your license.

Floating license keys

A license key which distributes floating license leases is not the same as a traditional license key. The two cannot be used interchangeably. If you have purchased traditional license keys and wish to exchange them for a floating license key, or vice versa, contact Posit Support using the Posit Support form.

The Workbench license server

The Workbench license server supplies licenses to Workbench. It is available for Linux, Mac, and Windows. A license server can supply licenses to any platform. For example, you can run your license server on Windows and distribute licenses to Workbench instances running Linux.

Linux

Note

The Posit License Server site contains Linux license server downloads for all Posit products. Download and install the license server for Workbench. You then activate your license key with the command:

Terminal

sudo dpkg -i rsp-license-server-1.1.2-x86_64.deb
sudo rsp-license-server activate <license-key>
sudo rsp-license-server start

The file /etc/rsp-license-server.conf contains configuration settings for the Workbench license server, including the network port to listen on and any proxy settings required for connecting to the Internet.

Mac and Windows

The Posit License Server site contains downloads for the Mac and Windows license servers. These require a few additional configuration steps. They can be set up as follows (order is important):

Download the license server (TurboFloatServer) appropriate to your platform, and place it in the directory where you wish it to run.
Copy the file /usr/lib/rstudio-server/bin/license-manager.conf to the same directory as TurboFloatServer, and change its name to TurboActivate.dat.
If activating online, run the command TurboFloatServer.exe -a="ABCD-EFGH-IJKL-MNOP-QRST-UVWX-YZAB".
If activating offline, follow the offline activation steps. Supply the fully qualified path to file arguments to TurboFloatServer, even if they are in the same directory as the executable.
After successful activation, run TurboFloatServer.exe -i with administrator permissions. This will install the license server as a service that will start automatically and run in the background.

For additional help with Mac and Windows license server installation and configuration, refer to the official TurboFloat Server documentation.

License server hardware requirements

The license server is designed to distribute licenses to ephemeral virtual machines or containers, which can move freely between hosts. However, the license server itself must stay on the same physical host on which it was activated.

You can run the license server inside a container or a virtual machine (VM) as long as the container or VM always runs on the same hardware. Stopping the license server, moving it to a different physical host, and starting it again will cause the license to become deactivated. Because it can be impractical to try to ensure that the server only runs on a particular host, we recommend running the license server outside containers and virtualization software.

Note that the system requirements for the license server are very low, so it can be run on almost any server. If your environment cannot ensure that the server stays on a single physical host, contact Posit Support using the Posit Support form to discuss alternate licensing options.

License server offline activation

Note

The rsp-license-server activate command requires an internet connection. If your license server has no connection to the Internet, then you can perform an offline activation. The process for doing this on the license server is identical to the process used to activate Workbench offline. Generate an offline activation request as follows:

Terminal

sudo rsp-license-server activate-offline-request <license-key>

Executing this command will print an offline activation request to the terminal. Copy this request and send it in a request to Posit Support using the Posit Support form. You will receive a reply with a file attachment that can be used to activate offline as follows:

Terminal

sudo rsp-license-server activate-offline <activation-file>
sudo rsp-license-server restart

License server deactivation

If you are permanently decommissioning your license server, or need to transfer its license to a different license server, deactivate (remove) its license as follows:

Terminal

sudo rsp-license-server deactivate

Using floating licensing

Once your license server is up and running, configure Workbench to use floating licensing instead of traditional licensing.

/etc/rstudio/rserver.conf

server-license-type=remote

The value remote instructs Workbench to connect to a remote licensing server to obtain a license. The value local can be used to explicitly specify traditional (local) activation.

Then, tell Workbench which licensing server to connect to:

Terminal

sudo rstudio-server license-manager license-server <server-hostname-or-ip>
sudo rstudio-server restart

You only need to run the license-server command once. Workbench saves the server name and will use it on each subsequent startup.

When operating Workbench within a containerization system like Docker, it might also be necessary to specify the PWB_LICENSE_SERVER environment variable on the container host. If you use an official Workbench Docker image, the container’s startup script will check whether this environment variable is defined. If it is, the script will automatically run the necessary license server commands. This prevents you from having to access the container to run these commands every time. As with the PWB_LICENSE environment variable, placing it in a .bashrc or any similar rc file is recommended, so that you only have to set it once.

Depending on your system configuration, the Workbench service might be started before the service that provides hostname resolution. (For example, this is known to be the case on some Amazon EC2 systems.) If this is the case, specify the license server using a private IP address rather than a hostname so that Workbench can acquire a license immediately when starting up.

Note

If you are renewing your floating license offline or if you want to move your floating license for Workbench to another system, then perform license deactivation offline first.

To renew your floating license offline or to move your floating license, run the following to perform license deactivation offline:

Terminal

sudo rstudio-server license-manager deactivate-offline

Specifying a license server

Workbench supports three methods for connecting to a license server. You can select the method by specifying the license server as follows:

Connecting over TCP

By default, the Workbench license server listens for raw TCP connections on port 8989.

To use a different port, configure the port number in /etc/rsp-license-server.conf, then use <server-hostname-or-ip>:<port> in the license-server command.

Example

Terminal

sudo rstudio-server license-manager license-server mylicensehost:9403

Connecting over HTTPS

You can also connect to the license server over HTTPS instead of raw TCP. This can be useful when using proxies or load balancers in front of the license server.

Example

Terminal

sudo rstudio-server license-manager license-server https://mylicensehost/

The license server does not use HTTPS by default. To configure the license server to use HTTPS, see the TurboFloat Server documentation:

Configuring TurboFloat Server for HTTPS Communication

Connecting to a hosted server

Example

Terminal

sudo rstudio-server license-manager license-server 871A2BFA-87C5-11E9-BD16-4749DB7B7927

Finally, if you are connecting to a hosted license server, specify the UUID of the server rather than its hostname. Hosted license servers are run by our licensing vendor, WyDay, and do not require you to run anything in your own network. Read more about setting up a hosted license server and getting a UUID here:

Creating a LicenseChest Server

Configuring license leases

When using floating licenses, you can optionally determine how long the license leases last by setting the lease length value on the licensing server. This value is in seconds. For example, to make license leases last 30 minutes, use the following syntax:

/etc/rsp-license-server.conf

<lease length="1800"/>

The lease length controls how frequently the Workbench instances must contact the licensing server to renew their license leases. Workbench will release its lease immediately if shut down normally. If Workbench terminates abnormally, the license remains in use until the lease expires.

A shorter lease length will increase tolerance to failures of Workbench instances by making leases available for reuse more quickly.

A longer lease length will increase tolerance to transient failures of the network or the Workbench license server. Any such issues that can be resolved before the lease is due for renewal will not interrupt use of Workbench.

We generally recommend using a longer lease length. Use a short lease length only if your environment routinely encounters abnormal terminations of the server or the container/instance on which it runs.

License server downtime tolerance

Workbench does not wait until its lease has fully expired before it renews it. It renews its lease when it is halfway to expiry. For instance, if you use 30-minute leases, Workbench will actually renew its lease every 15 minutes.

This means that the license server can be taken down for a short period of time without affecting any running Workbench instances. Because of this behavior, no existing lease will be more than halfway to expiry if the server goes down. You have a grace period of half of the length of the lease during which the server can be offline without consequences. For instance, if you use 30 minute leases, your license server can be offline for 15 minutes.

Lease expiration and renewal

Under normal conditions Workbench will automatically renew its license lease in a configurable interval as described above. However, there are situations in which it will be unable to do so, such as a network problem, or an issue on the host running the license server.

If Workbench cannot obtain a license lease, then it will begin automatically attempting to acquire a lease every 10 seconds. This might occur if there are no leases currently available or if Workbench cannot reach the licensing server. This interval is configurable. For example, to retry every 30 seconds, set the following value:

/etc/rstudio/rserver.conf

license-retry-seconds=30

To prevent Workbench from automatically attempting to renew a license lease, set the value to 0. If you do so, you must explicitly restart Workbench before the lease expires. This can be useful if you often run more instances than you have keys for and need more control over which Workbench instances receive license leases from the limited pool.

Troubleshooting floating licensing

To validate that the license server has been successfully activated, run the activation-status command. This will report the version of the server as well as the license key and the number of available slots.

Terminal

sudo rsp-license-server activation-status

If your server is activated but you are still having trouble with floating licensing, you can configure the Workbench license server to emit more detailed logs.

First, change the log level to notification:

/etc/rsp-license-server.conf

<log file="/var/log/rstudio-licensing.log" level="notification"/>

Then, restart the license server, tail the licensing log, and start your Workbench instances.

Terminal

sudo rsp-license-server restart
tail -f /var/log/rstudio-licensing.log

At the notification level, the licensing log will tell you the total number of licenses associated with your key, and how many are currently in use. It will also notify you when Workbench instances acquire leases, and when those leases are released, renewed, or expired. This log is not automatically rotated, so we recommended using the warning level in production.

Userspace licensing

In a standard installation of Workbench, licensing configuration operations require elevated access (e.g., via sudo). This is appropriate given the product will normally be installed and activated by an administrator on behalf of multiple user accounts.

Alternatively, the licensing system can be switched to a userspace model where the licensing commands are available to a non-elevated user account. This is a system-wide setting. Userspace and standard licensing cannot be mixed on a single system.

Switching to userspace licensing

Before switching, stop the server, and deactivate any existing license-key or license-server.

Terminal

sudo rstudio-server stop
sudo rstudio-server license-manager deactivate
sudo rstudio-server license-manager clear-license-server

Next, disable the standard system-level licensing mode by deleting the verify file.

Terminal

sudo rm /var/lib/rstudio-server/verify

Initialize the license system in userspace mode. This command must not be run elevated, but as the Workbench account (normally rstudio-server) as described in Server account.

Terminal

rstudio-server license-manager initialize --userspace

Confirm that the mode was successfully changed.

Terminal

rstudio-server license-manager verify

This produces a message similar to the following:

Terminal

Trial-Type: Verified
Status: Evaluation
Days-Left: 5
License-Scope: User

The line License-Scope: User indicates successful switch to userspace licensing (versus the default setting of System).

At this point, the user can perform licensing commands without using sudo, such as activating a license-key or configuring a license-server.