FVA-Workbench KnowledgeBase

New licensing options are available from FVA-Workbench 11.0. The setup and access processes differ depending on the type of license.

Figure 7. License types

Cloud Client Licenses

Cloud client licenses are computer-based. With this type of license, the FVA-Workbench can only be used on the computer with which the license is linked. An internet connection is required to use this type of license.

Cloud Floating Licenses

These licenses allow multiple users to access a shared pool of licenses. Each individual license can only be used by one user at a time. An internet connection is required to use this type of license.

Local Floating Licenses

With this type of license, license management software is installed on a server. This server must be accessible for all computers running the FVA-Workbench. The server checks the validity of the licenses and distributes them to the network. The client computers do not require an internet connection.

The Sentinel License Manager is a program developed by Thales that is required to use the new licenses. It is installed by default as part of the FVA-Workbench setup, but is also available for download at the FVA Download Center. Administrator rights are required for the installation.

After the installation, the Sentinel License Manager starts a service which retrieves and manages the available licenses.

The license manager can be configured via the Admin Control Center web interface. This can be accessed at: http://localhost:1947.

Location of license files (relevant for local floating licenses only)

The license certificates uploaded in the Admin Control Center are stored in the installation directory of the Sentinel License Manager:

C:/Program Files (x86)/Common Files/SafeNet Sentinel/Sentinel LDK/installed/

Remove the files to remove the licenses from the Admin Control Center.

[de] Ports

[de] Der Lizenzmanager nutzt für ausgehende Verbindungen den Port TCP 443 (HTTPS). In der Regel ist hierfür keine zusätzliche Freigabe in der Firewall erforderlich. Für die interne Kommunikation greift die FVA-Workbench über localhost:1947 auf den Lizenzmanager zu. Dieser Port wird ausschließlich für die lokale Kommunikation verwendet.

Linking the license to the computer

When a license is issued, an e-mail is sent to the user which includes a link to associate the license with the computer. The computer on which this link is opened will be permanently linked with the license.

After it has been successfully linked, the license is displayed in the FVA-Workbench start dialog.

Registration in the Sentinel EMS online license management system

Administrators can view available licenses and assign them to users in the Sentinel EMS online license management system.

Once a license has been issued, the administrator receives an e-mail instructing them to login to the Sentinel EMS online license management system.

A user account has already been created for the administrator, but the password must first be set. To do so, click "Forgot password" in the login form and enter the address to which the e-mail was sent. A reset password e-mail will then be sent. A new password can be entered via the link included in the e-mail.

Figure 8. https://fvagmbh.prod.sentinelcloud.com/customer/login

Initial registration in Sentinel EMS: Click "Forgot password" in the login form, open the password reset link in the e-mail, and assign a new password.

Creating users

In order to assign licenses to individual users, they must first be created in the EMS. A user ID, e-mail address, password, and name must be entered for each user.

The password can be set and then communicated to the user. If necessary, the user can login to the EMS with their e-mail address and password and change the password themselves. However, registration is not required to use the license.

If Standard is selected as the User Type, the user only has limited read access to the EMS settings.

Assigning licenses to users

All available licenses with their ID and description are listed under the User Associations menu. Click the button (1) to open a dialog box for user assignments.

Select a license in the dialog by entering the license ID or description in the search field (2). The users to whom the selected license can be assigned are displayed in the lower area (3). Click on the user name to assign the license to that user.

Using the license with the FVA-Workbench

A login dialog is displayed when starting the FVA-Workbench. "Login with user account" must be selected in the dropdown menu (1) to access cloud floating licenses.

After clicking the Login button (2), a browser window opens. The user information must be entered here. After a successful login, the available licenses are displayed in the FVA-Workbench login dialog and can be selected here.

Create machine accounts for cloud floating licenses

For certain use cases, logging in with a username and password is not suitable, for example:

For these use cases, a machine account can be set up for a computer in Sentinel EMS. The computer is then linked to this machine account via a link and thus gains access to all available floating licenses without the need for separate login.

Steps for creating a machine account

(1) Create a new machine account.

(2) Name: Name of the user or computer Email: Address to which the link will be sent.

(3) Save machine account

(4) Click on the link on the computer that is to be authorized to access the licenses.

Overview of the required steps

Restricting user access

Access to licenses can be managed at the user level in the Admin Control Center.

(1) Shows the users or devices which have recently used a license.

(2) Explicitly allow or deny access to users or devices.

Client cloud and local floating licenses

For these license types, the license ID to be used must be specified.

Example:

C:\FVA\FVA-Workbench.exe -WBJob="C:\WB_job\WB-Job.wbj" -Lic="TLic;518247552335801006"

Cloud floating licenses

For cloud floating licenses, it is recommended to create a machine account for the computer on which the batch process is to be executed. When the computer is connected via a machine account, the license is specified in the same way as for client cloud and local floating licenses.

For testing purposes, however, batch mode can also be started with authentication via email and password.

Example:

C:\FVA\FVA-Workbench.exe -WBJob="C:\WB_job\WB-Job.wbj" -Lic="TLic;632067363738713777;userMode"

Before executing the batch job, the FVA Workbench should be started once in GUI mode. The user name and password must be entered and then the Remember me option must be activated. After that, login in batch mode will take place automatically.

If a proxy server is used in the company for external connections, it must be configured.

There are two .ini files in the FVA-Workbench installation directory. The address of the proxy server must be specified in these files.

hasp_auth.ini

# Authentication Runtime Configuration File
SNTL_AUTHZ_URI=https://auth-emea.prod.sentinelcloud.com/auth/realms/41630fb7-4ce2-b0a3d52b45da/protocol/openid-connect/auth
SNTL_TOKEN_URI=https://auth-emea.prod.sentinelcloud.com/auth/realms/41630fb7-4ce2-b0a3d52b45da/protocol/openid-connect/token
SNTL_LM_HOST=fvagmbh.prod.sentinelcloud.com
SNTL_CLIENT_ID=app-9a0622fc-f27a-4294
SNTL_REDIRECT_URI=http://localhost/v1/callback
SNTL_CODE_CHALLENGE_METHOD=plain
SNTL_STORE_AUTHZ=false
SNTL_SCOPE=openid
SNTL_LOG_LEVEL=Debug
SNTL_BROWSER_MODE=external
SNTL_EMBEDDED_BROWSER_TITLE=FVA-Workbench
#SNTL_AUTH_PROXY=http://my.proxy.de:8080
#SNTL_AUTH_PROXY_PWD=<user>:<password>

SNTL_AUTH_PROXY: Address and port of the proxy server

SNTL_AUTH_PROXY_PWD: If the proxy server requires login details, these can be entered here.

A preceding hash symbol (#) comments out the respective line.

hasp_34488.ini

proxy = 1
proxy_host = my.proxy.de
proxy_port = 8080
proxy_username = <username>
proxy_password = <password>

Cloud licenses are not displayed or the connection is unstable

Some corporate networks use proxy servers with packet inspection. This involves analyzing and partially modifying network traffic. This can result in timestamps or certificates deviating from the license manager's expectations. One possible consequence is unstable connections to the license service.

Possible solution Please check with your IT department to see if your company uses such a proxy server. If this is the case, the following URL should be added to the whitelist in the proxy or firewall: *.sentinelcloud.com