Private Cloud Authentication​

Application Scenario

If the FineDataLink project is deployed on a virtual machine/cloud platform, the physical information of the FineDataLink server is not fixed, causing the authentication via local machine information to be unavailable.

In this case, you need to find a server with fixed physical information to be the authorization server. After you send the RIF file containing the machine information of the authorization server to business personnel, they will generate the FanruanLicenseServer.zip file (including a server file) for the authentication via private cloud.

Function Description

If the physical information of the FineDataLink project is not fixed, the authentication via local machine information is unavailable. In this case, you can perform the authentication via private cloud through a server with fixed physical information.

The authorization server (the License Server end) returns the authorization details (including the function point, access domain, access port, application name, and expiration date) to the FineDataLink server.

If the validation on the FineDataLink server passes, the server can proceed with normal access. If the validation fails, the server is unauthorized, as shown in the following figure.

The authorization server program refers to the server program that provides authorization functionality (physical information required). The FineDataLink server refers to a server on which FineDataLink projects are running (physical information not required).

Notes

1. The authorization server for the private cloud authentication needs to be a machine with fixed physical information. Fixed physical information is not required for the machine where the FineDataLink project server is located.

For example, servers in a virtual machine environment are unsuitable as authorized servers since physical information may change, causing registration failure.

2. The server hosting the FineDataLink project to be registered (the FineDataLink server) must have network connectivity with the authorization server.

3. A single authorization server is not allowed to run two private cloud authentication programs.

4. If you need to use the same machine as the authorization server after uninstalling the authorization server program, you must regenerate the MachineInfo.rif file and send it to business personnel for re-registration.

5. A single authorization server can authorize multiple FineDataLink servers within the allowed registration capacity.

6. When using private cloud authentication for a cluster, you do not need to send the registration information of each node to business personnel.

7. When migrating the FineDataLink server, you do not need to reapply for the authorization file.

• When applying for authorization, you can specify an IP address range instead of a specific IP address for the FineDataLink server.

• After migration, ensure that the machine where the FineDataLink server is located can communicate with the authorization server over the network and that the new FineDataLink server's IP address is within the IP range specified in the authorization application.

8. Systems i386, ARM, and AMD64 are supported on Linux.

9. You cannot access the private cloud through network address translation (NAT).

10. The authentication program running on the authorization server cannot be closed for more than 24 hours.

• If the shutdown time is less than 24 hours, the registration of the FineDataLink server will fail. However, the registration remains valid if the FineDataLink server can automatically reconnect to the authorization server within two hours.

• If the shutdown time is more than 24 hours, you need to re-run the authentication program and re-register the FineDataLink server.

11. The FineDataLink server sends a request to the authorization server every two hours. Upon receiving the request, the authorization server responds to the FineDataLink server.

If the FineDataLink server does not receive feedback within 24 hours, or the authorization server does not receive a request for 24 consecutive hours, the registration fails and a re-registration is required.

Under System Management > Registration Management, the failure time and reason for each registration failure are displayed in a list, helping you troubleshoot problems, as shown in the following figure. 

Note:

In a cluster environment, failure reasons may vary across nodes, and the system displays the failure reason for each node individually.

Downloading the machine Tool

You can download the machine tool (used to obtain the authorization server information file): Windows.zip.

Upload the ZIP file to the authorization server and unzip the file.

Exporting the Authorization Server Information

Run the extracted machine.exe file as the admin. A require folder will be automatically created in the same directory.

The MachineInfo.rif file in the require folder is the exported authorization server information file, as shown in the following figure.

Obtaining the Authorization File

Use the email address specified in the contract and send the registration information to FineDataLink business personnel (business@fanruan.com). The email format is shown as follows.

After verifying the received email, business personnel will generate a FanruanLicenseServer.zip file and email it to you.

The following table shows the email content.

Starting the Authorization Server

Unzip the obtained authorization file FanruanLicenseServer.zip on the authorization server.

Run the server.exe file in the bin directory as the admin, as shown in the following figure.

Note:

1. If the startup fails due to a port being occupied, specify a different port by adding the -port Port number parameter when starting the program from the command line.

For example, server.exe -port 8088

2. You can specify the language for the server.exe file when starting the authentication server. The default language is Simplified Chinese, with English as an additional option.

Startup command example: server.exe -port 8088 -language en

Configuring Auto-Startup

The executable file running on the authorization server cannot be closed. On Windows, server.exe must remain running. If you close server.exe, the FineDataLink project will be in an unregistered state when you restart server.exe, requiring you to repeat the steps in the "Starting the Authorization Server" section.

Configure server.exe for auto-startup on system boot in the FanruanLicenseServer/bin path.

Note:

After successful configuration, the service will start automatically on system boot. If you need to change the private cloud server, you must stop the existing service first.

Verifying the Authorization

Log in to FineDataLink as the admin, choose System Management > Registration Management > Version Information, and click Register Now.

Select Private Cloud as the Authentication Method, fill in the IP address and listening port number (for example, https://172.16.63.131:8081) displayed on the authorization server in Server Address, and click Submit, as shown in the following figure.

Note:

1.  If the domain name of the authorization server is provided, enter the domain name. Otherwise, enter the IP address.

2.  Ensure that FineDataLink can access the authorization server.

The following figure shows the effect after successful authentication.

Note:

1. Max Connections refers to the maximum number of projects that can simultaneously request authorization from the authorization server.

2.  If authentication fails, check firewall settings, open corresponding ports, or disable the firewall.

Downloading the machine Tool

You can download the machine tool (used to obtain the authorization server information file).

Note:

Generally, AMD64 is used for 64-bit Linux, and i386 is used for 32-bit Linux.

In rare cases (when the physical machine uses a RISC instruction set and low-power CPUs), ARM is used. The choice depends on the hardware specifications.

Exporting the Authorization Server Information

Note:

You must use an administrator account to perform the operations in this section. Otherwise, an error will occur during the authorization program startup, indicating that the machine code is mismatched.

Take Linux_AMD64 as an example:

Upload the ZIP file to the authorization server and unzip the file to generate the machine.file file.

unzip linux_amd64.zip

Add permissions to the machine.file file.

chmod 777 machine

Run the machine.file file as the admin to generate the require folder in the same directory. The MachineInfo.rif file in the require folder is the authorization server information file.

./machine

Obtaining the Authorization File

Use the email address specified in the contract and send the registration information to FineDataLink business personnel (business@fanruan.com). The email format is shown as follows.

After verifying the received email, business personnel will generate a FanruanLicenseServer.zip file and email it to you.

The following table shows the email content.

Starting the Authorization Server

Note:

If you use a tool to connect to the authorization server, after running nohup ./bin/server &, use exit to log out.

After re-login, you can use the ps -ef | grep server command to check if the server is running in the background. If so, the private cloud has started in the background and will continue running as long as the server remains on.

1. Unzip the obtained authorization file FanruanLicenseServer.zip on the authorization server.

unzip FanruanLicenseServer.zip

2. After extraction, run server in the bin directory as an admin.

nohup ./server &

Note:

You can specify the language when starting the authentication server. The default language is Simplified Chinese, with English as an additional option.

Startup command example: ./server -language en

3. The authentication server is started successfully.

Verifying the Authorization

Log in to FineDataLink as the admin, choose System Management > Registration Management > Version Information, and click Register Now.

Select Private Cloud as the Authentication Method, fill in the IP address and listening port number (for example, https://172.16.63.131:8081) displayed on the authorization server in Server Address, and click Submit, as shown in the following figure.

Note:

1. If the domain name of the authorization server is provided, enter the domain name. Otherwise, enter the IP address.

2. Ensure that FineDataLink can access the authorization server.

The following figure shows the effect after successful authentication.

Note:

1. Max Connections refers to the maximum number of projects that can simultaneously request authorization from the authorization server.

2. If authentication fails, check firewall settings, open corresponding ports, or disable the firewall.

Downloading the machine Tool

You can download the machine tool (used to obtain the authorization server information file):  Mac.zip.

Exporting the Authorization Server Information

Upload the ZIP file to the authorization server and unzip the file to generate the machine.file file.

unzip Mac.zip

Add permissions to the machine.file file.

chmod 777 machine

Run the machine.file file as the admin to generate the require folder in the same directory. The MachineInfo.rif file in the require folder is the authorization server information file.

./machine

Obtaining the Authorization File

Use the email address specified in the contract and send the registration information to FineDataLink business personnel (business@fanruan.com). The email format is shown as follows.

After verifying the received email, business personnel will generate a FanruanLicenseServer.zip file and email it to you.

The following table shows the email content.

Starting the Authorization Server

Note:

The executable file running on the authorization server cannot be closed. On macOS, the server must remain running.

Unzip the obtained authorization file FanruanLicenseServer.zip on the authorization server.

Run server in the bin directory as the admin, as shown in the following figure.

Note:

You can specify the language when starting the authentication server. The default language is Simplified Chinese, with English as an additional option.

Startup command example: ./server -language en

Verifying the Authorization

Log in to FineDataLink as the admin, choose System Management > Registration Management > Version Information, and click Register Now.

Select Private Cloud as the Authentication Method, fill in the IP address and listening port number (for example, https://172.16.63.131:8081) displayed on the authorization server in Server Address, and click Submit, as shown in the following figure.

Note:

1. If the domain name of the authorization server is provided, enter the domain name. Otherwise, enter the IP address.

2. Ensure that FineDataLink can access the authorization server.
   

The following figure shows the effect after successful authentication.

Note:

1. Max Connections refers to the maximum number of projects that can simultaneously request authorization from the authorization server.

2. If authentication fails, check firewall settings, open corresponding ports, or disable the firewall.

If the registration fails, a prompt window pops up with the specific failure reason, helping you troubleshoot problems.

Standalone Project

If the registration fails, a prompt window pops up with the specific failure reason. You can click Details for troubleshooting, as shown in the following figure.

You can click Back to return to the Registration Management page. In the Registration Information area, information about the registration failure and the reasons is displayed. You can click View Error Details for troubleshooting, as shown in the following figure.

Cluster Project

If the registration fails, the reasons may vary across different nodes. A prompt window pops up with the specific failure reason for each node. You can click Details for troubleshooting, as shown in the following figure.

You can click Back to return to the Registration Management page. In the Registration Information area, failure reasons for all nodes are displayed in a list. You can click View Error Details for troubleshooting.

Failure Reason

You can click Details to view the reason for the registration failure and troubleshoot accordingly.

Note:

1. The error message of all other errors not mentioned in the following table is “Incorrect License Format”.

2.  If the registration fails for multiple reasons, only the reason for the initial failure will be displayed.

Revoking Authorization

First, destroy the current authentication server. Enter the bin folder as the admin and then run a corresponding command.

Windows

On a Windows operating system, open Command Prompt (cmd), navigate to the bin directory, and run the following command.

.\server.exe -destroy

Note:

You can specify the language when destroying the authentication server. The default language is Simplified Chinese, with English as an additional option.

For example: ./server -destroy -language en

macOS and Linux

On macOS and Linux operating systems, run the following command.

./server -destroy

Note:

You can specify the language when destroying the authentication server. The default language is Simplified Chinese, with English as an additional option.

For example: ./server -destroy -language en

Obtaining the Revocation Evidence File

Upon execution of the command, the authorization for the current server will be revoked, and a proof-of-destruction evidence file will be generated, as shown in the following figure.

Note:

Sometimes the Windows OS may report errors. In this case, you need to create an uninstall folder in the same path as the bin folder. The evidence file will be generated in the uninstall folder.

Re-registration

Send the following two files to business personnel via email.

Send the following two files to business personnel via email: the receipt.fr file and the MachineInfo.rif file (regenerated by applying for the authentication server)

After confirmation, business personnel will send you a new file for authentication server authorization via email.

Note:

After the authorization server is destroyed, if you restart FineDataLink, registration will fail immediately. If you do not restart FineDataLink, registration will fail after approximately 24 hours.