I have five applications residing on server(s). Some of these applications are socket (C/C++) based, others are web based (Java, PHP). I need to give licenses to these applications on the basis of the number of users that can access, the type of functionalities and type of users. What kind of business model should I use? I have a few in mind:

  1. Create a java webservice that will be mounted on a license data, and all the servers will communicate with it when a user logins to any of the above applications.
  2. Do a socket based server.
  3. Mount a license file on each server and make each one communicate with its file individually and act as the license rules.

If you have other solutions please shoot.

3 Answers 3


Use a local digitally signed license file encoding business rules

I've split my answer to cover generally accepted requirements, a matching business strategy and the technical aspects of the problem.

General requirements

Few things annoy users more than having their work interrupted as a result of a license issue. To that end you want to have a system that:

  • is resilient against network and hardware failure (no single point of failure)
  • scales well (new servers and more users arrive as the business grows)
  • is resilient against forgery of licenses
  • warns administrators when they are approaching the limits of their license
  • doesn't ever present a false positive (if unsure allow access is the rule for customer-friendly licensing behaviour)

to name but a few.

Business strategy

Your company will want total control over the license, otherwise the customer will manipulate the values to their advantage. However, the customer will not want your company looking over their shoulder and so the system will need to be self-contained on their site.

The customer will not want their entire system to fail if a license is unable to be verified. This obvious demand rules out a networked cental authentication approach because it could fail for a multitude of reasons (network, poor coding, power outage, hardware failure etc). While the central license authenticator is being repaired (could be days to get that done) the customer is unable to do anything - totally unacceptable.

With the above in mind, the strategy to keep your customer happy is to take a bit of a hit in terms of maintenance by using a local license file containing the rules for the given server.

Technical implementation

To achieve that goal, and minimise the hit, I would suggest that you will need to do the following:

  1. Write a license configuration tool for your company. This file defines the user limit, allowed functions, and user types for each product in the form of a digitally signed license file issued by your company using a private key.

  2. The servers must load the license file and verify the digital signature using your public key which is hosted on a well-known public key site (pgp.mit.edu) or embedded directly in the code on startup or after maintenance

  3. Each server verifies it's current user load, type and tasks against the signed license file as traffic occurs. Loading approaching the limit of the license should trigger an email or message to the system administrators.

  4. Servers can update their license file in response to a socket-based PUT request that has a suitable digital signature (again verified by the remote key site). This will allow an automated script to provide license changes when one of your guys is on site providing maintenance.

  • 1
    @Harout Edited accordingly
    – Gary
    Jan 10, 2012 at 16:58
  • Hello Gary, I am with you on your answer, thanks so much for your time. But my question is related to the business architecture of it. From your explanations I can understand that each server application needs separate module to be added where different license files may be mounted on each one of them, do you suggest that this approach is better than creating a webservice for a license which will have a single license mounted and control all the servers' logins?
    – GingerHead
    Oct 1, 2015 at 8:34

Are you sure that you want to write this?

Have you looked into existing license control applications/services?

If the cost is not prohibitive, this sounds like a classic not-worth-inventing-here application.

  • yeah I looked and researched. The best way is to write one, because the number of the applications needing license may increase. So which solution you think is the best choice here?
    – GingerHead
    Jan 10, 2012 at 16:55
  • 1
    Speaking as a consumer of licensed applications (but not as a developer of licensing mechanisms) the most common approach I've seen is a license (key) server that runs on the app server. It seems to handle a mix of license types fairly well. Jan 10, 2012 at 17:11
  • You mean that the first point is the most acceptable to you?
    – GingerHead
    Jan 11, 2012 at 9:18
  • 1
    Actually the case I was talking about was a Unix process but the idea is that it runs on the app server so you don't create an extra point of failure. Within that constraint it's up to you how you want to implement it. Jan 11, 2012 at 22:55

I think you should look at the FlexLm.

For awhile SUN was using it to provide distributed licence services for their products.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.