HCL Leap v9.

2 Installation Guide

1. HCL License Server Setup

Proper functioning of the HCL Leap product requires the continuous validation of entitlements by
communicating with a HCL License Server. As an attachment to your order acknowledgement email,
you should have received the document “Introduction to the HCL License Portal”. Please follow the
instructions in this document to create your own License Server and associate it with your product
entitlement.

“Local” versus “Cloud” License Server

The licensing of HCL Products is managed through a Flexera Cloud License Server instance, or, by
installing the HCL Common Local License Server. The Cloud License Server is the recommended
approach for most customers as it is the easiest way to get started and requires little configuration
and no software installation. The Cloud License Server approach simply involves the installation of
the HCL product and configuring it to point to a Cloud License Server instance, which itself is
managed by customers online via the HCL License Portal.

The Local License Server is an alternate way to manage HCL software entitlements. This option is
provided for customers who want to keep network traffic within their local isolated network, rather
than communicating with a Cloud License Server on the public internet. The Local License Server is a
stand-alone application for which installation, configuration, and management must be done by the
customer and then synchronized with the HCL License Portal. Refer to the documentation of the
HCL Common Local License Server for the full list of requirements and installation steps.
2. Secure License Server Configuration
Secure communication between HCL Leap and the HCL License Server (cloud or local) involves signed
content using a public/private keypair. You will need to generate and distribute this keypair. HCL
Leap will sign licensing requests with the private key and the License Server will verify signatures
with the corresponding public key.

2a. Generate Public/Private Keypair

You will need to generate a public/private keypair to be used for secure communication. The keypair
should be in “RSA 2048-bit” format. The private key must be “pksc8” format. The public key must
be in “DER” format.

Various third-party tools are available for generating this keypair. Refer to the documentation supplied
with the third-party tool for instructions.

The following is an example of keypair generation using OpenSSL:

# Generate private key.

$openssl genrsa -out leap_private_key.pem 2048

# Get the public key.

$openssl rsa -in leap_private_key.pem -pubout -outform DER -out

leap_public_key.der

# Convert private key to pkcs8 format to use it with HCL Leap

$openssl pkcs8 -topk8 -inform PEM -outform PEM -in leap_private_key.pem -

out leap_private_key.pem -nocrypt

2b. Upload Public Key

The public key must be uploaded to your License Server using the provided “flexnetlsadmin”
command line tool. This tool requires Java 1.8 to run and requires that the License Server’s Admin
password is set. Follow the instructions in the “Introduction to the HCL License Server” document to
set the Admin password. Run the “flexnetlsadmin” tool as follows:
flexnetlsadmin.bat -server https://[license server
host]/api/1.0/instances/[license server ID] -authorize admin [license sever
admin password] -uploadPublicKey [local path to public key (in DER format)]

For example:
flexnetlsadmin.bat -server https://
hclsoftware.compliance.flexnetoperations.com/api/1.0/instances/FED321CBA -
authorize admin adminpwd -uploadPublicKey C:\temp\leap_public_key.der

If you experience SSL issues when using the “flexnetlsadmin” tool, try one of the following:

i. Upgrade the JVM which is being used to run the “flexnetlsadmin” tool
ii. Import the certificate of https://hclsoftware.compliance.flexnetoperations.com into
the JVM’s trust store
iii. Run the “flexnetlsadmin” tool with the -noCertCheck flag (not recommended)
3. Confirm Entitlement Mapping
Invoke the following command to confirm that you have mapped entitlements to your license server
instance:
flexnetlsadmin.bat -server https://[license server
host]/api/1.0/instances/[license server ID] -authorize admin [license sever
admin password] -licenses -verbose

For example:
flexnetlsadmin.bat -server https://
hclsoftware.compliance.flexnetoperations.com/api/1.0/instances/FED321CBA -
authorize admin adminpwd -licenses -verbose

Sample output:
=======================================================================================

Feature ID Feature Name Feature Version Feature Count Used/Available

=======================================================================================

457084 HLEAP_Application 1.0 0/5

=======================================================================================

Device Information:

-------------------------------------------------------------

Device Name Feature Registered(Used Count)

-------------------------------------------------------------

=======================================================================================

Total feature count : 5

Total feature count used : 0

=======================================================================================

4. Product Installation
Follow the HCL Leap installation instructions at
http://leap.hcldoc.com/help/topic/LEAPv9/LEAP/in_overview.html to install the HCL Leap product
on IBM WebSphere Application Server with an IBM DB2 or Oracle database.
5. Additional Product Configuration
Additional product configuration properties are required for communication with the License Server. See
http://leap.hcldoc.com/help/topic/LEAPv9/LEAP/co_configuring_the_properties_file.html for instructions on updating the “Leap_config.properties” file.

Note: Leap must be restarted after making changes to any of these values.

Key Value Notes

hcl.LicensingConfig.privateKeyFileName Mandatory. Example: “C:/keys/leap_private_key.pem”
Location of private
key file, generated
in Step 2a.
hcl.LicensingConfig.licenseServerID Mandatory. Example: “FED321CBA”
HCL License Server
ID
hcl.LicensingConfig.clusterSharedID Any string. Example: “LeapProdEnv”
Associates nodes
in a clustered The same value should be set on all instances in a high-availability
environment. environment in which two or more Leap instances share the exact
same applications in the same database.

Note: This value can also be used if there is a reason to migrate the
Leap instance to a fail-over server, hosting the exact same applications
in the same database.

hcl.LicensingConfig.licenseServerType
hcl.LicensingConfig.localLicenseServerBaseURI
Usage of this property outside of these use cases is not permitted and
may result in loss of usage or faulty product behaviour.
Valid values: Indicates usage of Cloud License Server or Local License Server. If
“Cloud” or “Local” unset, the default value is "Cloud".
Must be set to "Local" if using a Local License Server.
The base URI of Example: “https://hcllicenseserver.companyinternal.com”
the HCL Common Must be set if using a Local License Server.
Local License
Server.
hcl.LicensingConfig.checkLicenseInterval Interval (in hours) Example:
for checking hcl.LicensingConfig.checkLicenseInterval=12
licenses with the
license server.
Maximum value is
7 days. If unset,
the default is 2
hours.

hcl.LicensingConfig.toEmailAddress A comma- Example:

separated list of hcl.LicensingConfig.toEmailAddress=leapadmin1@example.com,
email addresses to leapadmin2@example.com
send notifications
to if there is any
issue acquiring
licenses from the
license server.
6. Verify Installation
a. Start HCL Leap and proceed through the initial Leap setup screens as described in
http://leap.hcldoc.com/help/topic/LEAPv9/LEAP/in_setting_up_environment.html
b. Create a new HCL Leap application and deploy it. Check server logs for “Successfully issued
one more license.”
c. Launch this new application and submit one submission.
d. Delete the application. Check server logs for “One license was returned.”

7. Troubleshooting

a. If you experience SSL issues when HCL Leap is contacting the licensing server, validate that
you are using the most recent IBM JVM with IBM WebSphere Application Server. You may
have to import the license server’s certificate into the IBM WebSphere Application Server
environment, as below.

b. If you are using the Cloud License server

i. Host: hclsoftware.compliance.flexnetoperations.com
ii. Port: 443
c. The Alias can be anything you like to for this cert.
d. Click the “Retrieve signer information” button.
e. Verify the signer is trustworthy, then click Apply or OK button.