Allow user machine activation, but not deactivation

[nschloe]

I'd like to give out licenses for a number of machines, and I'd like my users to activate them themselves. I'd like to avoid though that they can also deactivate them at will, effectively turning a license for 2 machines into a license for a million ones (just not simultaneous use). My idea is to automatically take out machines out of the pool after a period of time, say a week, if there's no machine heartbeat.

This requires the user to be able to manually activate, but not deactivate machines. Is this possible in policies? (I only find Protected.)

[ezekg]

You'd need to disable license key authentication, via setting the policy's authentication strategy to TOKEN instead. Then generate a license token with a deactivation limit of 0, effectively blocking deactivations.

Alternatively, if you're on an Ent tier for Keygen Cloud, or self-hosting Keygen EE, then you could also remove the machine.delete permission from any relevant licenses.

[nschloe]

Just tried that and it didn't work. Setting the limit to anything >=1 is okay, setting it ==0 results in infty. (I used the web interface.) Bug?

[ezekg]

This may be a UI bug. It looks like it's showing "unlimited" when the value is set to zero or null, when it should only show "unlimited" when the value is null. Even with the UI bug, the API should behave as-expected with a zero value. Will fix the UI bug soon.

[ezekg]

This should now be fixed.