Set up an on-premises license server (Icarus)

Icarus is SciTools' license server that you host on your own network. Normally Understand verifies licenses against SciTools' cloud server (Helios, at licensing.scitools.com); Icarus is a drop-in replacement for closed labs and other environments that can't reach it. It speaks the same HTTPS/REST protocol, so as far as Understand is concerned there is no difference — clients just point at your server instead.

Icarus hands out seats keyed to the requesting username, whatever machine the user is on, and denies requests once the seat cap or concurrent-use limit is reached. A web GUI shows who is using what and lets an administrator deregister users, free stuck seats, and pull usage reports.

Requirements

• Set up must be done by a user with admin privileges (also required to register the service).
• Two incoming ports open — 443 and 80 by default (both configurable).
• A 64-bit OS: Windows 7+, macOS 10.12+, RHEL/CentOS 7.4+, or Ubuntu 16.04+.

The -service feature doesn't cover RHEL/CentOS 8 or macOS

The service library Icarus uses can't register a service on RHEL/CentOS 8 or macOS. Icarus itself runs fine there when launched with sudo/as root — arrange your own startup script or system service to launch it at boot.

Install and license the server

1. Locate icarus.zip — it ships inside every Understand install kit (in the same directory as the und executable) — and extract it on the server machine. It is also available from licensing.scitools.com/download-all (log in, then switch the product selector to Icarus).

2. In a terminal running as administrator, from the extracted directory:

   icarus -service install
   icarus -service start
   

   (The other service commands are stop, restart, and uninstall.)

3. Open a browser to the server (https://localhost from the machine itself). The page shows an InstanceId.

4. Send the InstanceId to SciTools or your regional distributor; you'll receive an icarus.dat license file in return.
5. Upload icarus.dat through the web GUI (Add Icarus License). Seats are served immediately.

Point Understand at your server

On each client (or once in a deployed image):

und -setlicenseserver <hostname-or-IP>

Add :<port> if you changed the license port from its default 443 (e.g. und -setlicenseserver license01:9000). The UNDERSTAND_LICENSE_SERVER environment variable does the same per-run, which is handy on CI runners — see Licensing from the command line, the und licensing reference, and Licensing without internet. Understand uses the system proxy, so a proxy rule may be needed for clients to reach Icarus.

Configuration: settings.dat

On first launch Icarus writes settings.dat next to its logs:

OS	Location
Windows	C:\Windows\System32\config\systemprofile\AppData\Roaming\SciTools\Icarus
Linux	/.config/SciTools/Icarus (under root's home when run as a service)
macOS	/Library/Application Support/SciTools/Icarus

Key	Default	What it does
Port	443	HTTPS port Understand connects to for licenses. May equal SecureWebport.
SecureWebport	443	HTTPS port for the web GUI. May equal Port.
EnableWebport	0	Enables (1) the unencrypted web GUI on Webport — for users who can't bypass the self-signed-certificate warning.
Webport	80	Unencrypted web-GUI port (GUI only — Understand can't license through it).
AllowTLS12	0	Accept TLS 1.2 in addition to TLS 1.3 (see below).
AuthName / UserHash	—	Optional web-GUI login username (plain text, or SHA-256 hash). Use one, not both.
AuthPass / AuthHash	—	Optional web-GUI login password (plain text, or SHA-256 hash). Use one, not both.
InstanceId, MachineId, Hash	—	Generated identifiers — never edit these, Icarus stops working.

Every change requires an Icarus restart. Setting both an auth name and password makes the web GUI prompt for a login; use it over SecureWebport, since on Webport the credentials travel in plain text. Icarus generates a self-signed cert.pem/key.pem pair — browsers will warn until you bypass the warning or replace the pair with your own certificate and key (same filenames).

TLS compatibility

Icarus requires TLS 1.3 by default. If a client can't negotiate it — most commonly Understand on macOS, whose TLS backend only offers TLS 1.2 — set AllowTLS12 1 in settings.dat and restart. Understand builds 1078 and newer speak TLS 1.3 and work with every Icarus version; if you're running much older Understand builds, contact support for the compatibility matrix (builds older than 934 can't use Icarus at all).

Manage users and seats

In the web GUI, the In Use view is a live snapshot of available seats and active users; the Users view lists everyone who has ever connected, where you can deregister a user or free a seat that's stuck in use. Users are added automatically on first connection. To restrict who may take a seat, upload an access list — a text file with one alphanumeric username per line — via Add User Whitelist. Generate Report produces a signed usage report for a date range (Validate Report checks one hasn't been altered), and daily per-user usage accumulates in a downloadable CSV. For the cloud-licensing equivalent of this workflow, see Manage a team — seats and usage.

Logs and troubleshooting

Icarus writes three logs beside settings.dat: err.log (errors) and event.log (registrations, start/stop — the two to attach to a support ticket), plus web.log (access log). Like Understand, Icarus follows a live-service model — if you hit an issue, try the latest build first. Two known gotchas: upgrading across a minor version (e.g. 1.1.x → 1.2.x) usually needs a new icarus.dat from your distributor, and Nessus vulnerability scans have been known to terminate the Icarus service unexpectedly. Questions: [email protected].