CIB seven License Keys

Some CIB seven features require a license key. The license will be provided as a string by the CIB seven support team. The following section explains the various methods by which a CIB seven license can be added to the Process Engine.

Deployment Scenarios and the License Key

Starting from CIB seven version 2.2.0, a license key should be applied per database.

In a clustered scenario, where multiple engines on multiple nodes access a single database, the license only needs to be activated once. When activated, a license is valid until the expiration date or until you have deleted your database. The license key is valid for an unlimited amount of engines.

In a multi tenancy scenario, the license check will be performed for each engine with an own database. Thus, you will be prompted to enter the license key separately for each engine.

Note In the versions before CIB seven 2.2.0, a license key was stored on the file system, and therefore it should be applied to each node of the cluster.

License Key Pickup Methods

Through the Admin Webapp UI

Any environment setup that uses the enterprise CIB seven Admin webapp, can use the provided License key page to enter a valid license key. Please see the dedicated Admin webapp docs section for more details.

Through the Home Directory

Another possibility is to put a file with the license key on the path ${user.home}/.cibseven/cibseven-license.txt. This is another method that can be applied in any environment setup. The license key will be automatically loaded in the database table unless a valid license key is already present.

Through the configuration file

License keys could be stored in a file specified by an optional application property cibseven.webclient.license.file.path in your cibseven-webclient.yaml

With the CIB seven Spring Boot Starter & CIB seven Run

CIB seven Run, and other Spring Boot applications that use the CIB seven Spring Boot Starter, can be provided with license keys in two additional ways:

  • provide a URL to a license file via a custom application property cibseven.webclient.license.file.path in your application.yaml.
  • provide the license key in a file called cibseven-license.txt and put it into ${user.home}/.cibseven/ directory.

Note: For these two ways to be available, the CIB seven Run EE edition must be used, or the Spring Boot application must use the EE version of the starter, with -ee suffix.

<dependency>
  <groupId>org.cibseven.bpm.springboot</groupId>
  <artifactId>cibseven-bpm-spring-boot-starter-webapp</artifactId>
  <version>${project-version}-ee</version>
</dependency>

Authenticating Licensed Frontend Chunks

Many enterprise features are loaded by the browser as separate, license-gated JavaScript chunks — among them process instance search, the audit log and user operations, process restart and modification, batch operations, human task search, decision instance search, reports, cleanup and the engine metrics charts. Every request for one of these chunks is checked against the license on the server, and refused with 403 if no valid license can be resolved.

To let that check identify the user, the webclient registers a service worker that attaches the current user’s auth token to each chunk request as an Authorization header — a dynamic import() issued by the browser cannot carry a custom header on its own, which is why the service worker exists at all.

This breaks down when the user is already authenticated before the webclient starts. A custom integration — SAML, or a session established by a reverse proxy or API gateway — never passes through the standard login form, the SSO callback, or the ?token= bootstrap, so nothing ever writes the token to sessionStorage/localStorage. The service worker then has no token to attach, the webclient does not issue the chunk request at all, and the feature shows a “License Required” message even though the license itself is perfectly valid.

Leaving chunk authentication to the server

For these setups, set cibseven.webclient.license.chunk.trustServerAuthentication to true:

cibseven:
  webclient:
    license:
      chunk:
        # Set true when the deployment authenticates requests itself, without an
        # Authorization header (gateway, SAML, mTLS).
        trustServerAuthentication: true

This tells the webclient that your deployment can authenticate a chunk request without help from the browser. The request is then sent rather than cancelled, and your IUserProvider.authenticateUser(HttpServletRequest) gets to authenticate it from the session, proxy header, or cookie it already relies on.

Note what the property does not do. It does not disable the license check, and it does not weaken server-side authentication: a request your user provider cannot authenticate is still refused with 403, and the feature still shows “License Required”. It only stops the browser from giving up before the server has been asked.

Deployments that use the standard login flows need no configuration here — the token is in browser storage, the service worker attaches it, and the default (false) is correct.

License content

This section defines what is a valid license key that will be accepted by the CIB seven webclient. This description is valid for all License pickup methods.

A valid license key content is stored in a JSON format with the following items:

{
    "customer":"Test Solutions GmbH",
    "signature":"XXXXXX...",
    "expires":"2025-12-31"
}

Note that omitting any part of the content will result in an error, and you will have to re-enter your license key in the correct format.

On this Page: