Allocation of Named and Document CALs to specific AD group

[#1]

Hello all,

I am currently struggling with an issue of allocation Document and Named CALs.

I have about 300 Named CALs and 250 Document CALs. This number is quite high so I do not want to allocate the licenses manually so I turned on 'Dynamic Allocation' (250 Doc CALs are dedicated to one special document).

I would like to configure that Document CALs are consumed ONLY by people in AD group A and Named CALs by colleagues in AD group B.

Is this possible? If yes than how?

Thank you for replies.

[Peter_Cammaert]

IMHO this is not possible using the standard tools, for two reasons:

• There is no way to reserve a type of CAL exclusively for users of a specific AD domain
• There is no way to break the logic of dynamic CAL assignment (see chapter 14.4 Combining different CAL's in the Server Ref Manual)

Sorry,

Peter

[#3]

Hi Peter,

Would it not be possible to do a slight workaround and have publisher publish two different documents based on the AD group/domain and after that assign the decided number of CALs to be dynamic distributed on the two (?) documents?

[Peter_Cammaert]

The question then becomes: will you get a dynamically assigned CAL before or after security kicks in and decides you don't have access to that particular document anyway? I'm not really sure.

Peter

[#5]

Hi Peter,

The CAL is assigned by the server when the document is opened up, so you will not end up in a scenario where you lose a CAL based on the access rights missing on the document. However, the best would be to only show the document the user has access rights to on the access point to avoid confusion.

/H

[Peter_Cammaert]

Okay, that's settled then.

It may work, but a number of conditions still apply: Vladimir will need a Publisher and he will need to do a lot of AD Group management as AD Groups are the only means to avoid the entry of lots of users somewhere in QMC. Assuming that he will have other documents on his server and Dynamic CAL assignment has been turned on for Named CALs all over the place, he should decide on how to best handle security by distribution target with multiple groups. Probably means one AD group per document.

Peter

[#7]

Yes, its not a solution that is as sleek and perfect due too all the limits in CAL handling, however, in the right scenario it still might be an option. But as you stated, there are several things that needs to be considered before going down this route.

/H