Managing Flexera One SaaS Management Connections

FlexNet Manager Suite 2024 R2 (On-Premises)
Tip: Imports through a connection with Flexera One SaaS Management supersede and override imports from any of the following connectors:
  • Microsoft 365
  • Microsoft Office 365 (deprecated)
  • Salesforce.com.
When you authorize imports from Flexera One SaaS Management, any existing or future licenses created from any of the above connectors are automatically given a status of Retired, so that they have no impact on license reconciliation calculations. Instead, new licenses are created from the Flexera One SaaS Management imports to cover the same applications, and these are included in license reconciliations as usual. Therefore, if you are switching from one or more of the above connectors to integration with Flexera One SaaS Management, it may be helpful to:
  1. Run your first import from Flexera One SaaS Management so that the new licenses are created and can be inspected/validated.
  2. Review each of the now-Retired old licenses created by previous use of the old connectors, and switching any attachments (such as documents, purchases, contracts and the like) across to the corresponding new licenses, in order to preserve information as an audit trail (keeping in mind that linked purchases and contracts are for information only now, since consumption for these licenses is calculated in, and imported from, Flexera One SaaS Management).
  3. When satisfied, remove the old connectors, and optionally delete the Retired licenses that were imported from them and have now been replaced.
For more information about switching from old connectors to the Flexera One SaaS Management connector, see Deprecating Other Connectors in FlexNet Manager Suite Inventory Adapters and Connectors Reference.
Importing information from Flexera One SaaS Management requires two elements:
  • You have licensed both FlexNet Manager Suite (on-premises) and Flexera One SaaS Management (in the cloud).
  • You configure one inventory beacon to make the connection to Flexera One SaaS Management, as described below.

Prerequisites

To complete this process, your chosen inventory beacon must meet the following requirements, some of which should have been fulfilled when the FlexNet Beacon software was installed:
  • This must be the only inventory beacon in your computing estate where you configure a connection to Flexera One SaaS Management, as only a single connection is allowed.
  • This must be a top-level inventory beacon, with direct access to the Internet (optionally, through a proxy server). It must not be a child inventory beacon that uploads to a parent inventory beacon.
  • PowerShell 5.1 or later is running on Windows Server 2012 or later, or on Windows 7 SP1 or later; with the PowerShell execution policy set to RemoteSigned.
  • Ensure that the Windows Environment Variable PSModulePath includes the following path: 
    %ProgramFiles%\WindowsPowerShell\Modules
  • The software installed on the inventory beacon must be release 14.3.0 (shipped with 2019 R2.3) or later.
  • You must log onto the inventory beacon, and run FlexNet Beacon, using an account with administrator privileges.
  • It is also convenient if a web browser is installed and enabled on the inventory beacon.

The connection to Flexera One SaaS Management supports optional use of a proxy server.

To configure the connection to your Flexera One SaaS Management instance:

  1. Run the inventory beacon interface (for example, in the Windows Start menu, search for FlexNet Beacon, right-click it, and select Run as administrator).
    Tip: Remember that you must run the inventory beacon software with administrator privileges.
  2. From the Data collection group in the navigation bar, choose Schedules.
    If there is not already a suitable schedule in the list ready for you to (re)use, click New... and complete the details (see Creating a Data Gathering Schedule for more information). Otherwise, identify the schedule you will use for importing data from Flexera One SaaS Management to FlexNet Manager Suite. In normal operation, once a day in an off-peak time is generally sufficient. Allow enough time for data collection and upload to your inventory database – say, 30 minutes before your nightly full inventory import and license consumption calculations are scheduled.
  3. Also in the Data collection group, click Inventory systems.
    The list of current connections for this inventory beacon appears.
  4. Below the list, select the down arrow at the right of the Next... button, and from the drop-down options, choose PowerShell.
    The Create PowerShell Source Connection dialog appears.
  5. Create a Connection Name.
    Make the name meaningful within the first few characters, as it will appear in lists with fairly narrow columns.
  6. From the Source Type drop-down, choose Flexera One SaaS Management.
    Two additional fields appear in the lower part of the same dialog.
  7. If a proxy server is in use between the inventory beacon and Flexera One SaaS Management, select the Use Proxy check box, and complete the following additional details:
    • Proxy Server: Enter the address of the proxy server using HTTP, HTTPS, or an IP address. Use the format https://ProxyServerURL:PortNumber, http://ProxyServerURL:PortNumber, or IPAddress:PortNumber). If the protocol is omitted, it defaults to http:. If the port number is omitted, it defaults to :80 for http, or 443 for https.
    • Username and Password: If your enterprise is using an authenticated proxy, specify the credentials to access the proxy server you just identified.
  8. The SaaS Manager URL field defaults to https://api.flexera.com/saas/v1. Only overwrite this value if you have a specific URL available only to your enterprise (such as a private staging environment).
    Tip: This URL is automatically (and privately) extended to ensure that your connector can access only your own enterprise data.
  9. Your Flexera Organization ID is automatically populated with a read-only value. This value is taken from your license to use FlexNet Manager Suite.
  10. The account that the inventory beacon supplies when exercising this connector must have access (with at least read-only privileges) to Flexera One SaaS Management:
    1. An existing user (with appropriate privileges) logged in to Flexera One SaaS Management can invite the chosen user account, identified by an email address, to access Flexera One SaaS Management online.
    2. When access is granted to that account, use your web browser to download the PowerShell script generate-refresh-token.ps1. This is available through the knowledge base in the Flexera Customer Community: search for "SaaS Manager Refresh Token Generator". Download the script to your inventory beacon (or download to a web-connected browser on another device, and copy across to your inventory beacon).
    3. On the inventory beacon, run the PowerShell command line console.
      For example, press Windows + R keys together on the keyboard to open the Run box. Type powershell and hit Enter.
    4. In the PowerShell command line, run the downloaded script in the appropriate path.
      For example:
      PS C:\Downloads\generate-refresh-token.ps1
    5. When the script asks for the IAM Username, enter the email address used to give the service account access to Flexera One SaaS Management.
    6. Similarly, when the script asks for the IAM Password, enter the password for that account that will be used to access Flexera One SaaS Management.
    7. The PowerShell script then returns a refresh token. Copy this value, switch back to the Create PowerShell Source Connection dialog in FlexNet Beacon, and paste the value into the Refresh Token field.
    8. You may exit the PowerShell command line console.
      Tip: If you later need to refresh the token, you can rerun the same PowerShell script.
  11. When all data is complete, click Test connection.
    There are two possible outcomes:
    • If the inventory beacon can successfully access Flexera One SaaS Management using the details supplied, a Test connection succeeded message displays. Click OK to close the message, and continue with the next step.
    • If the Test connection fails and displays an error message, see below for further insight. Then click OK to close the message, review and correct the connection details, and retest the connection. You cannot save the connection details if the connection test fails. If you cannot get the connection test to succeed, click Cancel to cancel the addition of these connection details, and seek further assistance.
  12. When your connection test is successful, select your new connection from the displayed list, and click Schedule....
  13. In the dialog that appears, select the name of your chosen schedule for inventory collection through this connection, and click OK.
  14. At the bottom of the FlexNet Beacon interface, click Save, and if you are done, also click Exit. Your work here is done.
If you receive an error message when testing the connection, check this table for possible corrections:
Error message More information 
Unable to validate Refresh Token with 
Flexera Identity and Access Management (IAM).
Please check Refresh Token, and ensure any
proxy server or firewall allows access to
IAM.
Also displays the URL used to access IAM, and the HTML response received.
  • Most common problem here is a copy/paste error in the Refresh Token field. Clear the field entirely, get a fresh copy of the token from IAM, and paste it carefully into the field before retesting the connection.
  • If you have added settings for a proxy server, ensure that these are correct too. A proxy server may return HTML response codes like 403 (Forbidden), 407 (Proxy Authentication Required – meaning that the user name and password are not correctly set), or 408 (Request Timeout – by the proxy server).
  • It's possible that IAM is experiencing a service interruption (typically displays a 404 error); or has an internal error (returns 500). 
SaaS Manager returned an unexpected response.
Please check that your SaaS Manager URL is
correct, and that your Refresh Token has
access to SaaS Manager.
Also displays the URL used to access IAM, and the HTML response received.
  • Most common error is an incorrect URL, most especially if the HTTPS (secure) protocol has not been specified. If need be, correct the SaaS Manager URL field to https://api.flexera.com/saas/v1 before retesting the connection. Do not include any additional characters after the default string provided.
  • If this does not correct the problem, replace the Refresh Token field (as described above). 
Invalid SaaS Manager URL specified. Please 
note that the 'https://' protocol must be
included.

No attempt has been made to contact Flexera One SaaS Management, because local checking of the SaaS Manager URL field showed the format was invalid. This may be because the protocol was omitted, or because there was excess white space included. Correct the URL as shown above.
After correcting any error, click Test connection again. Remember that you cannot save the connection details if the connection test fails. Once you have a successful connection test, click Save to add the connection to the list.

FlexNet Manager Suite (On-Premises)

2024 R2