Commercial Features

Forseti’s OSS core is everything you need to run a self-service identity portal in front of Kratos and Hydra. A commercial license unlocks a small set of features aimed at teams running Forseti for more than one tenant or wiring it into a corporate identity provider.

This page is the buyer/operator overview: what the license unlocks, how the offline licensing model works, and where the free/paid line sits. For the operator and integrator detail of each feature, follow the links below.

What a license unlocks today

A commercial license unlocks a small set of features. They all ship and work today:

• Organizations — run Forseti for more than one tenant: named orgs beyond the always-free default, per-org membership and invites, per-org branding, an org-scoped admin slice, and the OIDC org / orgs claims for org-aware authorization.
• Enterprise SAML SSO — per-org SAML login (/sso/{org-slug}) against a customer’s corporate identity provider, with just-in-time provisioning and verified-email linking. Your apps keep doing plain OIDC.
• Observability - a Prometheus /metrics endpoint on the internal listener, token-gated, exposing HTTP RED metrics (request counts, latency) plus a couple of bridged operational gauges. A stock Prometheus, Grafana Agent, or OTel Collector scrapes it as-is.
• Linux authentication — higher seat cap. The Linux-authentication core (back your Linux hosts’ login accounts off the identity store) is free; a commercial license raises how many accounts you can provision. See Linux authentication below for exactly where the free/paid line sits.

Other capability names you might see referenced (SCIM provisioning, SIEM streaming, bulk admin) are planned, not shipped — they don’t work yet, so don’t plan around them.

How licensing works

Licensing is offline. Forseti never calls out to validate a license; verification is fully offline. There’s no license server and no outbound call at runtime — which matters if you self-host in a network that can’t (or won’t) reach the internet, including air-gapped deployments.

A license is a small signed file. You activate it by pasting the blob at /admin/license. Forseti verifies the signature itself, reads the customer name, expiry, the list of enabled features, and an optional cap on the number of orgs, then stores it. Each feature is unlocked independently — a license that includes Organizations but not SAML unlocks exactly that.

Active, grace, and locked

A license can carry an expiry (lifetime licenses never expire). Forseti checks the license against the clock at startup and whenever you activate one, putting each licensed feature into one of three states:

The grace period is a safety net: if a renewal is forgotten, your production deployment doesn’t break the moment the license expires — existing users keep logging in, and you can’t accidentally lose access to data you already created. You just can’t add new paid resources (new orgs, SAML connections) until you renew, and then it hard-locks. The window is a fixed 30 days of read-only operation after expiry and is not operator-configurable.

The feature set, expiry, and org cap come from the signed license itself, not from config — editing config.toml can’t widen what a license grants.

Free vs paid

The boundary is deliberately simple:

OSS ships exactly one real default org and every code path treats it like any other org — there’s no stubbed single-tenant mode. The license simply lets you add more orgs and switch SAML on, so an unlicensed deployment is always a fully working single tenant.

Linux authentication

Linux authentication is a hybrid: the capability is free, and a license raises one specific limit.

• Free / OSS. Everything operational: the resolver that serves passwd/group/SSH-key data to your hosts, host enrollment (and secret rotation/revocation), adding SSH keys, and provisioning POSIX accounts up to the free seat cap (free_seats, default 25). A single-machine or small-fleet operator never needs a license to run Linux auth.
• Commercial — higher seat cap. A license carrying the Linux-authentication feature raises the cap from free_seats to the license’s seat allowance, so you can provision more accounts. This is the only thing the license changes about Linux auth.
• Resolution is never gated. Whatever your license state, an already-provisioned account keeps resolving — a lapsed or missing license can stop you adding accounts but can never lock an existing user out of a machine. In the 30-day grace window after expiry, the cap falls back to the free tier for new provisioning (consistent with grace being read-only), while existing accounts keep working.
• Team-scoped host access needs Organizations. A host always belongs to one org and can resolve that org as a whole on Linux auth alone. Scoping a host to specific teams within the org (finer-grained host access) requires the Organizations feature — it’s part of the multi-org capability, not Linux auth on its own. Membership is resolved live at request time; there is no group-mirroring step.

The operator-facing how-to (enrolling hosts, provisioning accounts, the seat cap in practice) is in the operator guide → Linux authentication.

The licensing split

Forseti is dual-licensed:

• The OSS core — everything that runs Forseti as a single-tenant portal — is AGPL-3.0-or-later. See LICENSE.
• The commercial gate — the code that enforces the paid feature flags — is the proprietary, source-available Forseti Commercial License 1.0. See LICENSE-COMMERCIAL.

The gate is source-available so you can audit exactly what it does (it’s an offline signature check, nothing more), but it isn’t AGPL — running the paid features requires a license. The README’s License section is the canonical statement.