Component validation

[VSornalakshmi]

I have a scenario where I need to validate whether a fingerprint matches. If it doesn't match, I need to check the components using the validate-key API. The machine fingerprint consists of five components, but it is not necessary for all five to match. Only four of the components need to be validated.
How should I implement the component matching strategy in this case?
Additionally, I understand that components should always be sent along with the fingerprint. If the fingerprint is missing, the error 'FINGERPRINT_SCOPE_REQUIRED - fingerprint is required when using the components scope' occurs. Could you please clarify the correct approach to handle this scenario?"

[ezekg]

You would probably want the MATCH_MOST component matching strategy, which would require that at least 3/5 match i.e. the majority. We don't have a matching strategy for n-1 yet. And yes, you can't match against a machine's components without telling the API which machine to match against, so the fingerprint scope is required when using the components validation scope.

[VSornalakshmi]

{
"meta": {
"key": "license-key",
"scope": {
"product":"product-id",
"policy":"policy-id",
"fingerprint": "$machines[0].fingerprint",
"machine":"machine-id",
"components": [
"$components[0].fingerprint",
"$components[1].fingerprint",
"$components[2].fingerprint",
"$components[3].fingerprint"
]
}
}
}

Product, Policy, Machine and fingerprint scopes are enabled in my policy. Component matching strategy is set as MATCH -MOST.

[ezekg]

Can you please explain the actual issue e.g. expected vs actual behavior? If you're receiving a fingerprint mismatch code, that typically means the machine is not activated for the given license key and that you should activate it.

Share the failing validation response if possible.

[VSornalakshmi]

We are generating the machine fingerprint using the following components: UUID, system serial number, hostname, username, and hard disk ID and add to machine and components when user activates the license.
The goal is to validate whether the fingerprint matches. If it does not match, we need to check if at least 4 of these components match.

Currently, when we pass both the fingerprint and components to the validation API, it first validates the fingerprint. If the fingerprint does not match, the system returns the error "FINGERPRINT_SCOPE_MISMATCH indicating that the fingerprint is not activated or does not match any associated machine.

However, what we expect to happen is that, if any component values are missing or incorrect in the fingerprint generation, the system should proceed with the component matching strategy and check if at least 4 components match, instead of immediately returning a fingerprint mismatch error.

Please let me know if we are on the right track or if there's anything we need to look into.

[ezekg]

That's not how the validation works. The fingerprint must exist before the components are also asserted. You should use a fingerprint value for the machine that is known to not change, or very unlikely to change, e.g. the OS GUID or some static value, and then add hardware components to that machine. This will allow some hardware components to be changed, but not the OS GUID.

The validation engine will look up the machine by fingerprint, and then assert that enough components satisfy the matching strategy for the given machine. If the machine does not exist, it will return a mismatch code.

[VSornalakshmi]

Thankyou for your quick response.