Release Notes. KNOX Premium SDK. Version 2.5

Transcription

1 Release Notes Premium SDK 2.5 September 2015

2 Copyright Notice Copyright 2015 Samsung Electronics Co. Ltd. All rights reserved. Samsung is a registered trademark of Samsung Electronics Co. Ltd. Samsung is a trademark of Samsung Electronics, Co., Ltd. in the United States and other countries. Specifications and designs are subject to change without notice. Non-metric weights and measurements are approximate. All data were deemed correct at time of creation. Samsung is not liable for errors or omissions. Android and Google Play are trademarks of Google Inc. ARM and TrustZone are registered trademarks of ARM Limited (or its subsidiaries) in the EU and/or elsewhere. Bluetooth is a registered trademark of Bluetooth SIG, Inc. worldwide. Cisco AnyConnect is a registered trademark of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. F5 Big IP-Edge Client is a registered trademark of F5 Networks, Inc. in the U.S. and in certain other countries. ios is a trademark of Apple Inc., registered in the U.S. and other countries. Junos Pulse is a trademark of Pulse Secure, LLC. KeyVPN Client is a trademark of Mocana Corporation. Microsoft Azure and Microsoft Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. NFC Forum and the NFC Forum logo are trademarks of the Near Field Communication Forum. OpenVPN is a registered trademark of OpenVPN Technologies Inc. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. strongswan is an open source software under General Public License as published by the Free Software Foundation. Wi-Fi is a registered trademark of the Wi-Fi Alliance. All brands, products, service names and logos are trademarks and/or registered trademarks of their respective owners and are hereby recognized and acknowledged. Samsung Premium SDK Information : 2.5 Supported Target Platform Android 5.0 (Lollipop) Document History Date SDK Doc Description of changes 12/27/ Base document version 7/10/ Added new polices. Removed Takeover APIs 10/21/ Added new and 3/4/ Added new 2.0 (includes 1.2 APIs) Separated Smart Card (SC) SDK 7/8/ Added new 2.1 polices. Update on released 2.0 polices. 9/25/ Updated all existing policies & features till 2.1. Added new 2.2 polices. 12/5/ Updated all existing policies & features till 2.2. Added new 2.3 polices. 3/4/ Updated all existing policies & features till 2.3. Added new 2.4 polices. 9/3/ Added new 2.5 polices. Note: No changes in Contact Information Samsung Electronics Co., Ltd 416, Maetan-3dong, Yeongtong-gu Suwon-City Gyeonggi-do, Samsung Research America, Ltd 665 Clyde Avenue, Mountain View, CA United States of America Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. ii

3 Contents 1 Introduction... iv Additional documentation... iv 2 Installation and configuration Supported features... 6 Previous version 2.4 Release history... 6 Previous version 2.3 Release history... 8 Policies implemented up to New features and enhancements New 2.5 feature descriptions New 2.5 feature enhancement descriptions New 2.5 policies Issues fixed Known issues Samsung Standard SDK Developer Guide Copyright 2015 Samsung Electronics Co. Ltd. iii

4 1 Introduction This release contains the policies released as part of the Enterprise Device Management Project. The Enterprise Device Management project is part of a broader on-going effort to make Samsung Android Smart phones & Tablets enterprise friendly. These policies are intended to be used by any Device Management client to enforce organization specific policies on employee devices. MDM clients developed by Samsung Partners are intended to make use of these policies to satisfy their and their customer s requirements. Additional documentation The following documentation is also available for additional information regarding the Samsung Standard and Premium SDKs: Samsung Premium SDK Developer Guide Describes the Samsung Premium and Standard SDK APIs and explains how to use them to develop Android app containers and other mobile enterprise features that can be implemented in Enterprisemanaged Samsung -enabled mobile devices. This guide includes Java device and container use case examples. You should consult this guide if you want to implement an agent APK that calls SDK APIs and communicates with the partner s management server. The partner agent APK must be installed on the device by the user or IT admin, typically through Google Play or side loading. The advantage of this approach is that this is the traditional model that supports pre- 2.0 versions of the SDK. Samsung Quality Criteria for MDM Solutions Describes the quality criteria for Samsung that each MDM partner should implement with their mobile device management solution. Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. iv

5 2 Installation and configuration The Premium SDK policies are currently developed on Android Lollipop. The required MDM client should be installed on this device and the new policies can be exercised. Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 5

6 3 Supported features Previous version 2.4 Release history The following table includes the policies which have been developed in 2.4: Policy Group Advanced Restriction Policy Group Policy CC Mode State: AdvancedRestrictionPolicy.getCCModeState() Container Configuration: Container Configuration Policy group ConfigurationType.setEnterpriseIdentityAuthentication() ConfigurationType.getEnterpriseIdentityAuthentication() ConfigurationType. setgenericssoconfig() ConfigurationType. getgenericssoconfig() ConfigurationType.setKeyguardDisabledFeatures() ConfigurationType.getKeyguardDisabledFeatures() Container Management: 2.4 Container Management ContainerConfigurationPolicy.enableBluetooth() ContainerConfigurationPolicy.isBluetoothEnabled() ContainerConfigurationPolicy.enableNFC() ContainerConfigurationPolicy.isNFCEnabled() The following table lists helper classes which have been developed in 2.4: Class Comments MDM KnoxVpnErrorValues New error code class 2.4 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 6

7 The following table includes the constants which have been developed in 2.4: Class AdvancedRestrictionPolicy Constant CCMODE_STATE_NOT_SUPPORTED CCMODE_STATE_NONE CCMODE_STATE_DISABLED CCMODE_STATE_READY CCMODE_STATE_ENFORCING CCMODE_STATE_ENABLED 2.4 The following table includes the list of policies which have been deprecated in 2.4: Policy Group Advanced Restriction Policy Group Policy AdvancedRestrictionPolicy.isCCModeEnabled(boolean showmsg) 2.0 The following table includes the list of constansts have been deprecated in 2.4: Class Member EnterpriseSSOPolicy SSO_SAMSUNG_SERVICE_PACKAGE_PATH 2.0 The following table includes the list of constansts have been deprecated and not supported since 2.4: Class Member SmartCardAccessPolicy BT_SECURE_MODE_DISABLED 2.0 The following table lists the policies which have not been supported since 2.4: Policy Group Enterprise ISL Group EnterpriseISLPolicy class Policy IntegrityResultSubscriber class 1.0 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 7

8 Previous version 2.3 Release history The following table lists the policies which were developed in 2.3: Policy Group Policy Container Configuration: 2.3 Container Configuration Policy group ConfigurationType.setBiometricAuthenticationEnable d(int bioauth, boolean enable) ConfigurationType.isBiometricAuthenticationEnabled( int bioauth) Container Management: 2.3 Container Management ContainerConfigurationPolicy.setSettingsOptionEnabled(Str ing option, boolean enable) ContainerConfigurationPolicy.isSettingsOptionEnabled(Stri ng option) The following table lists the constants which were developed in 2.3: Class Constant ContainerConfigurationPolicy OPTION_CALLER_INFO 2.3 The following table lists the policies which have been deprecated in 2.3: Policy Group Policy Enterprise ISL Group EnterpriseISLPolicy class IntegrityResultSubscriber class EnterpriseManager.getEnterpriseISLPolicy() 1.0 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 8

9 Policies implemented up to 2.2 The following table includes the list of policies which have been developed up to 2.2: Policy Group Policy Audit Log Container Application Policy group Container Firewall Policy group Container Restriction Policy Group Certificate Management Container VPN Policy group Enterprise Container Management Policy group Container Password Policy Group Enable/Disable Audit Log Service 1.0 Manage/Monitor Audit Log Feature Parameters 1.0 Dump Audit Log Information 1.0 Additional Audit Log Features 1.0 Container Package management 1.0 Start/Stop an Application 1.0 Enable/Disable Application 1.0 Write data in application home directory. 1.0 Add/Get/Check/Remove the packages in the intall white 1.0 list. Home shortcut 1.0 Prevent user from clear data certain application 1.0 Prevent user from clear cache certain application 1.0 Application inside container based Firewall 1.0 Get active IPTABLES rules 1.0 Web Filtering / Reporting 1.0 Redirect Exceptions 1.0 Kernel routing table information 1.0 Allow/Disallow Camera 1.0 Allow/Disallow Share List 1.0 Allow/Disallow Use Secure Keyboard 1.0 Manage trusted CA restriction list 1.0 Notify MDM admin of certificate failure events 1.0 Notify user of certificate failure events 1.0 Display to the user the identity of the entity that signed an 1.0 application Manage untrusted upon user certificate request restriction list 1.0 Certificates Revocation Status Check 1.0 Certificate Validation at install time 1.0 Add/Remove Per App VPN in Container 1.0 List packages with VPN profile 1.0 Add/Remove VPN profile in Container 1.0 Container Creation policy 1.0 Container removal policy 1.0 Container Information Policy 1.0 Container Activation/Deactivation policy 1.0 Container Activation/Deactivation policy 1.0 Password Age IT policy rule 1.0 Maximum Password History IT policy rule 1.0 Minimum number of complex characters 1.0 Password Policy Delay 1.0 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 9

10 Enterprise Single-Sign-On (Added late binding support) Enterprise ISL Group Attestation Enterprise License Management Enterprise Premium VPN Policy Group SEAndroid Policy Enforcement Password Change enforcement 1.0 Maximum password attempts for Container disable 1.0 Password Maximum Repeated Characters 1.0 Password Maximum Repeated Numerics 1.0 Password Forbidden Personal Data 1.0 Maximum Sequence of Characters 1.0 Minimum change in Password Characters 1.0 Enable / Disable Make password visible option 1.0 Password sufficient. 1.0 Get SSO error code Get EnterpriseSSOPolicy object Perform Prebaseline scan 1.0 First time device approval using MDM 1.0 Perform Integrity scan 1.0 Clear integrity baseline 1.0 Add 3rd party package to baseline 1.0 Remove3rd party package from baseline 1.0 Update the current baseline 1.0 Register callback with integrity service 1.0 Request binding to integrity service agent 1.0 Check if integrity service agent is ready 1.0 start the runtime Integrity monitoring 1.0 stop the runtime Integrity monitoring 1.0 get the List of ISA 2.0 Start attestation Start attestation with nonce Set the attestation server URL Get device id Activate Enterprise License Connect/Disconnect Per app VPN Set/Get certificates for authentication 1.0 Set/Get VPN Connections 1.0 Set/Get VPN mode 1.0 Enable/Disable Route and setting. 1.0 Remove VPN Connection 1.0 Update SEAndroid Policy 1.0 Update Mapping of File Paths to Security Labels 1.0 Update Mapping of Android Properties to Security Labels 1.0 Update Mapping of Java Applications to Security Contexts 1.0 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 10

11 Revoke SEAndroid policies 1.0 Get the SEAndroid Agent owner 1.0 Get the status of the SELinux property 1.0 Get AMS Enforce State 1.0 Get AMS Log Level 1.0 Set SELinux Enforcing 1.0 SmartCard Policy group Enable/Disable SmartCard credentials for 1.0 Enterprise Single-Sign-On Enable/Disable SmartCard Authentication for Browser 1.0 Set/get customer ID 1.0 Set Application whitelist 1.0 Delete Application whitelist 1.0 Delete Application whitelist state 1.0 Set Customer Information 1.0 Force user to re-authenticate 1.0 Unenroll user from SSO service 1.0 Enterprise Manager Get 1.0 Enterprise Container Management Policy group Generic VPN Policy Group SEAndroid Policy Enforcement Get ified State 1.0 Container Activation/Deactivation Policy Container Activation/Deactivation Policy Connect/Disconnect Per app VPN Set/Get Certificates for authentication Set/Get VPN Connections Set/Get VPN mode Enhanced VPN Functionality Remove VPN Connection Get state/error-status of the profile Get SELinux Mode Get the SEInfo from PackageName Get the SEInfo from Certificate Get Domain from PackageName Get Domain from SEInfo, PackageName Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 11

12 Get DataType from PackageName Get DataType from SEInfo, PackageName Update MAC Permission Enterprise License Manager De-Activate license 1.2 Container Remote content provider Data sync management policy 2.0 policy Container group Remote content provider File moving policy 2.0 policy Container group Remote content provider Application moving policy 2.0 policy Certificate group Management Prevent removal of certificates / resetingkeystore 2.0 Certificate Management Permit an application to read private keys 2.0 Container Management Container Creation policy 2.0 Policy group Container Management Container removal policy 2.0 Policy group Container Management Container Information Policy 2.0 Policy group Container Management Container configuration policy 2.0 Policy group Container Management Container Activation/Deactivation policy. 2.0 Policy group Container Management Self Uninstall Policy 2.0 Policy group Enterprise License Manager Activate license(non-admin) 2.0 Enterprise License Manager De-Activate license (non-admin) 2.0 SmartCard Policy group Enforce certificate alias name used for SmartCard 2.0 SmartCard Policy group credentials Bluetooth Secure for S/MIME Access to Card reader 2.0 SmartCard Policy group Select certificate alias name for SmartCard Authentication 2.0 VPN Management Group with Connect/Disconnect Browser Per app Vpn. 2.0 Enterprise Client Certificate Manage Client Certificates 2.0 Manager Enterprise Policy Group TIMA Keystore Manage TIMA Keystore 2.0 Policy SEAMS Group Manage SEAMs APIs 2.0 Advanced Restriction Policy Manage Firmware Auto update 2.0 Advanced Restriction Policy Manage CC Mode 2.0 Advanced Restriction Policy Exclusive admin support 2.0 Advanced Restriction Policy ODE Trusted Boot verification 2.0 Container Smartcard Access policy Enable smartcard access policies inside container 2.0 Container Configuration policy Add/Get/Check/Remove the packages in the install white 2.0 Container Configuration policy list. Allow/Disallow secure keypad usage IT policy rule 2.0 Container Configuration policy Container Activation/Deactivation policy 2.0 Container Configuration policy Resetting container password 2.0 Enterprise Single-Sign-On Push data to SSO service 2.0 Enterprise Single-Sign-On Request setup SSO service 2.0 Enterprise Single-Sign-On Check if EnterpriseSSOPolicy service is ready 2.0 Enterprise Client Certificate Manage Client Certificates 2.1 Manager Enterprise Policy Group Certificate Enroll Certificate enrollment, renewal and deletion operations 2.1 Policy SEAMs Group with Manage different SEAMs protocols APIs like SCEP, CMC, CMP 2.1 Advanced Restriction Policy API whether CC mode supported or not 2.1 Container Configuration policy Reset container on reboot 2.1 Container Configuraton Management Policy Group Password pattern restriction 2.1 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 12

13 Container Configuraton Light Weight Container (LWC) configuration 2.1 Management Container Configuraton Policy Group Container Only Mode (COM) configuration 2.1 Management Certificate Policy Policy Group Group Allow/Block installation of self signed applications 2.2 Enterprise Billing Policy Group APN based Enterprise split billing 2.2 Container Management Policy Remove Configuration Type 2.2 Group Container Management Policy Create Container(Creation Param) 2.2 Group Container Configuration policy Reset container password 2.2 group. Container Configuration Policy Manage Hibernation Timeout 2.2 Group Container Configuration Policy Manage Wi-Fi network SSID 2.2 Group Container Configuration Policy Enable external sdcard. 2.2 Group Container Configuration Policy Manage External Storage White and Black List 2.2 Group Container Configuration Policy Manage Remote Control 2.2 Group Configuration Type MultiFactor Authentication 2.2 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 13

14 4 New features and enhancements This chapter details the new 2.5 features and enhancements in the following sections: New feature descriptions New feature enhancement descriptions Policies New 2.5 feature descriptions The following table details the new features for 2.5: Feature Container Launch Layout Container USB access Description You can now set the container layout that users see when accessing a container: folder (as used by the lightweight container) or classic (with separate launcher). Folder type is set by default. You can enable or disable USB access for apps inside the container. New 2.5 feature enhancement descriptions The following table details the feature enhancements for 2.5: Feature Description Audit log You can now specify the types of messages that get saved to the Audit Log to analyze device events and troubleshoot problems. You can select events based on their severity, success or fail status, module group (security, system, network, events, and application), and whether they originated from the kernel New 2.5 policies The following table lists the policies which have been developed in 2.5: Policy Group Policy Container Configuration Policy group Container Configuration: ConfigurationType.setContainerLayout() ConfigurationType.getContainerLayout() ConfigurationType.allowLayoutSwitching() ConfigurationType.isLayoutSwitchingAllowed() 2.5 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 14

15 Container Management Policy group Get policy instance: KnoxContainerManager.getFirewall() 2.5 AuditLog Policy Group Container Management: ContainerConfigurationPolicy.enableUsbAccess() ContainerConfigurationPolicy.isUsbAccessEnabled() AuditLog: AuditLog.setAuditLogRules() AuditLog.getAuditLogRules() 2.5 SEAMS Note: Changed multiuser scope for all APIs from Global to User Manage SEAMs: SEAMS.activateDomain() 2.5 The following table lists helper classes which have been developed in 2.5: Class AuditLogRulesInfo Configure AuditLog rules Comments 2.5 The following table includes the constants which have been developed in 2.5: Class Constant CONTAINER_LAYOUT_TYPE_FOLDER CONTAINER_LAYOUT_TYPE_CLASSIC 2.5 KnoxContainerManager KnoxVpnErrorValues AuditLog CONTAINER_CREATION_FAILED_SPECIFIC_ERROR_TYPE ERROR_CREATION_FAILED_INVALID_PARAM ERROR_CREATION_FAILED_SUB_USER ERROR_CREATION_FAILED_RESERVED_CONFIGURATION_TYPE_USED ERROR_CREATION_FAILED_INVALID_PARAM_LIST ERROR_CREATION_FAILED_INVALID CONFIGURATION_TYPE ERROR_CREATION_FAILED_EMERGENCY_MODE ERROR_CREATION_FAILED_INVALID_USER_INFO ERROR_CREATION_FAILED_TIMA_PWD_KEY ERROR_CREATION_FAILED_GENERATE_CMK ERROR_PROXY_FEATURE_NOT_SUPPORTED ERROR_STORING_PROXY_USERNAME ERROR_STORING_PROXY_PASSWORD AUDIT_LOG_SEVERITY_ALERT AUDIT_LOG_SEVERITY_CRITICAL Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 15

16 AUDIT_LOG_SEVERITY_ERROR AUDIT_LOG_SEVERITY_WARNING AUDIT_LOG_SEVERITY_NOTICE The following table includes the list of constansts have been deprecated since 2.5: Class Member CCMProfile Enum AccessControlMethod.PASSWORD 2.1 CCMProfile String accesscontrolpassword 2.1 Samsung Premium SDK Release Notes Copyright 2015 Samsung Electronics Co. Ltd. 16