This guide provides information on...

Transcription

1 Distributing GO!Enterprise MDM for ios as an Enterprise App This guide provides information on Benefits of Distributing GO!Enterprise MDM for ios as an Enterprise App... Requirements for Distributing GO!Enterprise MDM for ios as an Enterprise App... Tips on Enrolling in the ios Developer Enterprise Program... Information for Organizations using an App Store version... Renewing the Enterprise App Certificate GO!Enterprise MDM Why Distribute GO!Enterprise MDM for ios as an Enterprise App? 1

2 Table of Contents Why Distribute GO!Enterprise MDM for ios as an Enterprise App? 3 Requirements 5 Enrolling in the ios Developer Enterprise Program 7 Preparing for your Enterprise App 8 Distributing your GO!Enterprise MDM Enterprise App 15 Renewing an Enterprise App Certificate 16 Appendix A: Upload SSL Certificate for Group Notifications 17 GO!Enterprise MDM Why Distribute GO!Enterprise MDM for ios as an Enterprise App? 2

3 Why Distribute GO!Enterprise MDM for ios as an Enterprise App? The GO!Enterprise MDM for ios device application is available in the Apple App Store. In accordance with Apple privacy regulations, however, App Store applications do not permit background processing to initiate a connection to a server for the purpose of tracking statistics. Thus, the GO!Enterprise MDM app obtained from the App Store requires ios users to initiate synchronization of user/device statistics and location data by opening the application at least once a day. Since Enterprise (proprietary, in-house) Applications do not fall under the same privacy regulations as App Store applications, you can opt to distribute the GO!Enterprise MDM for ios device app as an Enterprise App. Applications distributed in this manner can run on a device in the background without user interaction. Synchronization of user/device statistics and location data occurs automatically at a frequency determined by the device connection schedule. Distributing the application as an Enterprise App requires that your organization maintain an annual Apple ios Developer Enterprise Program (idep) membership. Globo Mobile Technologies will work with organizations who want to pursue this solution. Please contact Globo Mobile Technologies support team for more information at, technical@globoplc.com. Distribution Options You can host the GO!Enterprise MDM for ios Enterprise App at your own site or the app can be hosted at the Globo Data Center. Globo Mobile Technologies will issue your organization a URL from which users can obtain the application. Updates to an Enterprise App hosted at Globo Mobile Technologies follow the same update schedule as the standard application available on the Apple App Store. See Distributing Your Enterprise App. Tips for Using the Application Hosted in the App Store If you choose not to distribute the GO!Enterprise MDM for ios app as an Enterprise App, you should do the following to ensure the most effective use of the App Store application: Instruct users to initiate the synchronization of user/device statistics and location data by opening the GO!Enterprise MDM app daily and allowing it to complete a synchronization cycle. GO!Enterprise MDM Why Distribute GO!Enterprise MDM for ios as an Enterprise App? 3

4 If you use the Compliance Manager to restrict devices that do not make GO!Enterprise MDM connections or update location data, you may want to set the parameters for certain restrictions more liberally for the ios device platform. This will prevent ios users from being easily restricted due to infrequent GO!Enterprise MDM connections or location data updates. Configure the following Device Platform Restrictions for ios devices accordingly: o o o Restrict user GO!Enterprise MDM connections Restrict if location not updated Restrict if policy out of date GO!Enterprise MDM Why Distribute GO!Enterprise MDM for ios as an Enterprise App? 4

5 Requirements The following prerequisites must be in place before you can distribute the GO!Enterprise MDM for ios application as an Enterprise App: An account with the ios Developer Enterprise Program (idep) (Note: This is not the Apple Developer Program) Apply for an account at: See the section, Enrolling in the ios Developer Enterprise Program, in this document for additional information. GO!Enterprise MDM Server Base GO!Enterprise MDM for ios device application Organizations that distribute GO!Enterprise MDM for ios as an Enterprise application will need to obtain an Apple Push Notification service SSL Certificate in order to support the Group Notification feature. See Appendix A. For information on Group Notifications consult the guide, Managing Users & Resources. GO!Enterprise MDM Requirements 5

6 Preparing to distribute the GO!Enterprise MDM for ios device application as an Enterprise App If you have decided to distribute the GO!Enterprise MDM for ios application as an Enterprise App, determine whether you will host the Enterprise App in your own environment or have the app hosted at the Globo Data Center. Then follow this process: 1. Enroll and maintain an annual membership in the Apple ios Developer Enterprise Program (idep). Customer enrollment process for idep can take up to eight weeks Contact Globo Mobile Technologies Technical Support at to request an Enterprise App build of the GO!Enterprise MDM for ios application. 3. Globo Mobile Technologies will send you a Certificate Signing Request (CSR) for the application and the sub-contractor agreement authorizing Globo Mobile Technologies to build your GO!Enterprise MDM Enterprise App. You can expect this within one business day after you make your request. 4. Using the CSR, go to the Apple developer portal and create a Production Certificate, an App ID, and an In House Distribution Provisioning Profile for the GO!Enterprise MDM for ios device application Send your signed sub-contractor agreement, the Production Certificate, and the Provisioning Profile, to Globo Mobile Technologies. 6. Globo Mobile Technologies will build the app and deliver it to your host site or host it at the Globo Data Center. The new Enterprise App should be available within one business day after Globo Mobile Technologies receives your certificate, profile, and signed agreement. Updates to your GO!Enterprise MDM for ios Enterprise App If you choose to have your GO!Enterprise MDM Enterprise App hosted at the Globo Data Center, updates to the application software will follow the same update schedule as the standard application available on the Apple App Store. Organization administrators will receive notification and descriptions of software updates well in advance. When you host your own Enterprise App, it is your responsibility to make the updated version available to users. GO!Enterprise MDM Requirements 6

7 Enrolling in the ios Developer Enterprise Program Distributing the GO!Enterprise MDM for ios device application as an Enterprise App requires that you enroll in the ios Developer Enterprise Program. The application process involves creating an Enterprise Developer account and paying the enrollment fee. Apple s verification process can take up to eight weeks, so it is advisable to begin the enrollment process as soon as possible. Apple requires the following: You must have a DUNS number (Data Universal Numbering System from Dun & Bradstreet). You will be required to provide your DUNS number during the enrollment process. If you do not have one, you can obtain one at: You must have authority to bind your company to the legal agreements. You will need to provide the legal contact who can verify that you have the authority to bind your company to the ios Developer Program Enterprise License Agreement. Each organization must have its own ios Developer Enterprise Program membership. Apply for the Apple Enterprise Developer account at: The Apple Developer site steps you through enrolling and creating the account. The steps include: Enter Account Info - Create an Apple ID, enter personal profile information and answer survey questions. Apple sends a verification . Verify by signing in with your Apple ID. Enter company information, including legal entity name and DUNS number. Review and Submit Company Verification Agree to License Purchase Program Activate Program GO!Enterprise MDM Enrolling in the ios Developer Enterprise Program 7

8 Preparing for your Enterprise App After you have obtained an ios Developer Enterprise Program membership, there are several steps to complete before you can distribute GO!Enterprise MDM for ios as an Enterprise App. Determine whether you want to have the App hosted at the Globo Data Center or host it yourself. Globo Mobile Technologies will send you a Certificate Signing Request (CSR) for a Production Certificate. (Since Globo Mobile Technologies will build and be considered the sub-contractor for the app, the CSR must be issued from Globo Mobile Technologies.) Sign your sub-contractor agreement with Globo Mobile Technologies authorizing Globo to build your GO!Enterprise MDM Enterprise App. Through the ios Development Center, use the CSR to create a Production Certificate and unique App ID, and an In House Distribution Provisioning Profile. Send them to Globo Mobile Technologies along with your signed subcontractor agreement. Globo Mobile Technologies will use the certificate and profile to build the Enterprise App. 1. When you receive the Certificate Signing Request (CSR) from Globo Mobile Technologies, browse to 2. Login to the ios Development Center using your Apple ID and password. 3. Enter the Certificates, Identifiers, & Profiles page. GO!Enterprise MDM Preparing for your Enterprise App 8

9 Create the Production Certificate and APP Identifier 4. Choose Certificates, then click the + icon in the top right corner of the page to create the production certificate. 5. Under the Production section, mark the radio button next to App Store and Ad Hoc and click Continue. 6. On the Add ios Certificate page, select Choose File and locate the CSR file provided by Globo Mobile Technologies. Click Generate. GO!Enterprise MDM Preparing for your Enterprise App 9

10 7. Download and save the Production Certificate. You will send it and the Distribution Provisioning Profile, which you will create next, to Globo Mobile Technologies Technical Support, along with your signed sub-contractor agreement. 8. Once the certificate is created, select App IDs from the Identifiers section of the left panel and click the + icon in the top right corner of the page to create the App ID. 9. On the Register ios App ID page, enter an App ID Description for the GO!Enterprise MDM app. This can be any text you want to use to describe the App ID. GO!Enterprise MDM Preparing for your Enterprise App 10

11 10. Again, on the Register ios App ID page, select an Apple ID Prefix. The default value can be used. 11. Under App ID Suffix, mark the radio button for Explicit App ID and enter a Bundle ID for the App ID. This is a unique ID to identify the app, commonly in the form of com.yourcompanyname.appname. 12. You will see the App ID you just created appear in the ios App IDs page. GO!Enterprise MDM Preparing for your Enterprise App 11

12 Create an In House Distribution Provisioning Profile 13. Once the app identifier is created, select All from the Provisioning Profiles section of the left panel and click the + icon in the top right corner of the page to create a profile. 14. Set Distribution to In House and click Continue. GO!Enterprise MDM Preparing for your Enterprise App 12

13 15. Select the App ID from the dropdown. 16. Select the production certificate created earlier and click Continue. GO!Enterprise MDM Preparing for your Enterprise App 13

14 17. Give the profile a name by which you can identify it. Click Generate. 18. You will see the newly created Provisioning Profile. Download and save the Provisioning Profile. Send it and the Production Certificate to Globo Mobile Technologies Technical Support, along with your signed sub-contractor agreement. GO!Enterprise MDM Preparing for your Enterprise App 14

15 Distributing your GO!Enterprise MDM Enterprise App GO!Enterprise MDM for ios Enterprise App Hosted at the Globo Data Center If your GO!Enterprise MDM for ios app will be hosted at the Globo Data Center, Globo Mobile Technologies will use the certificate and profile you send to build the app and will then issue your organization a URL from which users can obtain the application. Updates to a GO!Enterprise MDM Enterprise App hosted at the Globo Data Center, follow the same update schedule as the standard application available on the Apple App Store. Organization administrators will receive notification and descriptions of software updates well in advance. GO!Enterprise MDM for ios Enterprise App Hosted at Your Site If you are hosting your GO!Enterprise MDM Enterprise App at your own site, you may want to do one of the following: If your company has developed other Enterprise Apps, you may want to distribute the GO!Enterprise MDM Enterprise App in the manner that you distribute the other apps. Place the app on a secure Web site.. URLs pointing to Enterprise Apps, including manifest files, must be https. Add the app to the /Sync directory on the server where the GO!Enterprise MDM Web/HTTP component is housed. The app build comes to you in two files, an.ipa file and a.plist file. The.ipa file is the app and needs to be hosted on your server. The.plist is a text file that contains information that an ios device will need to install the app. The.plist can be located, but is not required to be, in the same place as the.ipa file. Edit the.plist file so the URL value is the address where you host the.ipa file. Create a simple Web page that contains a link to the.plist. Users will use this Web page to download the app. The link to the.plist must be in a format that contains the following specific details, so that devices recognize it as a means to install the app. Where you see SERVER_ADDRESS_FOR_PLIST, insert the address of the server where your.plist file is located: <html><body> <a href="itms-services://?action=downloadmanifest&url= Install GO!EnterpriseMDM</a> </body></html> You can make updated versions of the app available to users in the same way. GO!Enterprise MDM Distributing your GO!Enterprise MDM Enterprise App 15

16 Renewing an Enterprise App Certificate IDEP Membership Renewal Organizations distributing GO!Enterprise MDM for ios as an Enterprise App are required to maintain an annual membership in the Apple ios Developer Enterprise Program (idep). Enterprise App Certificate and Profile Renewal In addition, the Enterprise App provisioning profile must be renewed annually and the production certificate must be renewed every three years. Organizations should keep track of the certificate s expiration date, because there is no automatic renewal notification as the date approaches. An expired provisioning profile will prevent your organization from receiving updates to the GO!Enterprise MDM App. An expired certificate will disable all apps in use. 1. Before your production certificate or provisioning profile expires, log in to the Apple ios Dev Center and select Certificates, Identifiers & Profiles from the right panel. Follow the same procedure used to initially create your production certificate and provisioning profile. Annually you will generate a new provisioning profile. See Create an In House Distribution Provisioning Profile Every three years you will generate a new production certificate in addition to the provisioning profile. See Create the Production Certificate and APP Identifier 2. Download the renewed production certificate and/or provisioning profile and send them to Globo Mobile Technologies. GO!Enterprise MDM Renewing an Enterprise App Certificate 16

17 Appendix A: Upload SSL Certificate for Group Notifications Apple Push Notification service SSL Certificate When is an APNs SSL Certificate required? Organizations that distribute GO!Enterprise MDM for ios as an Enterprise application will need to obtain an Apple Push Notification service SSL Certificate in order to support the Group Notification feature. The certificate establishes a trusted provider identity for the GO!Enterprise MDM server and is presented when the GO!MDM server makes a connection to the Apple push notification servers. The Production SSL Certificate must be obtained from Apple and renewed annually. Once the certificate has been obtained it must be uploaded to the GO!MDM server. It will replace the certificate for the App Store version of GO!Enterprise MDM for ios that is hard-coded in the GO!MDM server. Globo Mobile Technologies Technical Support team will provide a tool that enables you to upload your certificate and replace the hardcoded certificate. Obtain the Production SSL Certificate from Apple 1. Obtain a Certificate Signing Request (CSR) from the Globo Mobile Technologies Technical Support team. After completing the CSR, the APN cert needs to be exported. This will give you a.p12 file which has the private key. You will be asked to create a password. Record the password, as you will need it when you upload the.p12 file to the GO!MDM server. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 17

18 2. Log in to the Apple developer portal at: and go to the Certificates, Identifiers and Profiles section. 3. Select App IDs under the Identifiers section. 4. Select the App ID for GO!Enterprise MDM and click edit. 5. Enable Push Notifications. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 18

19 6. Once push notifications are enabled, click the Create Certificate button under Production SSL Certificate. 7. You will then be prompted for a Certificate Signing Request (CSR). Use the new CSR provided by Globo Mobile Technologies Technical Support team. 8. Select Done when you see that the cert has been created and is displayed in the Certificates list. 9. Examining the App ID again shows that push notifications are enabled and that the newly created cert has been applied. 10. Click the Download button, then save the.cert file so that it can be installed on the GO!Enterprise MDM server. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 19

20 Install the tool that allows you to upload your certificate A push notification certificate for the App Store version of GO!Enterprise MDM for ios is hard-coded in the GO!MDM server. Those with an Enterprise app must replace this certificate by uploading the SSL certificate they obtain from Apple. This is done by installing a.php file on the GO!MDM server. The file provides a tool that allows you to upload your SSL certificate. For security reasons, you must remove this file after you have finished uploading the certificate. 1. Obtain the apnscert.php file from Globo Mobile Technologies Technical Support team. 2. Add the.php file to the GO!Enterprise MDM directory. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 20

21 3. You will also need to know the OrganizationSAKey to upload the certificate. From the Microsoft SQL Server Management Studio, run the following query to obtain the key: SELECT OrganizationSAKey, DisplayName FROM Organizations The OrganizationSAKey will display in the bottom pane. Note the key, as it will be used during the certificate upload. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 21

22 Upload the SSL certificate to the GO!Enterprise MDM server Now upload the SSL certificate you obtained from Apple. 1. From a browser, enter this address to upload the certificate: 2. Enter your OrganizationSAKey. 3. Browse to the location where you stored the certificate file. Select it and click Open. 4. Enter the Certificate Password that you used when exporting the certificate file. 5. Click Submit. The uploaded certificate replaces the certificate that is hard-coded for App Store apps GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 22

23 Remove the.php file 1. You will see a confirmation that the APNs Certificate has uploaded successfully. 2. For security reasons, you must remove the apnscert.php file from the GO!Enterprise MDM directory after you have finished uploading the certificate. Locate it, then right click on it and select Delete. GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 23