Citrix Worx App SDK Overview

Citrix Worx App SDK Overview

Table of Contents Introduction... 3 About the App Catalog Deployment Model... 3 About the Citrix MDX Toolkit... 4 The Worx App SDK... 5 The Unmanaged and Managed Modes of Worx SDK Apps... 6 Unmanaged App Store Apps... 6 Managed Worx Premium Apps... 7 App Store App Update Behavior... 7 User Experience of Worx App... 7 User Starts with Worx Home... 8 User Starts with the Apple App Store... 8 Worx Home Is not Present on the Device or the App Is not Entitled... 8 Worx App SDK Limitations on ios... 8 Worx SDK App for Android... 9 Optional Worx App SDK APIs on ios... 10 Public APIs... 10

Introduction The Worx App SDK for Independent Software Vendors (ISVs) lets third- party ISVs enable their apps with MDX app container technology with minimal effort. For ios apps, ISVs can embed their app source with the Worx App SDK framework with one line of code to enable MDX app container technology in their apps. On Android platforms, ISVs do not need to make any code change. They can simply use their apk for app store as input and run the MDX Toolkit utility (pick the For ISV to upload app to app store option) to generate the.mdx and.apk packages for Worx enabled apps. For an overview of MDX, please refer to the follow online documentation: http://www.citrix.com/products/xenmobile/overview.html http://www.citrix.com/products/xenmobile/features/mdx.html http://www.citrix.com/content/dam/citrix/en_us/documents/products/coll- mdx- feature- brief.pdf The Worx App SDK offers the full range of capabilities based on MDX app container technologies. Enterprise user authentication through Citrix Worx Home. Application authorization through Worx Home(app enumeration, subscription, downloading, and installation) App policy enforcement, which includes policies on: o Data sharing among MDX apps o Data loss prevention from MDX apps o Network restrictions Selective app lock and wipe Micro VPN and associated policies (for example, app VPN and network tunneling) App containment and associated policies, such as: o o Managed Open In All other app containment features, such as secure cut and paste, location service, camera, SMS, and so on Data encryption and associated policies, such as: o SQL DB encryption o Transparent File encryption All these features are available within the app after you embed the Worx framework in the app. About the App Catalog Deployment Model Citrix evaluates third- party apps through the Citrix Ready program to ensure that the apps are

compatible with the XenMobile infrastructure before the app (the.mdx bundle) is made available in the Citrix Ready app catalog in the Worx App Gallery. The validation process largely involves XenMobile integration testing. As part of the Citrix Ready process, apps that are integrated with the Worx App SDK can be published in the Apple App Store. At the same time, the catalog for these enterprise- enabled apps can be published in the Worx App Gallery. The catalog includes the metadata derived from each app, as well as the latest third- party app metadata (.mdx files) after the apps pass the Citrix Ready certification Users from various organizations can log on to their enterprise app store to get list of available apps and acquire the app binaries from the Apple App Store during installation. Because MDX is built into these apps, enterprise administrators can manage the apps in XenMobile after they are installed on user devices. About the Citrix MDX Toolkit ISV developers can use the Citrix MDX Toolkit to update an app bundle, extract app metadata, and generate.mdx and.ipa files. They can use a wizard or a command- line version of the tool. Developers can also use the tool to update an app URL from Apple app store after Apple approves the app. The following figure illustrates the process for publishing ios apps to the Apple App Store and XenMobile.

The Worx App SDK The Worx App SDK (Worx.framework) is available for internal and external developers to integrate their apps with MDX app container technology. By adding a single line of code to the ISV app source code, i.e. import the WorxEnable.h header file in the app s precompiled header file, developers can enable the full range of MDX app container capabilities for that app. In addition, ISVs who want to define custom app behavior or more integration with the XenMobile infrastructure can take advantage of optional Worx SDK APIs written in Object- C. During app development, developers can use the MDX Toolkit to generate a package (such as an.ipa file) and the associated metadata file (such as the..mdx file). They can then use the generated.ipa and.mdx packages to test MDX app container functionalities that are integrated into the app. They need to validate that their apps can function using the same process as they did before integrating the app with the Worx framework. They can also test some of the MDX app container functionalities of the app (using the default MDX policy.xms file) without using a XenMobile setup. They can test the MDX app container features fully if they have XenMobile setup.

The original app IPA and IPA files that include the embedded Worx.framework are then sent to Citrix for Citrix Ready certification, for validation of MDX functionalities as an app published from the Xen Mobile infrastructure. After the files are certified, an ISV can upload the app to the Apple App store and send the URL to Citrix. The app is updated with the final app URL add added to the Citrix Ready app catalog hosted by Citrix. At that time, a XenMobile IT administrator can download, configure, and publish the Citrix Ready apps to their enterprise mobile users. The Unmanaged and Managed Modes of Worx SDK Apps The Worx App SDK offers dual- mode app behavior. Apps integrated with Worx App SDK should be able to run independently of Citrix Worx. This behavior is in contrast with the Worx apps deployed from XenMobile backend directly. Those apps always require the presence of Citrix Worx and proper authorization from Citrix XenMobile Enterprise Store to run. Apps that are not associated with a XenMobile enterprise store are considered to be running in unmanaged mode. The Worx App SDK for ISVs can run in unmanaged mode without the Worx or XenMobile infrastructure. Apps that are integrated with the Worx App SDK will run in this mode until certain conditions are met, as described in the following sections, in which case they transition to managed mode. When the apps are in the managed mode, the MDX policies set by administrator for the apps are enforced. Third- party developers can either develop two versions of app, one that is unmanaged and one that is managed, or they can develop a single app for both independent use and for inclusion in Worx. ISVs receive one Worx API that specifies the type of dual- mode app behavior they need when integrating with Worx for an app. The Worx framework ensures that the default behaviors associated with that type are enforced. The characteristics of the unmanaged and managed modes are as follows: Unmanaged App Store Apps Apps set to the unmanaged mode function just as generic app store apps if Citrix Worx is not installed on the device. Apps that run in unmanaged mode are, for example, consumer apps, such as GoToMeeting. These apps can silently transition to managed mode if the following conditions are met: Citrix Worx Home app is present on the device. A user has logged on to a XenMobile enterprise store at least one time and the app is entitled to the user. A user has subscribed to the app. If a user has not subscribed the app but the first two conditions in the preceding list are met, a message appears prompting the user to confirm the transition to managed mode. After user confirmation, the app will trigger logon to Worx if the user is not logged on and will subscribe

the app automatically after logon. Note that this will trigger a flip between the app and the Worx app. The app remains locked if an error occurs during logon or auto- subscription. The app will only be unlocked after the app is subscribed. If user chooses not to transition to managed mode, the message is dismissed and does not appear again until the app is closed and restarted. Note: An app cannot transition from managed mode back to unmanaged mode. Managed Worx Premium Apps Worx premium apps specifically target enterprise users and typically run in managed mode. Some examples are the Citrix Worx apps. Before these apps are associated with an enterprise account, the embedded Worx framework allows the apps to run in unmanaged mode, but with a default set of Worx policies set by ISVs through a template file. Therefore, ISVs can effectively control the app behavior and demonstrate Worx capabilities if they choose to without any enterprise account association. After users install Worx on a device, the user logs on to Worx and subscribes that particular app. The app automatically transitions to managed mode with all of the Worx capabilities enabled. The behavior is similar to what occurs with an unmanaged app store app if a user has not subscribed to the app. In this case, instead of prompting a user to opt in, the app starts the transition automatically. In particular, it triggers logon if necessary in Worx and subscribes the app automatically in order to transition to managed mode. The app is locked if an error occurs during the logon and auto- subscription process. As with the unmanaged app store app, an app cannot transition from managed mode back to unmanaged mode. App Store App Update Behavior The Worx App SDK for ISVs is flexible in order to allow ISVs to update their app in an Apple app store without updating the corresponding catalog data (.mdx) within XenMobile. As such, users can download a newer version of an app directly from the Apple store and the new app should run correctly even if it is associated with an enterprise account that has obsolete.mdx catalog data. User Experience of Worx App The way a user interacts with an app that is integrated with the Worx App SDK is as follows depending how user install and launch the app:

User Starts with Worx Home 1. The user opens Worx Home 2. The user logs on to Worx Store and then subscribes, downloads an app from the Apple store, and starts the app. 3. The app starts the handshake protocol with Worx to establish secure IPC. 4. The app starts the authentication handshake with Worx to establish secure IPC. 5. The app flips to Worx only when the user needs to enter credentials to log on to Worx. 6. The user has to log on to a personal itune account to download and intall the app from the Apple App Store. User Starts with the Apple App Store If Worx Home is present on device already, users have the following experience depending on if they are using a managed or unmanaged app. Worx premium app 1. The user starts the app. 2. The app detects an installation of Worx Home and that the app is entitled and then alerts the user about the transition to Worx Home (ios) if logon to Worx Home is required. 3. Works opens and the user logs on to the Worx Home. 4. The user is automatically subscribed to the app. 5. The app transitions to managed mode upon successful subscription. Otherwise, the app is locked pending the successful subscription. General App Store app The user starts the app. The app detects an installation of Worx Home and that the app is entitled. The app prompts the user to confirm the transition to managed mode. If the user confirms, Worx Home opens, and the user logs onto the Worx Home account. The app transitions to managed mode upon successful subscription. Otherwise, the app is locked pending successful subscription. Worx Home Is not Present on the Device or the App Is not Entitled In this case, the app will run in unmanaged mode, just like a regular App Store app. Worx App SDK Limitations on ios The Worx App SDK should be integrated with app source code. It cannot instrument third- party static binary libraries that are linked to the app.

In this current release, arm 7s architecture is not supported as a build target on ios. ISVs should use arm 7 as build target, which is fully compatible with arm 7s hardware. Worx SDK App for Android Integration of Android app with Worx is much simpler than ios. There is no need to change anything in the app from the ISV s perspective. The high level publishing flow is shown below. As indicated above, the same MDX Toolkit utility can be used to generate both ios and Android App store packages. ISV can generate Worx app packages based on their apk for app store.

Android Worx SDK apps have the similar behavior as ios counterpart, e.g. Dual- mode behavior and unmanaged to managed mode transitions. Optional Worx App SDK APIs on ios The following APIs are defined in WorxAPI.h from the Worx framework. Note that these APIs are optional for ISVs who would like to customize their app behavior, for example, with preconfigured app settings. There is no need to call any of these APIs if ISVs do not have special requirement for their app behaviors. Public APIs typedef enum { MDX_APPMODE_MDXSpecific, MDX_APPMODE_GeneralAppStore } MDX_APPMODE; //MDX Premium App Mode //General App Store App Mode @interface MDXSDK : NSObject ///// Set App Mode from one of the modes mentioned in the MDX_APPMODE enum +(BOOL) CTXMDX_SetAppMode:(MDX_APPMODE)appMode; ///// Get policies values set by admin (managed mode) or default policy template ///// (unmanaged mode). ISV can use this API to pre-configure application settings ///// +(NSString*) CTXMDX_GetValueOfPolicy:(NSString*)policyName DefaultValue:(NSString*)defaultValue; ////// Check if MDX-Manager(WorxHome) is installed +(BOOL) CTXMDX_IsMDXAccessManagerInstalled; @end