Deploying, Securing, Customizing and Extending the IBM Connections Mobile App

Transcription

1 Deploying, Securing, Customizing and Extending the IBM Connections Mobile App Rusty Godwin Connections Mobile Development Jack O Donnell Connections Mobile Development

2 Please Note: IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here.

3 Agenda Connections Mobile Overview New in 2015 Deployment and Installation Customizing the App Securing the App

4 Connections Mobile Overview

5 IBM Connections Mobile One Application per Mobile OS Regardless of the server deployment & level... Greenhouse IBM SmartCloud Customer A 4.x Customer N 5.5.x

6 Supported Components Mobile apps iphone, ipad, ipod touch ios 8, 9 Android Android 4.0+ Server Mobile Application Management Mobile Security Management

7 Mobile Architecture Mobile App App Mgmt Security Mgmt User Interface Activities Device Features Content Provider Local DB Mobile Services App Mgmt Security Mgmt Web Pages Connections Services Activity Stream, Profiles, Files, Communities, etc.

8 Deployment Components Client Mobile OS specific app from the app stores Server Connections Mobile Service installed (enterprise app) Minimum Connections Mobile refresh (LO61851) EOS in 1H2016 Suggested minimum level is Connections CR1 Specific features may require more recent version of the server

9 New In 2015

10 New Function Released in 2015 Managing Work Assign a single To Do to multiple people in Activities Polls & Surveys Nested Folder support Application Management Enforce App level password Control which apps can import data Render customized app theme colors Support secure browsers for IBM MaaS360 and MobileIron IBM Verse Integration Send an directly from IBM Connections IBM Connections Editor Integration Create and edit documents

11 New Application IBM Connections Editor Editing Capability for IBM Connections Securely create and edit within Connections Files Supports Microsoft Office formats for spreadsheets, documents and presentations PDF viewer capability (Android)

12 New in IBM Connections 5.5 Nested Folder Support Create folders within another folder Move folders and files within folders Polls & Surveys Respond to surveys from you mobile device View survey results

13 Demo IBM Connections Editor

14 Deployment and Installation On-prem deployments

15 Deployment Configuration Connections Server w/ other Connections Apps (HTTP) Connections Server w/ Mobile HTTPS (HTTPS) (HTTP) VPN, IBM Mobile Connect, Reverse Proxy Connections Server w/ other Connections Apps Internet Domain (untrusted) DMZ Intranet Domain (trusted)

16 IBM Connections Server Deployment with Mobile Similar to most other Connections applications

17 DB Wizard

18 Connections Install LaunchPad

19 Deployed Components Enterprise applications Mobile ear Security Roles everyone* all users (mobile web login pages and /SecurityConfiguration) person all authenticated Mobile Administration ear Security Roles everyone all authenticated (device and user registry) administrator admin users (mobile admin console access) * Special consideration for /mobile/homepage/securityconfiguration

20 Deployed Components Database Schema Mobile mobile DataSource (jdbc/mobile) and associated mobilejaasauth Customization Mobile config files mobile-config.xml and mobile-config.xsd Deployed to LotusConnections-config Customization folder (../data/shared/customization)

21 Customizing the App

22 Application Customization Mobile App Management is a feature that has been made available since the 3.2 release of the Connections Mobile app and the CR2 of the Connections server. It allows the various Connections services to be customizable and adds support for extensibility, re-branding, custom login form among other things. For on-prem customers, the customizations/extensions are defined in a config file called mobile-config.xml Found under <cell-name>\lotusconnections-config Cloud customers can access the customization options from Connections Mobile App Management in the administration console

23 Application Management Topology Native Connections App /SecurityConfiguration -- Needs to be unsecured /Configuration /MobileConfiguration Cloud Admin Connections Mobile Service Connections AppServer mobile-config.xml

24 Service Customization Generally speaking for each service, if the service is enabled its features will be available to the client application. If the service is enabled, but displayinlauncher is false, the capabilities will be available to other services, but will not be available to navigate to from the home screen Common set of customization's supported for the all services. <Communities enabled="true" displayinlauncher="true"> <PublicCommunities>true</PublicCommunities> <AllowAddMembers>true</AllowAddMembers> </Communities> For Profiles, we have a policy to prevent photo upload <Profiles enabled="true" displayinlauncher="true"> <Upload>true</Upload> <AllowEditProfile>true</AllowEditProfile> </Profiles>

25 Service Customization For Files, configure access to files on the device <Files enabled="true" displayinlauncher="true > <PublicFiles>true</PublicFiles> <ShareWithPublic>true</ShareWithPublic> <AllowDownloads>true</AllowDownloads> <AllowUploads>true</AllowUploads> <AllowExport>true</AllowExport> <AllowExportToDeviceGallery>true</AllowExportToDeviceGallery> </Files> Set the default service that is started after login <DefaultApplication>Files</DefaultApplication>

26 Rebranding Support Rebranding support includes the ability to customize the app name and also provide service labels for the various Connections services. <Customizations enabled="true"> <CustomizationLocation>mobile</CustomizationLocation> Customized Theme Color Customized App Name <AppName>My Company</AppName> <AppColors> <ThemeColor>009933</ThemeColor> <ForegroundColor>FFFFCC</ForegroundColor> </AppColors> Customized Service Labels </Customizations>

27 Extensibility Support One or more custom services can be added Custom service definition includes the following: Service Icon's for different device types and densities Service Label Service URL Parameter substitution - %userid% The icons need to be designed in grey scale. Custom Services

28 Customization in the Cloud Cloud customers can access the customization options from Connections Mobile App Management in the administration console

29 Connections Mobile Custom URLs Connections mobile app can be started from a browser or another mobile app on the device Custom uri - ibmscp://com.ibm.connections/* Launch the app ibmscp://com.ibm.connections/launch Open a profile ibmscp://com.ibm.connections/profiles?<uid=> < => Open a community ibmscp://com.ibm.connections/communities?<uid=> Open a file ibmscp://com.ibm.connections/files?<uid=> Etc... Information on ibmscp options can be found in the Connections 5.5 Knowledge Center under Using links to start and configure the IBM Connections mobile app

30 Digest Links (a.k.a Redirect) digest received with links to connections apps includes additional link for mobile device access Connections references open in mobile app Configuration WAS mail session with JNDI name of mail/notification with mail server and protocol Enabled in notifications-config.xml <property name="includemobilelinksinnotifications">true</property> Enable channels for those events for which you want to broadcast <source defaultfollowfrequency="individual" enabled="true" frequencylocked="false" name="files"> <type name="mediashare" notificationtype="directed"> <channel enabled="true" name=" "> </channel> <property <property name="ftl">mediashared.ftl</property>

31 Sample Mobile Link

32 Push Notifications When enabled, mobile users will see notifications on the device for the following event: The user is invited to join a community The user is invited to join a person's network A task is assigned to the user A user A comment is added to content that the user owns The Push Notification mechanism is platform specific Android notifications are sent using Google Cloud Messaging (GCM) ios notifications are sent using Apple Push Notification Service (APNS) IBM issues yearly ifix to update APNS Certificates Requires specific ports to be opened 443 for GCM (Android) Ports 2195 and 2196 for APNS (ios)

33 Push Notification Proxy Support has been added for accessing GCM and APNS via proxy Support for HTTP based proxy servers (no SOCKS) Supports authenticated and non-authenticated access to the proxy server Available in Connections 5.0 CR and 5.5 ifix Updates to mobile-config.xml to use proxy Append the following to the <!-- START PUSH SECTION -> <ProxyHost>proxyserver</ProxyHost> <ProxyPort>proxyport</ProxyPort> Append the following to the <GCM> section <ConnectionRequestTimeout>300</ConnectionRequestTimeout> <ConnectTimeout>100</ConnectTimeout> <SocketTimeout>300</SocketTimeout> For authenticated proxy access Create J2C authentication alias named proxymobilepushnotificationjaasauth Ensure that the Prefix option is not enabled

34 Demo Mobile Customization in the Cloud

35 Securing the App

36 Security Features App Data Control Security Control for app data is provided through the following files service customizations : ShareWithPublic AllowDownloads AllowUploads AllowExport AllowImport/ImportWhitelist AllowExportToDeviceGallery Password Retention Policy can be defined for storing/ not storing password on device. Expose/Hide Address Allow/Prevent Geolocation information to be used Allow/Prevent copy and paste in the app Allow/Prevent app documents to be shared when you sync your device with itunes.

37 Security Features - Custom Login Form Custom Login Form can be defined by customers for various authentication mechanisms such as TAM, SiteMinder, SPNEGO and the login form details are defined in the SecuritySettings section. Connections App presents the same login interface irrespective of the login form defined by customer. <SecuritySettings enabled="false"> <AuthType></AuthType> --TAM,SiteMinder,SPNEGO,Form,Basic <LoginUrlContext></LoginUrlContext> <LoginErrorUrlContext></LoginErrorUrlContext> <LoginFormName></LoginFormName> <UseridFieldName></UseridFieldName> <PasswordFieldName></PasswordFieldName>... </SecuritySettings>

38 Security Features EULA/Information Page Connections App will allow EULA or information pages defined by customers to be presented to users before they are granted app access. <InfoPagePathPattern> </InfoPagePathPattern> <InfoPagePositivePathPattern> </InfoPagePositivePathPattern> <InfoPageNegativePathPattern> </InfoPageNegativePathPattern> <TermsOfUsageURL> </TermsOfUsageURL>

39 Security Two factor Client Certificate Authentication Allows requiring the mobile user to provide a certificate during login. For ios, due to sandboxing rules, apps can not access certificates in Settings The certificate used by the app must be installed in the app's keychain. Requires adding special ibmmbd extension to the certificate file so app can open it. End user access ibmmbd file via web site or and opens it in the Connections app to import it into the app keychain. Supported on Android 4.0+ using the unified keychain 4.1 is not supported due to Android defect Can install via a p12 file or an ibmmbd file See Configuring access with client certificates in the Connections documentation wiki for more info.

40 Sample Client Certificate Authentication Flow Native Connections App ) App attempts connection 2) App is challenged for client certificate 3) App sends certificate 4) Connection continues 5) App is challenged for Connections Server credentials 6) App sends Connections Server credentials Proxy Connections Mobile Service

41 Demo Two Factor Authentication

42 Mobile Application Management Mobile Device Management software, such as MaaS360, provides a way to manage the security requirements for devices and mobile application management (MAM). The IBM Connections Mobile App supports the following MDM providers: Fiberlink MaaS360 MobileIron Citrix

43 Mobile Application Management MaaS360 Support is built-in to the IBM Connections Mobile app on Google Play and the Apple App Store IBM Connections Mobile supports the following policies: Copy/Paste File Export and whitelist Print (Android only) Controlling access using MaaS360 IBM Connections Mobile does not support the MaaS360 Enterprise Gateway Function to control access based on MaaS360 managed policies is supported using IBM Mobile Connect (IMC)

44 Mobile Application Management MobileIron Separate app for Android Can be downloaded from the MobileIron app store Support on ios is built-in to the IBM Connections Mobile app on the Apple App Store IBM Connections requires MobileIron VSP 5.7 or higher be installed IBM Connections Mobile supports the following: AppConnect Container Policy AppConnect App Configuration

45 MobileIron Management Managing access to the Connections Server In order to allow access to the Connections Server thru the MobileIron server, you need to setup a policy to create an app tunnel. This policy will map the URL the user uses to configure the Connections server account in the app with the URL of the MobileIron server that will provide access to the Connections server. The user configures Connections server URL as: in the app and the app config will route any myserver.company.com request to the sentry host

46 MobileIron Setup Configuring your App policies MobileIron allows you to control the following features of a managed app: Printing Copy/Paste Open In

47 Mobile Application Management Citrix Separate IBM Connections Mobile apps containing Citrix support Download IBM Connections Android Citrix app from the Citrix IBM Connections ios Citrix app is available on the Apple App Store. Both apps can be distributed to users using the Citrix Worx Home app The MDX file use to distribute the ios app via Citrix Worx Home can be downloaded from the Citrix Ready Marketplace

48 Mobile Application Management App Configuration Configuration Settings can be passed to the app via MDM Provides the ability to preconfigure accounts Limited support for certain mobile configuration settings: AllowRemoveAccount ThemeColor/ForegroundColor InactivityTimeout RememberPassword Support for MaaS360 and MobileIron Secure Browser Allows launching external URLs in Connections content in the secure browser usesecurebrowser and securebrowserpattern

49 MaaS360 App Configuration com.ibm.mobile.connections.servername.1=myconnections com.ibm.mobile.connections.serverurl.1= com.ibm.mobile.connections.user.1=% % com.ibm.mobile.connections.servername.2=ibm SmartCloud com.ibm.mobile.connections.serverurl.2= com.ibm.mobile.connections.user.2=% % com.ibm.mobile.connections.allowremoveaccount=true com.ibm.mobile.connections.themecolor= com.ibm.mobile.connections.foregroundcolor=ffffff App Configuration settings are specified in a properties file that is uploaded to the MaaS360 portal Substitutions for userid and are supported by MaaS360

50 MobileIron App Configuration App Configuration settings are specified in a AppConnect App Configuration policy Substitutions for userid and password are supported by MobileIron

51 ios Managed App Configuration On ios, if you use a MDM provider that is not supported by the Connections app, you still may be able to push out app config settings The Connections 5.5 ios app supports the ios Managed App Configuration feature The MDM vendor must support ios Managed App Configuration and the device must be managed by the MDM Can be used with supported supported MDM vendors in conjunction with MDM app configuration settings Duplicate settings in the MDM app configuration overwrite the setting in the ios Managed app configuration

52 Demo Using Maas360 App Configuration

53 Notices and Disclaimers Copyright 2015 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS DOCUMENT IS DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL IBM BE LIABLE FOR ANY DAMAGE ARISING FROM THE USE OF THIS INFORMATION, INCLUDING BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFIT OR LOSS OF OPPORTUNITY. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law

54 Notices and Disclaimers cont. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. IBM, the IBM logo, ibm.com, Aspera, Bluemix, Blueworks Live, CICS, Clearcase, Cognos, DOORS, Emptoris, Enterprise Document Management System, FASP, FileNet, Global Business Services, Global Technology Services, IBM ExperienceOne, IBM SmartCloud, IBM Social Business, Information on Demand, ILOG, Maximo, MQIntegrator, MQSeries, Netcool, OMEGAMON, OpenPower, PureAnalytics, PureApplication, purecluster, PureCoverage, PureData, PureExperience, PureFlex, purequery, purescale, PureSystems, QRadar, Rational, Rhapsody, Smarter Commerce, SoDA, SPSS, Sterling Commerce, StoredIQ, Tealeaf, Tivoli, Trusteer, Unica, urban{code}, Watson, WebSphere, Worklight, X-Force and System z Z/OS, are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at:

55 Thank you