Samsung KNOX EMM Release Notes KNOX EMM 14.9

Transcription

1 Samsung KNOX EMM Release Notes KNOX EMM 14.9 November 2014

2 Copyright Notice Copyright 2014 Samsung Electronics Co. Ltd. All rights reserved. Samsung is a registered trademark of Samsung Electronics Co. Ltd. Specifications and designs are subject to change without notice. Non-metric weights and measurements are approximate. All data were deemed correct at time of creation. Samsung is not liable for errors or omissions. Android and Google Play are trademarks of Google Inc. ARM and TrustZone are registered trademarks of ARM Ltd. or its subsidiaries. All brand, product, service names and logos are trademarks and/or registered trademarks of their respective owners and are hereby recognized and acknowledged. Document History Date Changes July 2014 First version of document. September 2014 Updated for version October 2014 Updated for version November 2014 Updated for version Contact Information If you want to contact us about You have these options General KNOX questions KNOX Portal, for comprehensive information about KNOX How to get KNOX Try KNOX, to start a free trial, get pricing info, or buy KNOX Contact KNOX Sales, if you need help buying KNOX Technical questions KNOX Support, for self-help resources like videos, guides, and FAQs If you already have a KNOX portal account, log in to see all the resources available to you. If you do not have an account, you can register for one. Other support options Contact KNOX Support ii

3 Contents About this release... 3 New Features... 3 Installation... 6 Security... 6 Known issues... 6 User enrollment... 6 Profile installation fails after successful enrollment... 6 Proxy server and administration... 6 High memory and CPU usage by the proxy server... 6 Disabling a user does not remove profiles... 6 Only one Exchange profile is installed when two profiles were configured... 7 Ratings region can t be set to a region other than the US... 7 Profile can t disable Safari Force Fraud Warning and Block Pop-ups... 7 Allow use of Safari policy setting can t override Accept cookie in Safari setting... 7 Wi-Fi auto-connects when GP is set to not auto join... 7 Deleting the ManagedBy property prevents device from being managed... 7 Changing the APNS certificate causes previous devices to be unreachable... 7 Integrated Windows Authentication (IWA) doesn t work through web proxies... 7 Using IWA with a cloud proxy machine running a firewall... 7 Using IWA with multiple proxies attached to different domains... 7 Proxy server upgrade fails if ADUC is open... 8 Users moved to another Active Directory container/ou are unenrolled... 8 Admin and User Portals... 8 Downloading certificate fails on Windows Server... 8 Portal dialogs do not close on Firefox... 8 Can t save profile after uploading image in Account Customizations page... 8 Previews for.tiff and.dib image file logos not visible in the Admin Portal... 8 Bulk user import using CSV file with IE fails... 9 Can t map multiple addresses to the same user... 9 Multi-factor Authentication (MFA)... 9 Required data for each selected authentication factor isn t present as an MFA mechanism is subject to spam / junk filters... 9 SMS or phone authentication are only attempted once a password is validated... 9 Can't close authentication page on Firefox... 9 High auth "lock" icon displays incorrectly... 9 Android Devices Always vibrate on notification setting doesn t function on Samsung KNOX devices PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices Cisco AnyConnect VPN type not supported on Samsung KNOX devices Changes in account name in Admin Portal does not show on Android devices HTC One X passcode issues IMEI number is incorrectly displayed in KNOX EMM Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace devices Notify on receiving new mail setting doesn t function on KNOX devices Must remove existing KNOX container in order to re-enroll Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP Can t log in to bookmark app whose url is "ftp://***" on Android mobile device Admin Portal only prompts for numeric passwords when trying to lockout device Exchange app doesn t have a Load more details button Can t set passwords containing complex characters on HTC One X Camera app stops on LG Nexus 5 when a group policy is applied Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 1

4 Can t configure Exchange account on Samsung Galaxy S ios devices Can t unenroll ios device while it is receiving a group policy Can t establish VPN connection on ios device using 56-bit encryption Can t connect to VPN after turning RSA SecurID off App Capture Login form only displays after clicking button or link on website Apps Office 365 app ID issues Firefox compatibility with Infinite Apps Configuring Zoho for SP-initiated authentication No certificate found error when using SAML to configure SSO for Webex Problems launching Arrow Electronics Europe app Using the Aribaexchange app with Internet Explorer Using AIM with mobile devices Using Windows Azure app with mobile devices Using My Memova with Internet Explorer Asana app doesn t support Internet Explorer Gliffy app doesn t support mobile devices ClickTime app doesn t support the mobile Chrome browser Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service Only one Office 365 app can be installed at once SSO error with Android Dropbox app Repeat login failures with Box app Additional Information and Support Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 2

5 About this release Samsung KNOX EMM delivers Identity as a Service (IDaaS) for robust, Active Directory- and cloud-based single sign-on, access management, app management and mobile management across any cloud, mobile or on-premise app from a catalog of thousands of tested and pre-integrated apps. With Samsung KNOX EMM you can use Active Directory and Windows Group Policy to automate security policy enforcement, locate devices, wipe or lock devices as well as auto-issue or renew certificates for strong authentication to Wi-Fi and VPN networks for end-users' Samsung KNOX, Android, Apple ios, and other mobile devices. Mobile application management (MAM) provides a customizable mobile enterprise app store for pushing and maintaining rich mobile client apps. Samsung KNOX EMM SSO delivers federation, password management and single sign-on as a service. It has built-in multifactor authentication with Samsung Authenticator soft token, one time passcode (OTP) via text/ and interactive phone calls. Samsung also delivers scriptable per-app authentication policies to restrict access or require additional authentication. New Features New apps supporting user provisioning: ServiceNow ShareFile Improved cloud policy service Cleaner layout, search and policy summary. Improved usability for role membership change Available users are pre-populated for cloud deployments. Certificate-based , Wi-Fi and VPN policies. Additional support for Samsung KNOX features: Split (Enterprise) Billing Common Criteria Mode Ability to specify app installation location (on the device or in the container) Support for web apps that are launched within the KNOX EMM mobile app that have special layouts for mobile device browsers. IT admins can now prevent end users from unenrolling their devices or (on Samsung KNOX devices) removing the container. New KNOX EMM mobile apps (14.9) will be available on the Apple App Store and Google Play store. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 3

6 The following apps have been updated in this release and should be re-deployed to take advantage of the change: URL changes in template: Boxcar icentera Namecheap Sydney Morning Herald Yelp Business App name changes: Previous name HomeAway New name HomeAway Traveler Other template changes: Active Albertsons Backupify Bing Travel Bookworld CarePilot CloudForge Codeship Desk.com (on device) DIY DollarTree ETS GRE Expedia Travel Feedity Gale Ge.tt GIANT Food Stores Gigya Gizmodo GoodBudget Gumboot.co.nz Hipmunk Hyatt Hotels and Resort Igloo Juniper Networks Support Kabuto MARTIN'S Food Market MeetingBurner Memset Microsoft BizSpark Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 4

7 Microsoft TechNet Microsoft Volume Licensing Mozy My Adobe MYC4 myflare (on device) One Media Hub QualysGuard US Platform Recurly Romwe Scout.me Sephora ShopAtHome Shopify Partner Portal Simple Sales Tracking Skype SlideShare Smartsheet Socrative Staples Symantec PartnerNet Tractor Supply Co. Tripping Virgin America Whole Foods Market Windows Embedded Developer Center Xinhuanet Yahoo! Finance Yugma Zoho The following apps have been removed: Airhant Holidays Lockerz Magellan's Travel Supplies Pacejet ScaleXtreme Support has been added for 26 apps, including the following eight apps that use SAML to authenticate users: Blue Coat Web Security Service Harvard ManageMentor Hightail LogMeIn Rescue OfficeSpace Software OnlyOffice OnPointe Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 5

8 RunMyProcess To see the full list of supported apps, in the KNOX EMM Admin Portal, click Apps > Add App. Installation Please refer to the Samsung KNOX EMM MDM and Samsung KNOX EMM SSO Installation Guides for detailed installation steps. For Samsung KNOX EMM Admin Guides, How To information, and FAQs, go to Samsung KNOX Support. Security Two minor security issues were resolved in this release. Known issues The following sections describe common known issues or limitations associated with this release of Samsung KNOX EMM. User enrollment Profile installation fails after successful enrollment For AD users, if the default enrollment container is used on a new tenant, the proxy fails to grant permissions on the default enrollment container. Workarounds: Use another enrollment container instead of the default. This can be done during proxy installation or subsequently using the proxy configuration UI. Uninstall and then re-install the proxy using the same reservation code. Install multiple proxies. Proxy server and administration High memory and CPU usage by the proxy server A caching facility has been added to the Samsung KNOX Cloud Service and proxy server which can cause high CPU / RAM usage while the cache is building and may last several hours, depending on the number of Active Directory users and the number and type of Active Directory groups used. However, after the cache has built the CPU / memory usage should reduce significantly. Disabling a user does not remove profiles If users are disabled in Active Directory, their profiles are not removed from the device. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 6

9 Only one Exchange profile is installed when two profiles were configured If you create two Exchange profiles with different profile names but pointing to the same Exchange host, only one profile will be installed. Ratings region can t be set to a region other than the US The GP setting "Restrictions Settings" has the ability to set the region to locations other than the United States, but this setting never reflects on an ios device due to an Apple bug. This issue will be resolved once Apple provides a fix. Profile can t disable Safari Force Fraud Warning and Block Pop-ups This is a known Apple bug and will need to wait for Apple for bug resolution. Allow use of Safari policy setting can t override Accept cookie in Safari setting This is a known Apple bug and will need to wait for Apple for bug resolution. Wi-Fi auto-connects when GP is set to not auto join This is due to the different way Android and Apple devices behave with Wi-Fi settings. Deleting the ManagedBy property prevents device from being managed Samsung KNOX EMM uses the ManagedBy property in the device's property pages to provide a link to the user using the device. Therefore, if you delete the ManagedBy property value the device can no longer be managed. Changing the APNS certificate causes previous devices to be unreachable If you change the APNS certificate after enrolling some ios devices in KNOX EMM, those devices enrolled with the previous APNS certificate will be unreachable. If you have to change your APNS certificate, ensure all currently enrolled devices are unenrolled first. Integrated Windows Authentication (IWA) doesn t work through web proxies This is a limitation of the protocols used for IWA, so if you use a Web proxy to allow users to access the internet, you can t use IWA to provide silent login to the Admin or User Portal. Using IWA with a cloud proxy machine running a firewall To support IWA, you should check and ensure that http traffic is allowed to the ProxyHost executable for any/all networks on the cloud proxy server machine. Using IWA with multiple proxies attached to different domains IWA will not currently function correctly if there are multiple proxies connected to different domains, where the domains have no trust relationship between them. This will be fixed in a future release Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 7

10 Proxy server upgrade fails if ADUC is open If the Active Directory Users and Computers (ADUC) extension for Samsung KNOX EMM is installed, you should close ADUC before upgrading the Proxy Server or the upgrade will fail as ADUC will have the extension open, preventing the binaries from being updated. Users moved to another Active Directory container/ou are unenrolled Active Directory users that are moved from one container/ou to another may find that their devices are unenrolled. In a future release users will no longer be unenrolled in such a case, but for the time being users who find themselves unenrolled due to this should re-enroll their devices. Use of Active Directory administration tools If you wish to use the Active Directory administration tools such as the ADUC plug-in or the Group Policy extension on computers not running the Proxy, you should log in to those computers with a local system account rather than a service account. Admin and User Portals Downloading certificate fails on Windows Server Certificates are encrypted files and Windows Server defaults to disallowing Internet Explorer (IE) from downloading encrypted packages to disk. To download the certificate for a SAML Web application or the APNS certificate on Windows server go Internet Options in IE and uncheck: Advanced > Security > Do not save encrypted packages to disk. Portal dialogs do not close on Firefox Firefox browser security settings can prevent portal dialogs from closing when the close button is clicked. To allow dialogs to close: 1. Open Firefox and enter about:config in the address bar. 2. Search for close. 3. Change the dom.allow_scripts_to_close_windows setting to true. Can t save profile after uploading image in Account Customizations page The Save button is not enabled after loading a login or portal image in the Account Customization settings page in the Admin Portal unless another field on the page is also changed. If you wish to change only the image, modify a text field and then remove the modification and the button will be enabled. Previews for.tiff and.dib image file logos not visible in the Admin Portal Uploaded image files on the Account Customization page in the Admin Portal may not preview if they are.tiff or.dib format. This appears to be a limitation of the image file formats supported by each browser.jpeg,.png, and.gif files should preview on all supported browsers. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 8

11 Bulk user import using CSV file with IE fails Internet Explorer tries to open files in the browser if there is no program associated with a given file extension. To work around this, assign a default program, such as Excel or other csv editor, to the csv extension as follows: 1. Go to Control Panel > Default Programs > Associate a file type or protocol with a specific program. 2. Find the.csv extension and associate your preferred program with it. Can t map multiple addresses to the same user Although it is possible to create multiple user accounts that have the same address, logging in using that address is not supported as it is not possible to definitively map the address to a single user. Multi-factor Authentication (MFA) Required data for each selected authentication factor isn t present When selecting the use of a secondary factor (SMS, phone, ), ensure that the data is present in Active Directory for all users, otherwise, users with missing data may be locked out. You can specify a preferred factor and if not present an alternative factor will be used. For example, if a user has no phone number in Active Directory and SMS was the preferred factor, KNOX EMM will fall back to another selected factor (e.g. ). If there is no phone number or in Active Directory, the user would effectively be locked out. as an MFA mechanism is subject to spam / junk filters Be aware that using as an MFA mechanism may be affected by providers' spam or junk filters. SMS or phone authentication are only attempted once a password is validated This prevents spam and billing issues if an attacker attempts to brute force passwords to gain entry. Can't close authentication page on Firefox This is due to Firefox security setting not allowing scripts to close browser windows, a workaround is: 1. Open Firefox and in the address bar, enter about:config. 2. Search for close keyword. 3. Set the dom.allow_scripts_to_close_windows value to True. High auth "lock" icon displays incorrectly It is possible for the high auth "lock" icon to show for an app for which it shouldn t, and vice versa. The app should launch as expected, the issue is only with the display of the icon. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 9

12 Android Devices Always vibrate on notification setting doesn t function on Samsung KNOX devices The Samsung KNOX Device Exchange GP setting, Always vibrate on notification, doesn t work in this release of the Samsung mobile app, the notification setting remains at the user's current setting. PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices This is a device-specific issue for Galaxy SIII devices running Android 4.0.4, Galaxy Tab 2 devices running Android 4.03, and Galaxy Note II devices running Android Cisco AnyConnect VPN type not supported on Samsung KNOX devices In this release the Cisco AnyConnect VPN type is not supported on Samsung KNOX devices. Changes in account name in Admin Portal does not show on Android devices Any changes made to the account name in the Admin Portal are not reflected on enrolled Android devices. The account name is only set on enrollment. HTC One X passcode issues HTC One X can t accept passcodes with minimum number of complex characters restriction greater than zero. This appears to be a limitation of this device as other devices do not have the problem. IMEI number is incorrectly displayed in KNOX EMM The IMEI shown for a device may be missing the last digit with some Android devices. This is an issue with the Android version, the portal is correctly reporting the number it is given. Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace devices In this release, Samsung KNOX Device app management restrictions only apply to Samsung KNOX Workspace devices. In a future release this will be expanded to other KNOX devices. Notify on receiving new mail setting doesn t function on KNOX devices The Samsung KNOX Device Exchange GP setting "Notify on receiving new mail" doesn't work; the setting remains at the user's current setting. This appears to be an issue with KNOX devices. Must remove existing KNOX container in order to re-enroll In order to re-enroll a Samsung device with a KNOX container, wait for the container to be completely removed before trying to re-enroll. There can only be one KNOX container Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 10

13 managed by KNOX EMM on a device and the enrollment may fail if it tries to auto-create a container before the old container is completely removed. Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP Some versions of the Galaxy Note II firmware don't accept the WPA/WPA2 setting in the Wi-Fi group policy. Settings > Wi-Fi shows that the setting has been made but the device can't connect to the network. Can t log in to bookmark app whose url is "ftp://***" on Android mobile device The stock Android browser doesn't support ftp. Admin Portal only prompts for numeric passwords when trying to lockout device When trying to lockout a device, you are prompted to only provide numeric passwords. Exchange app doesn t have a Load more details button. Samsung Galaxy S4 devices running older versions of Android do not have the Load more details button. This is a known Samsung Galaxy S4 device issue and is fixed after build JDQ39.I9505ZHUDMI1. Can t set passwords containing complex characters on HTC One X If the minimum number of complex characters password policy is set, users can t change a password on the HTC One X. This appears to be an issue with the OS on the HTC One X and may be fixed by a later ROM upgrade. Camera app stops on LG Nexus 5 when a group policy is applied The camera app stops on the LG Nexus 5 when the Permit/prohibit camera use group policy is applied to it. This is a known issue with Android 4.4 but appears to be fixed in Android Can t configure Exchange account on Samsung Galaxy S4 ios devices If the UPN is the same as the username, you can t configure an Exchange account on Samsung Galaxy S4 devices running Android This issue has been fixed in later Android releases. Can t unenroll ios device while it is receiving a group policy Wait for an enrollment operation to complete, including receiving group policies, before unenrolling an ios device. Can t establish VPN connection on ios device using 56-bit encryption In this release, MPPE 56-bit encryption cannot be used for VPN connections. Use MPPE 40- or 128-bit encryption instead. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 11

14 Can t connect to VPN after turning RSA SecurID off App Capture If RSA SecurID is turned off on an ios device then VPN will not connect. This appears to be an issue with ios and has been reported to Apple. Login form only displays after clicking button or link on website Apps If the login form only shows after clicking a button or link on the website being captured, app capture will not correctly capture the app at this time. Office 365 app ID issues KNOX EMM must search for this app in lowercase letters in order to display the app. You can view or set the app ID by going to Application Settings > Additional Options > Application ID. Firefox compatibility with Infinite Apps You must upgrade your Firefox extension in order to use Infinite Apps. Configuring Zoho for SP-initiated authentication When copying the login URL from the Admin Portal and pasting into the Zoho Web site, add "amp;" after the ampersand (&) and sign in with the URL you are pasting. No certificate found error when using SAML to configure SSO for Webex When you import SAML metadata into Webex and replace an existing certificate, it is possible that the certificate may not actually be changed even though the Site Certificate Manager shows that it is. If you have previously uploaded a certificate you should first remove it using the Site Certificate Manager before importing the KNOX EMM SAML metadata. Problems launching Arrow Electronics Europe app The Arrow Electronics Europe app is using an incorrect certificate on their website at the moment, so all browsers will fail to load this app correctly. On IE 10, click Show all content and the app will open correctly. On some versions of Chrome you need to confirm that the script should be run, then wait 10 seconds for the app to run. Firefox will abort the connection so you should use a different browser to run this app. Using the Aribaexchange app with Internet Explorer 10 Aribaexchange currently does not support IE10. The site works with earlier IE versions as well as Firefox and Chrome. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 12

15 Using AIM with mobile devices The AIM app is designed to work in the browser version of the User Portal. To use AIM on a mobile device, use the AIM app available in your mobile device's app store. Using Windows Azure app with mobile devices The Windows Azure app requires Silverlight to launch but this is not currently supported by ios or Android, so this app should not be used on mobile devices. Using My Memova with Internet Explorer 10 With default settings, opening My Memova launches a blank page on IE10. Change the document mode setting to IE7 will allow the app to launch correctly. Asana app doesn t support Internet Explorer The Asana app does not support Internet Explorer. Use another browser to open the Asana app. Gliffy app doesn t support mobile devices The Gliffy app does not appear to support mobile devices at this time. Open the Gliffy app on your Windows computer. ClickTime app doesn t support the mobile Chrome browser The ClickTime app does not appear to support the mobile Chrome browser at this time. Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service If you have users created using Samsung KNOX EMM Cloud Directory Service, you have to map the app to your cloud users instead of to your Active Directory users. 1. In the WebEx app, go to the Application Settings page. 2. Under Map to User Accounts, deselect Use the following Active Directory field to supply the username. 3. Select Use this script and enter the following script: var username = LoginUser.Get('userprincipalname'); var shortname = username.replace("@your-domain.com", ""); LoginUser.Username = shortname; Only one Office 365 app can be installed at once The ability to configure multiple Office 365 apps may be supported in a future release. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 13

16 SSO error with Android Dropbox app On the Samsung Galaxy S4 and Galaxy Note 3 running Android 4.3, an error occurs with the native Android Dropbox app when using single sign-on and the built-in Internet browser. This issue has been reported to Dropbox and may be resolved in a later update of the app. To work around this issue, install Chrome for Android in place of the built-in Internet browser. Repeat login failures with Box app Three consecutive login failures prompt the user to input CAPTCHA to access the account. After a successful login, this requirement is removed. Additional Information and Support Go to Samsung KNOX Support for Samsung KNOX EMM Admin Guides, How To information, and FAQs. You can also contact the Samsung KNOX Support team for assistance. Samsung KNOX EMM 14.9 Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 14