Samsung KNOX EMM Release Notes KNOX EMM 14.10

Transcription

1 Samsung KNOX EMM Release Notes KNOX EMM December 2014

2 Copyright Notice Copyright 2014 Samsung Electronics Co. Ltd. All rights reserved. Samsung is a registered trademark of Samsung Electronics Co. Ltd. Specifications and designs are subject to change without notice. Non-metric weights and measurements are approximate. All data were deemed correct at time of creation. Samsung is not liable for errors or omissions. Android and Google Play are trademarks of Google Inc. ARM and TrustZone are registered trademarks of ARM Ltd. or its subsidiaries. All brand, product, service names and logos are trademarks and/or registered trademarks of their respective owners and are hereby recognized and acknowledged. Document History Date Changes July 2014 First version of document. September 2014 Updated for version October 2014 Updated for version November 2014 Updated for version December 2014 Updated for version Contact Information If you want to contact us about You have these options General KNOX questions KNOX Portal, for comprehensive information about KNOX How to get KNOX Try KNOX, to start a free trial, get pricing info, or buy KNOX Contact KNOX Sales, if you need help buying KNOX Technical questions KNOX Support, for self-help resources like videos, guides, and FAQs If you already have a KNOX portal account, log in to see all the resources available to you. If you do not have an account, you can register for one. Other support options Contact KNOX Support ii

3 Contents About this release... 3 New Features... 3 Installation... 6 Security... 6 Notice of end of life support... 6 Known issues... 6 User enrollment... 6 Profile installation fails after successful enrollment... 6 Proxy server and administration... 7 High memory and CPU usage by the proxy server... 7 Disabling a user does not remove profiles... 7 Only one Exchange profile is installed when two profiles were configured... 7 Ratings region can t be set to a region other than the US... 7 Profile can t disable Safari Force Fraud Warning and Block Pop-ups... 7 Allow use of Safari policy setting can t override Accept cookie in Safari setting... 7 Wi-Fi auto-connects when GP is set to not auto join... 7 Deleting the ManagedBy property prevents device from being managed... 7 Changing the APNS certificate causes previous devices to be unreachable... 7 Integrated Windows Authentication (IWA) doesn t work through web proxies... 8 Using IWA with a cloud proxy machine running a firewall... 8 Using IWA with multiple proxies attached to different domains... 8 Proxy server upgrade fails if ADUC is open... 8 Users moved to another Active Directory container/ou are unenrolled... 8 Admin and User Portals... 8 Downloading certificate fails on Windows Server... 8 Portal dialogs do not close on Firefox... 8 Can t save profile after uploading image in Account Customizations page... 9 Previews for.tiff and.dib image file logos not visible in the Admin Portal... 9 Bulk user import using CSV file with IE fails... 9 Can t map multiple addresses to the same user... 9 Multi-factor Authentication (MFA)... 9 Required data for each selected authentication factor isn t present as an MFA mechanism is subject to spam / junk filters... 9 SMS or phone authentication are only attempted once a password is validated Can't close authentication page on Firefox High auth "lock" icon displays incorrectly Android Devices Always vibrate on notification setting doesn t function on Samsung KNOX devices PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices Cisco AnyConnect VPN type not supported on Samsung KNOX devices Changes in account name in Admin Portal does not show on Android devices HTC One X passcode issues IMEI number is incorrectly displayed in KNOX EMM Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace devices Notify on receiving new mail setting doesn t function on KNOX devices Must remove existing KNOX container in order to re-enroll Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP Can t log in to bookmark app whose url is "ftp://***" on Android mobile device Admin Portal only prompts for numeric passwords when trying to lockout device Exchange app doesn t have a Load more details button Can t set passwords containing complex characters on HTC One X Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 1

4 Camera app stops on LG Nexus 5 when a group policy is applied Can t configure Exchange account on Samsung Galaxy S ios devices Can t unenroll ios device while it is receiving a group policy Can t establish VPN connection on ios device using 56-bit encryption Can t connect to VPN after turning RSA SecurID off App Capture Login form only displays after clicking button or link on website Apps Office 365 app ID issues Configuring Zoho for SP-initiated authentication No certificate found error when using SAML to configure SSO for Webex Problems launching Arrow Electronics Europe app Using the Aribaexchange app with Internet Explorer Using AIM with mobile devices Using Windows Azure app with mobile devices Using My Memova with Internet Explorer Asana app doesn t support Internet Explorer Gliffy app doesn t support mobile devices ClickTime app doesn t support the mobile Chrome browser Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service Only one Office 365 app can be installed at once SSO error with Android Dropbox app Repeat login failures with Box app Additional Information and Support Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 2

5 About this release Samsung KNOX EMM delivers Identity as a Service (IDaaS) for robust, Active Directory- and cloud-based single sign-on, access management, app management and mobile management across any cloud, mobile or on-premise app from a catalog of thousands of tested and pre-integrated apps. With Samsung KNOX EMM you can use Active Directory and Windows Group Policy to automate security policy enforcement, locate devices, wipe or lock devices as well as auto-issue or renew certificates for strong authentication to Wi-Fi and VPN networks for end-users' Samsung KNOX, Android, Apple ios, and other mobile devices. Mobile application management (MAM) provides a customizable mobile enterprise app store for pushing and maintaining rich mobile client apps. Samsung KNOX EMM SSO delivers federation, password management and single sign-on as a service. It has built-in multifactor authentication with Samsung Authenticator soft token, one time passcode (OTP) via text/ and interactive phone calls. Samsung also delivers scriptable per-app authentication policies to restrict access or require additional authentication. New Features Support for Managed Service Providers (MSP) MSPs can have super-tenants, which are EMM accounts that can create and manage tenants for other enterprises. Contact Samsung KNOX Support ( to request access to this feature. Migration from old KNOX EMM accounts to KNOX Premium EMM customers who created their tenants prior to Sep 18, 2014 are now able to seamlessly migrate to the new KNOX Premium bundle by adding a KNOX Premium license key (trial or paid) to their tenants For more information, see Samsung KNOX Support. Support for Cisco AnyConnect VPN Cisco AnyConnect VPN is now supported on Samsung devices. Currently, only username and password-based authentication is supported. Delete a Cloud Proxy IT Admins can now delete a Cloud Proxy. Previously, retired Cloud Proxy records would continue to show in the list in the Admin Portal. User Portal access controls Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 3

6 It is now possible to specify under what circumstances users may log in to the User Portal and when they may launch apps. Custom templates IT admins can view and customize welcome s that are sent out to users. Invite users An Invite Users button is provided on the Users tab to allow IT admins to search for and invite users to KNOX EMM. The status of invitations is shown on the Users tab. A new Password never expires option has been added for EMM users. On-premise SharePoint Server app is now available in the app catalog. App catalog report is now available. Lock SIM with PIN Policy to lock a SIM to a particular device. Device enrollment restrictions Maximum number of devices a user can enroll Types of devices that can be enrolled Minimum supported OS for each device type KNOX EMM as the kiosk mode app. The KNOX EMM app can now be used as the kiosk mode (single app mode app) for Android and enrolled ios devices. Device logging improvements Policy to enable mobile client debug logging. Command to allow an IT admin to fetch a device log. New apps supporting user provisioning: Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 4

7 NetSuite Dropbox Egnyte New KNOX EMM mobile apps (14.10) will be available in the Apple App Store and Google Play store. The following apps have been updated in this release and should be re-deployed to take advantage of the change: URL changes in template: Balance Forecasting Buxfer Mikogo Vzaar Other template changes: TaskRabbit Support has been added for 19 apps, including the following ten apps that use SAML to authenticate users. CampusPress ChatOn Cloud Printing Kiteworks MangoApps Netskope OneDesk Phytel Atmosphere Simply Voting The Network Integrated GRC Suite To see the full list of supported apps, in the Admin Portal, click the Apps tab and then click Add App. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 5

8 Installation Please refer to the Samsung KNOX EMM MDM and Samsung KNOX EMM SSO Installation Guides for detailed installation steps. For Samsung KNOX EMM Admin Guides, How To information, and FAQs, go to Samsung KNOX Support. Security Detection of rooted Android devices and jail-broken ios devices has been enhanced. It's no longer possible to inject JavaScript into Wizards or login pages as part of a cross site scripting attack. Five minor security issues were resolved in this release. Notice of end of life support Links to download the 32-bit Cloud Proxy package will not be available in KNOX EMM 14.10; however, existing 32-bit proxies can be updated to (and later, 15.1) Cloud Proxies. With the 15.2 release, 32- bit proxies will no longer be updated or maintained. In addition, only server class 64-bit Windows operating systems will be supported as the host OS for Cloud Proxies as of KNOX EMM release bit Windows desktop operating systems, such as Windows 7 and Windows 8 will no longer be supported. Known issues The following sections describe common known issues or limitations associated with this release of Samsung KNOX EMM. User enrollment Profile installation fails after successful enrollment For AD users, if the default enrollment container is used on a new tenant, the proxy fails to grant permissions on the default enrollment container. Workarounds: Use another enrollment container instead of the default. This can be done during proxy installation or subsequently using the proxy configuration UI. Uninstall and then re-install the proxy using the same reservation code. Install multiple proxies. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 6

9 Proxy server and administration High memory and CPU usage by the proxy server A caching facility has been added to the Samsung KNOX Cloud Service and proxy server which can cause high CPU / RAM usage while the cache is building and may last several hours, depending on the number of Active Directory users and the number and type of Active Directory groups used. However, after the cache has built the CPU / memory usage should reduce significantly. Disabling a user does not remove profiles If users are disabled in Active Directory, their profiles are not removed from the device. Only one Exchange profile is installed when two profiles were configured If you create two Exchange profiles with different profile names but pointing to the same Exchange host, only one profile will be installed. Ratings region can t be set to a region other than the US The GP setting "Restrictions Settings" has the ability to set the region to locations other than the United States, but this setting never reflects on an ios device due to an Apple bug. This issue will be resolved once Apple provides a fix. Profile can t disable Safari Force Fraud Warning and Block Pop-ups This is a known Apple bug and will need to wait for Apple for bug resolution. Allow use of Safari policy setting can t override Accept cookie in Safari setting This is a known Apple bug and will need to wait for Apple for bug resolution. Wi-Fi auto-connects when GP is set to not auto join This is due to the different way Android and Apple devices behave with Wi-Fi settings. Deleting the ManagedBy property prevents device from being managed Samsung KNOX EMM uses the ManagedBy property in the device's property pages to provide a link to the user using the device. Therefore, if you delete the ManagedBy property value the device can no longer be managed. Changing the APNS certificate causes previous devices to be unreachable If you change the APNS certificate after enrolling some ios devices in KNOX EMM, those devices enrolled with the previous APNS certificate will be unreachable. If you have to change your APNS certificate, ensure all currently enrolled devices are unenrolled first. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 7

10 Integrated Windows Authentication (IWA) doesn t work through web proxies This is a limitation of the protocols used for IWA, so if you use a Web proxy to allow users to access the internet, you can t use IWA to provide silent login to the Admin or User Portal. Using IWA with a cloud proxy machine running a firewall To support IWA, you should check and ensure that http traffic is allowed to the ProxyHost executable for any/all networks on the cloud proxy server machine. Using IWA with multiple proxies attached to different domains IWA will not currently function correctly if there are multiple proxies connected to different domains, where the domains have no trust relationship between them. This will be fixed in a future release Proxy server upgrade fails if ADUC is open If the Active Directory Users and Computers (ADUC) extension for Samsung KNOX EMM is installed, you should close ADUC before upgrading the Proxy Server or the upgrade will fail as ADUC will have the extension open, preventing the binaries from being updated. Users moved to another Active Directory container/ou are unenrolled Active Directory users that are moved from one container/ou to another may find that their devices are unenrolled. In a future release users will no longer be unenrolled in such a case, but for the time being users who find themselves unenrolled due to this should re-enroll their devices. Use of Active Directory administration tools If you wish to use the Active Directory administration tools such as the ADUC plug-in or the Group Policy extension on computers not running the Proxy, you should log in to those computers with a local system account rather than a service account. Admin and User Portals Downloading certificate fails on Windows Server Certificates are encrypted files and Windows Server defaults to disallowing Internet Explorer (IE) from downloading encrypted packages to disk. To download the certificate for a SAML Web application or the APNS certificate on Windows server go Internet Options in IE and uncheck: Advanced > Security > Do not save encrypted packages to disk. Portal dialogs do not close on Firefox Firefox browser security settings can prevent portal dialogs from closing when the close button is clicked. To allow dialogs to close: 1. Open Firefox and enter about:config in the address bar. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 8

11 2. Search for close. 3. Change the dom.allow_scripts_to_close_windows setting to true. Can t save profile after uploading image in Account Customizations page The Save button is not enabled after loading a login or portal image in the Account Customization settings page in the Admin Portal unless another field on the page is also changed. If you wish to change only the image, modify a text field and then remove the modification and the button will be enabled. Previews for.tiff and.dib image file logos not visible in the Admin Portal Uploaded image files on the Account Customization page in the Admin Portal may not preview if they are.tiff or.dib format. This appears to be a limitation of the image file formats supported by each browser.jpeg,.png, and.gif files should preview on all supported browsers. Bulk user import using CSV file with IE fails Internet Explorer tries to open files in the browser if there is no program associated with a given file extension. To work around this, assign a default program, such as Excel or other csv editor, to the csv extension as follows: 1. Go to Control Panel > Default Programs > Associate a file type or protocol with a specific program. 2. Find the.csv extension and associate your preferred program with it. Can t map multiple addresses to the same user Although it is possible to create multiple user accounts that have the same address, logging in using that address is not supported as it is not possible to definitively map the address to a single user. Multi-factor Authentication (MFA) Required data for each selected authentication factor isn t present When selecting the use of a secondary factor (SMS, phone, ), ensure that the data is present in Active Directory for all users, otherwise, users with missing data may be locked out. You can specify a preferred factor and if not present an alternative factor will be used. For example, if a user has no phone number in Active Directory and SMS was the preferred factor, KNOX EMM will fall back to another selected factor (e.g. ). If there is no phone number or in Active Directory, the user would effectively be locked out. as an MFA mechanism is subject to spam / junk filters Be aware that using as an MFA mechanism may be affected by providers' spam or junk filters. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 9

12 SMS or phone authentication are only attempted once a password is validated This prevents spam and billing issues if an attacker attempts to brute force passwords to gain entry. Can't close authentication page on Firefox This is due to Firefox security setting not allowing scripts to close browser windows, a workaround is: 1. Open Firefox and in the address bar, enter about:config. 2. Search for close keyword. 3. Set the dom.allow_scripts_to_close_windows value to True. High auth "lock" icon displays incorrectly Android Devices It is possible for the high auth "lock" icon to show for an app for which it shouldn t, and vice versa. The app should launch as expected, the issue is only with the display of the icon. Always vibrate on notification setting doesn t function on Samsung KNOX devices The Samsung KNOX Device Exchange GP setting, Always vibrate on notification, doesn t work in this release of the Samsung mobile app, the notification setting remains at the user's current setting. PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices This is a device-specific issue for Galaxy SIII devices running Android 4.0.4, Galaxy Tab 2 devices running Android 4.03, and Galaxy Note II devices running Android Cisco AnyConnect VPN type not supported on Samsung KNOX devices In this release the Cisco AnyConnect VPN type is not supported on Samsung KNOX devices. Changes in account name in Admin Portal does not show on Android devices Any changes made to the account name in the Admin Portal are not reflected on enrolled Android devices. The account name is only set on enrollment. HTC One X passcode issues HTC One X can t accept passcodes with minimum number of complex characters restriction greater than zero. This appears to be a limitation of this device as other devices do not have the problem. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 10

13 IMEI number is incorrectly displayed in KNOX EMM The IMEI shown for a device may be missing the last digit with some Android devices. This is an issue with the Android version, the portal is correctly reporting the number it is given. Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace devices In this release, Samsung KNOX Device app management restrictions only apply to Samsung KNOX Workspace devices. In a future release this will be expanded to other KNOX devices. Notify on receiving new mail setting doesn t function on KNOX devices The Samsung KNOX Device Exchange GP setting "Notify on receiving new mail" doesn't work; the setting remains at the user's current setting. This appears to be an issue with KNOX devices. Must remove existing KNOX container in order to re-enroll In order to re-enroll a Samsung device with a KNOX container, wait for the container to be completely removed before trying to re-enroll. There can only be one KNOX container managed by KNOX EMM on a device and the enrollment may fail if it tries to auto-create a container before the old container is completely removed. Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP Some versions of the Galaxy Note II firmware don't accept the WPA/WPA2 setting in the Wi-Fi group policy. Settings > Wi-Fi shows that the setting has been made but the device can't connect to the network. Can t log in to bookmark app whose url is "ftp://***" on Android mobile device The stock Android browser doesn't support ftp. Admin Portal only prompts for numeric passwords when trying to lockout device When trying to lockout a device, you are prompted to only provide numeric passwords. Exchange app doesn t have a Load more details button. Samsung Galaxy S4 devices running older versions of Android do not have the Load more details button. This is a known Samsung Galaxy S4 device issue and is fixed after build JDQ39.I9505ZHUDMI1. Can t set passwords containing complex characters on HTC One X If the minimum number of complex characters password policy is set, users can t change a password on the HTC One X. This appears to be an issue with the OS on the HTC One X and may be fixed by a later ROM upgrade. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 11

14 Camera app stops on LG Nexus 5 when a group policy is applied The camera app stops on the LG Nexus 5 when the Permit/prohibit camera use group policy is applied to it. This is a known issue with Android 4.4 but appears to be fixed in Android Can t configure Exchange account on Samsung Galaxy S4 ios devices If the UPN is the same as the username, you can t configure an Exchange account on Samsung Galaxy S4 devices running Android This issue has been fixed in later Android releases. Can t unenroll ios device while it is receiving a group policy Wait for an enrollment operation to complete, including receiving group policies, before unenrolling an ios device. Can t establish VPN connection on ios device using 56-bit encryption In this release, MPPE 56-bit encryption cannot be used for VPN connections. Use MPPE 40- or 128-bit encryption instead. Can t connect to VPN after turning RSA SecurID off App Capture If RSA SecurID is turned off on an ios device then VPN will not connect. This appears to be an issue with ios and has been reported to Apple. Login form only displays after clicking button or link on website Apps If the login form only shows after clicking a button or link on the website being captured, app capture will not correctly capture the app at this time. Office 365 app ID issues KNOX EMM must search for this app in lowercase letters in order to display the app. You can view or set the app ID by going to Application Settings > Additional Options > Application ID. Configuring Zoho for SP-initiated authentication When copying the login URL from the Admin Portal and pasting into the Zoho Web site, add "amp;" after the ampersand (&) and sign in with the URL you are pasting. No certificate found error when using SAML to configure SSO for Webex When you import SAML metadata into Webex and replace an existing certificate, it is possible that the certificate may not actually be changed even though the Site Certificate Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 12

15 Manager shows that it is. If you have previously uploaded a certificate you should first remove it using the Site Certificate Manager before importing the KNOX EMM SAML metadata. Problems launching Arrow Electronics Europe app The Arrow Electronics Europe app is using an incorrect certificate on their website at the moment, so all browsers will fail to load this app correctly. On IE 10, click Show all content and the app will open correctly. On some versions of Chrome you need to confirm that the script should be run, then wait 10 seconds for the app to run. Firefox will abort the connection so you should use a different browser to run this app. Using the Aribaexchange app with Internet Explorer 10 Aribaexchange currently does not support IE10. The site works with earlier IE versions as well as Firefox and Chrome. Using AIM with mobile devices The AIM app is designed to work in the browser version of the User Portal. To use AIM on a mobile device, use the AIM app available in your mobile device's app store. Using Windows Azure app with mobile devices The Windows Azure app requires Silverlight to launch but this is not currently supported by ios or Android, so this app should not be used on mobile devices. Using My Memova with Internet Explorer 10 With default settings, opening My Memova launches a blank page on IE10. Change the document mode setting to IE7 will allow the app to launch correctly. Asana app doesn t support Internet Explorer The Asana app does not support Internet Explorer. Use another browser to open the Asana app. Gliffy app doesn t support mobile devices The Gliffy app does not appear to support mobile devices at this time. Open the Gliffy app on your Windows computer. ClickTime app doesn t support the mobile Chrome browser The ClickTime app does not appear to support the mobile Chrome browser at this time. Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service If you have users created using Samsung KNOX EMM Cloud Directory Service, you have to map the app to your cloud users instead of to your Active Directory users. 1. In the WebEx app, go to the Application Settings page. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 13

16 2. Under Map to User Accounts, deselect Use the following Active Directory field to supply the username. 3. Select Use this script and enter the following script: var username = LoginUser.Get('userprincipalname'); var shortname = username.replace("@your-domain.com", ""); LoginUser.Username = shortname; Only one Office 365 app can be installed at once The ability to configure multiple Office 365 apps may be supported in a future release. SSO error with Android Dropbox app On the Samsung Galaxy S4 and Galaxy Note 3 running Android 4.3, an error occurs with the native Android Dropbox app when using single sign-on and the built-in Internet browser. This issue has been reported to Dropbox and may be resolved in a later update of the app. To work around this issue, install Chrome for Android in place of the built-in Internet browser. Repeat login failures with Box app Three consecutive login failures prompt the user to input CAPTCHA to access the account. After a successful login, this requirement is removed. Additional Information and Support Go to Samsung KNOX Support for Samsung KNOX EMM Admin Guides, How To information, and FAQs. You can also contact the Samsung KNOX Support team for assistance. Samsung KNOX EMM Release Notes Copyright 2014 Samsung Electronics Co. Ltd. 14