Matrix42 Mobile. Technical Documentation. Matrix42 Mobile v September Copyright 2015 VMware, Inc. All rights reserved

Transcription

1 Matrix42 Mobile Technical Documentation Copyright 2015 VMware, Inc. All rights reserved

2 Instructions for App Vendors: Please fill in the appropriate field for each section. If you do not have capabilities for a specific section, you do not need to fill it out.we have broken up app management capabilities in the following ways: Deployment (all apps supported), Configuration, Tunneling (all apps supported), SSO, Access Control, and Security Policies. Fields that are already populated and not highlighted are native operating system and/or EMM capabilities. You can leave these as is. Once completed, include this in your submission to the AppConfig.org website. After being filled out by your organization and submitted, the AppConfig team will remove the instruction section, validate formatting, convert to PDF and make this doc available on the appconfig.org website. Introduction The following document describes the technical capabilities and deployment the native mobile Matrix42 Mobile app to devices based on the best practices documented by the AppConfig Community. Reference EMM vendor specific setup documentation available on the AppConfig Community site for details on how to configure each of these capabilities with the EMM vendor of your choice. App Deployment EMM solutions have the capability to deploy native public app stores applications to devices. Operating systems such as ios, Android, and Windows provide EMM vendors native built-in APIs as part of the MDM Mobile Device Management protocols documented by the operating systems to make this possible. Using this capability, the Matrix42 Mobile public app store can be installed automatically or via a self-service catalog with EMM platforms participating in AppConfig Community. EMM vendors participating in AppConfig Community have the capability to deploy these types of apps as well. Page 1

3 App Configuration For some customers, the first time use of the Matrix42 Mobile application requires the manual configuration of all its settings. EMM vendors participating in AppConfig Community have the ability to auto-configure these settings. The end user no longer has to input these values themselves, the EMM service can configure the following : Configuration Key Description Value Type ios Support UDID Identify the device UDID Device UDID string Yes EpicUrl TintColor External DNS name of a Silverback Server RGB code colors in decimal format separated by comma string Yes Android for Work Support 40,133,60 string Yes Yes LogoURL Logo Download URL string Yes Yes Username Service Store Username PeterPerfect string Yes Yes Password Password for demo puposes UseForDemos string Yes Yes Domain AD domain for SVS Domain.com string Yes Yes Server Name of SVS server host.domain.com string Yes Yes port Custom HTTPS port 443 string Yes Yes passcode SecurityPattern TouchID Set the numerb of digits in the app passcode. If you don t want a pin leave this empty Pattern, If you don t want a pattern leave this empty Ebales the user to authorize via TouchID integer Yes Yes TRUE boolean Yes TRUE boolean Yes EnablePrivacy Screenshot control TRUE boolean Yes LocalNotification Local Notification Settings dict dictionary Yes StartTabURL initial page m42mobile://news string Yes DisableUseAccounts DisableDocumentSource Removes the Add Account function TRUE boolean Yes Removes the Add Datasource function TRUE boolean Yes Logging Enable Logging TRUE boolean Yes Page 2

4 Matrix42 Mobile for App Configuration The Matrix42 Mobile App for ios and Android can be pre-configured by using Managed App Configurations on devices with ios 7 and higher or Android For Work compatible. The configuration is based on XML and can be set in App Portal when editing the M42Mobile application. You can pre-config Service Store, Mobile Content Management, Branding options or security policies. You can place the XML keys + value in any order. All KEY values can be generally be used optional but exceptions are mentioned in below sections. EMM Management This configuration points the M42Mobile App to a pre-defined EMM server. By doing this, the M42Mobile App can retrieve various policies and configurations: Content Management repositories like File Shares, CloudStorage,... Policies configured in Silberback Admin not deploy by ios App XML config feature We recommend to always define the following settings when managing the M42Mobile with an EMM service: Key 'UDID' This information is passed to the EMM Server to identify the device <key>udid</key> <string>{deviceudid}</string> Key 'EpicURL' This is the external DNS name of a Silverback Server <key>epicurl</key> <string> Page 3

5 Customer Branding You can change color of certain fields and texts where by default the Matrix42 orange color is used. This is also called the 'tint color'. Additionally you can exchange the Matrix42 logo with a customer logo. Key 'TintColor' Use the RGB code colors in decimal format separated by comma <key>tintcolor</key> <string>40,133,60</string> Key 'LogoURL' Refer to a URL that is accessible for M42Mobile App. The logo will be download during M42Mobile Setup process <key>logourl</key> <string> Page 4

6 Workspace Management (Service Store) Account Key 'Username' Configure the SVS username. You can use EMM lookup value to pre-populate. <key>username</key> <string>{username}</string> Key 'Password' You should use this field only for demo purposes. <key>password</key> <string>usefordemos</string> Key 'Domain' This is the LDAP / Active Directory domain the SVS user belongs to. <key>domain</key> <string>corpdomain</string> Key 'Server' The external DNS name of the SVS server. <key>server</key> <string>external_dns.svs_servername.com</string> Key 'Port' The TCP Port used for HTTP(S) communication used to connect to the SVS server. <key>port</key> <string>443</string> Page 5

7 Mobile Content Management (MCM) It is not required to pre-configure Content Locations like a File Share, Google Drive or SharePoint by using this ios App XML Config feature. The EMM Admin can easily configure the Content Locations in the Tag / Content area. This approach additionally has the benefit that the EMM administrator can granularly assign the Content Locations on a per Tag basis compared to the ios App XML Config feature. App Settings, Actions & Restrictions Starting with version of M42Mobile for ios it's possible to configure every setting within the EMM Server. This configuration is processed as policy enforce from the central server. After applying a settings via EMM the end user can't change this setting anymore in the application. The following settings are supported: Passcode Passcode settings are configured in the passcode dictionary <key>passcode</key> <dict>** Add settings as described bellow here **</dict> Enable: Enforces the user to authorize via passcode when opening the application <key>enable</key> Passcode Length: Defines the complexity level of the required passcode. Currently the values 4 or 6 are supported <key>length</key> <integer>4</integer> TouchID: Enforces the user to authorize via TouchID instead of a traditional passcode <key>touchid</key> Page 6

8 This following full example enforces the user to authorize via TouchID or when this is not available on the hardware with a complex 6 digit long passcode: <key>passcode</key> <dict> <key>enabled</key> <key>length</key> <integer>6</integer> <key>touchid</key> </dict> Privacy Enabling the privacy setting ensures that all sensitive information will be blurred when switching out the app or when switching between the applications in the ios task bar. In combination with the Passcode settings it prevents not permitted users from getting sensitive data via screenshots: <key>enableprivacy</key> Local Notifications Local Notifications can be used to define the timeframe end users should be notified regarding pending tasks in the M42Mobile app. The Local Notification configuration is encapsulated in the LocalNotifications dictionary <key>localnotifications</key> <dict>** Add settings as described bellow here **</dict> Days: Time frame in days to be reminded in. Currently 0-7 is supported, 0 means notifications are disabled <key>days</key> <integer>7</integer> Time: Specific time of day to be reminded in 24 hour date format. <key>time</key> <string>15:30</string> Page 7

9 This following full example notifies the end users every 7 days short after noon: <key>localnotifications</key> <dict> <key>days</key> <integer>7</integer> <key>time</key> <string>13:30</string> </dict> Start Tab This configuration defines which section from the left menu should be used as the initial page when the application will be started from the end user. <key>starttaburl</key> <string>m42mobile://news</string> The following start tab url's are supported: Dashboard: m42mobile://dashboard News: m42mobile://news Applications: m42mobile://applications Documents: m42mobile://documents Contacts: m42mobile://contact Service Catalog: m42mobile://catalog Service Desk: m42mobile://servicedesk Knowledge Base: m42mobile://kb Settings: m42mobile://settings Actions The M42Mobile application offers several actions which can be enabled or disabled from the EMM Server. As soon an action is disabled it can't be used from the end user anymore. The following actions are supported: Add Account: Allows to disable the add account action in the application settings <key>disableuseraccounts</key> Add Datasource: Allows to disable the add datatsource action in the mobile content management viewer <key>disabledocumentsource</key> Page 8

10 App Tunnel EMM vendors who participate in AppConfig Community have the ability to enable native app tunneling features on supported mobile devices using a protocol called per-app VPN. Many EMM vendors provide customers a built-in perapp VPN or App Tunneling solution as part of the EMM offering, as well as integrate with 3 rd party per-app VPN providers such as Cisco, Palo Alto Networks, F5, and Pulse Secure. Access Control For security reasons, enterprises may want to prevent users from downloading Matrix42 Mobile to their unmanaged or unapproved device. The following approaches of preventing access to the Matrix42 Mobile app on unapproved devices is supported: Access Control Support Type ios Support (y/n) Android Support (y/n) SAML Identity provider based access control N N App Config Based Access Control Y Y Page 9

11 Security Policies Some organizations may require the Matrix42 Mobile app to have more granular security and data loss protection within itself to prevent sensitive data and documents from leaking outside company control.. Lastly, EMM can leverage the native OS protocols to wipe and remove all corporate data on the device and uninstall the Matrix42 Mobile app. Security Policy ios Support (Y/N) Android Support (Y/N) Native OS Encryption Y (enforced with device pincode) Y (enforced with device pincode) Managed Open In Y (ios managed open in policy) Y (Android for Work policy) Copy / Paste Control N Y (Android for Work policy) Screenshot Control Y Y (Android for Work policy) The following config key/value pairs correspond to any security controls above that are implemented via app configuration keys. Key Description Value Type ios Support Android for Work Support EnablePrivacy Screenshot control TRUE Boolean Y Y (Android for Work policy) Page 10