Installation and Configuration Guide

Transcription

1 Installation and Configuration Guide BlackBerry Workspaces Unified Content Connector Version 2.1

2 Published: SWD

3 Contents Overview... 4 BlackBerry Workspaces versions...4 Installing a new integrated Unified Content Connector with Appliance-X... 5 Prerequisites... 5 Port requirements...5 Set up... 5 Deploy the UCC... 6 Manual installation... 7 Prerequisites... 7 Port requirements...7 Set up... 7 Install Unified Content Connector...10 UCC Installer settings Uninstall Unified Content Connector Configure the Unified Content Connector to work with the BlackBerry Workspaces Server...12 Install the Unified Content Connector SSL certificate Configuring the UCC Configure the Unified Content Connector in BlackBerry Workspaces administration console Create a transient workspace Migration to Unified Content Connector Migrate the database Migrate the server...16 Appendix: Configuring KCD...17 Find the application Pool Identity and Port...17 Apply a user in Active Directory for apps and files Add KCD in Active Directory for SharePoint Add Kerberos constraints for each File Share server Enabling KCD on the UCC Host Legal notice...21

4 Overview Overview 1 This guide describes how to install and configure the BlackBerry Workspaces Unified Content Connector (UCC) to work with your BlackBerry Workspaces system. Your organization must be defined in the BlackBerry Workspaces Configuration Tool with a Secure tier. Configure a Unified Content Connector to enable your users to securely access, edit, and share documents in transient workspaces. The steps that you need to follow depend on your BlackBerry Workspaces system. Chapter Configuration Follow steps in section Have BlackBerry Workspaces Appliance-X Want an integrated Unified Content Connector Installing a new integrated Unified Content Connector with Appliance-X Have BlackBerry Workspaces vapp and want an integrated UCC Manual installation Have BlackBerry Workspaces cloud service and want to have an on-premise integrated UCC Have BlackBerry Workspaces with an existing external GEMS configuration and want to move to integrated UCC Migration to Unified Content Connector BlackBerry Workspaces versions This guide describes workflows when working with the following versions of Workspaces components: BlackBerry Workspaces server: v5.6.0 or later. BlackBerry Workspaces Appliance-X: v or later. 4

5 Installing a new integrated Unified Content Connector with Appliance-X Installing a new integrated Unified Content Connector with Appliance-X 2 This chapter describes how to install and configure a Unified Content Connector (UCC) to work with your Workspaces Appliance-X system. Your organization must be defined in the Workspaces Configuration Tool with an Enterprise tier. Configure a Unified Content Connector (based on GEMS product technology) to enable your users to securely access, edit, and share documents in transient workspaces. Prerequisites This section describes the port requirements and set up for configuring Workspaces with a new integrated Unified Content Connector. Port requirements Set up the firewall ports according to the table port requirements listed below: Source Target Port Master-Main server (Basic deployment) Unified Content Connector 8443 or Main server (Advanced deployment) Unified Content Connector External Repository or Application server (Advanced deployment) At customer discretion Set up Perform this task to set up the Unified Content Connector machine as a Windows server. 1. Make sure that you are an administrator on this machine. 2. Import the provided standard OVF templates (Windows Server 2012) into your ESX environment. 5

6 Installing a new integrated Unified Content Connector with Appliance-X Deploy the UCC 1. Sign in to BlackBerry Workspaces Appliance-X: a. Browse to where <server-address> is the address of the Master-main server machine for Basic deployments, or the Orchestration server machine for Advanced deployments. b. Sign in with the username watchdox and the password created in the Appliance-X installer setup procedure. 2. Navigate to the Add-ons tab. 3. In the WatchDox Unified Content Connector area, enter the IP address and Password of the machine set up for Unified Content Connector installation. 4. Click Deploy Machines. The machine is deployed. 5. In the dialog that appears, click Next. The Add-ons tab is displayed. 6. Enter your administrator username and password for the UCC machine. 7. Click Save & Deploy. BlackBerry Workspaces Appliance-X is configured to work with the Unified Content Connector. After you finish: Configure the UCC. See Configure the Unified Content Connector in BlackBerry Workspaces administration console. 6

7 Manual installation Manual installation 3 This section describes the configuration instructions for configuring the Unified Content Connector manually in the following scenarios: When you have BlackBerry Workspaces vapp and want an integrated UCC When you have BlackBerry Workspaces cloud service and want to have an on-premise UCC Prerequisites This section describes the port requirements and set up for manual installation. Port requirements Set up the firewall ports according to the table below: Source Target Port Unified Content Connector SQL Express Server 1431 Unified Content Connector MySQL 3306 Workspaces Server Unified Content Connector 8443 Set up Perform the following steps to prepare the site for UCC installation. Step Configuration Set up the UCC machine as a Windows server. Create an Microsoft Active Directory account for UCC services. Configure the database. 7

8 Manual installation Step Configuration Install Java. Set up the UCC machine as a Windows server Perform this task to set up the Unified Content Connector machine as a Windows server. Windows Server 2012 R2 is supported. 1. Make sure that you are an administrator on this machine. 2. Import the provided standard OVF templates (Windows Server 2012) into your ESX environment. 3. For hybrid installations, i.e. where the BlackBerry Workspaces server is part of the Cloud service and the UCC server is onpremise, set the Windows server FQDN to public DNS. Create an Active Directory account for UCC Services 1. Create an Active Directory account with the following attributes: Attribute Description Account name Account password Password expires <domain>\goodadmin Must be distinct from the Account name and must not contain the following characters: ', ;', '@', '/' ^. Must be set to 'Never' for this account. 2. Make sure that the goodadmin account is a member of the local administrator group on the UCC machine. Configure the database Configure one server; either a Microsoft SQL Server or a MySQL Server. Install and configure Microsoft SQL Server 1. Download SQL Express Server (2014 or 2008 R2) from or obtain it from your BlackBerry Professional Services Representative. 2. Provision a user on the UCC machine with the following privileges: Local administrator "Log on as a service" 8

9 Manual installation Important: Log in as this user to perform all the following steps on the Unified Content Connector machine. 3. Copy and install the SQL Express Server available from your BlackBerry Professional Services Representative from the following location: Good%20Enterprise%20Mobility%20Server%20(GEMS)%7CPrerequisite%20Installations%7CSQl%20Express/ 4. Create the Unified Content Connector database on the machine created in step 1: a. In the Command window, run the following three commands: sqlcmd -S localhost\sqlexpress -E CREATE DATABASE GEMSDOCS GO b. Give the System user permissions to manage both databases. c. In the Command window, run the following commands: sqlcmd -S localhost\sqlexpress -E USE [master] GO CREATE LOGIN [NT AUTHORITY\SYSTEM] FROM WINDOWS WITH DEFAULT_DATABASE=[master] GO ALTER SERVER ROLE [sysadmin] ADD MEMBER [NT AUTHORITY\SYSTEM] GO USE [GEMSDOCS] GO CREATE USER [NT AUTHORITY\SYSTEM] FOR LOGIN [NT AUTHORITY\SYSTEM] GO ALTER ROLE [db_owner] ADD MEMBER [NT AUTHORITY\SYSTEM] GO d. Make sure that the Service SQL browser is started. e. Close all SQL management tools. 5. Configure the SQL Express Server to listen on port

10 Manual installation 6. Start PowerShell in Administrator mode then run the following script: Import-Module "sqlps" -DisableNamechecking $smo = 'Microsoft.SqlServer.Management.Smo.' $wmi = new-object ($smo + 'Wmi.ManagedComputer'). # List the object properties, including the instance names. $Wmi # Enable the TCP protocol on the default instance. $uri = "ManagedComputer[@Name='" + (get-item env:\computername).value + "']/ ServerInstance[@Name='SQLEXPRESS']/ServerProtocol[@Name='Tcp']" $Tcp = $wmi.getsmoobject($uri) $Tcp.IsEnabled = $true $Tcp.Alter() $Tcp $wmi.getsmoobject($uri + "/IPAddress[@Name='IPAll']").IPAddressProperties $wmi.getsmoobject($uri + "/ IPAddress[@Name='IPAll']").IPAddressProperties[1].Value="1431" $Tcp.Alter() 7. Restart the SQL Server service. Install and configure MySQL 1. Download MySQL (5.5 and above) from or obtain it from your BlackBerry Professional Services Representative. 2. Follow the procedure in the MySQL installer. Install Java 1. Download and install Java 1.8 from or obtain it from your BlackBerry Professional Services Representative. 2. Set JAVA_HOME environment variable on Windows. 3. As an administrator, in the Command window set the JAVA _HOME variable: setx -m JAVA_HOME "C:\Program Files\Java \jre1.8.0_131" 4. Download the latest java cryptography unlimited strength extension from the Oracle website, for example: Open the zip, and copy the enclosed jars to the $JAVA_HOME/jre/lib/security directory. Install Unified Content Connector Before you begin: The UCC installer is provided as a single zip file UCCInstaller.zip. 10

11 Manual installation 1. Run a command prompt as an Administrator. 2. Unzip UCCInstaller.zip to an installation folder, for example C:\UCCInstaller. 3. Change the directory to the installation dist folder, for example C:\UCCInstaller\dist. 4. Edit settings.ini as described in UCC Installer settings. 5. Run setup.bat. Good Technology Common Services appears in Windows Services. UCC Installer settings Edit settings.ini according to the table below: Parameter Required Value DB_SKIP Yes true: do not update database schema false: update database schema (default) DB_TYPE Yes mysql or sqlserver DB_USERNAME Yes Database user name DB_PASSWORD Yes Database password (can be encrypted) DB_HOST Yes Database host name DB_PORT Yes Database port number DB_DOCS Yes Database name (default gemsdocs) WINDOWS_AUTH No Use Windows Authentication (SQL Server only) NTUSER No Logon user for Windows service NTPASSWORD No Logon password for Windows service UCC_HOST Yes UCC server host name (can be encrypted) UCC_PORT Yes UCC server port number (default 8181) UCC_USERNAME Yes UCC admin user name UCC_PASSWORD Yes UCC admin password 11

12 Manual installation Parameter Required Value UCC_INSTALLPATH No UCC installation location (default C:\Workspaces_UCC) WD_KEYFILENAME No BlackBerry Workspaces public keyfile location (default C: \wdkey\wdkey.txt) WD_KEYSTORE No BlackBerry Workspaces keystore (default: C:\wdkey \watchdox.ks) This keystore is used for decrypting the database password. WD_KEYPASSWORD No BlackBerry Workspaces keystore password This keystore password is used for decrypting the database password. Uninstall Unified Content Connector 1. Run a command prompt as Administrator. 2. Change the directory to C:\Workspaces_UCC\dist\gems-quickstart-2.1.0\bin. 3. Run the command GoodServerDistribution-service.bat remove. 4. Remove the installation folder. Configure the Unified Content Connector to work with the BlackBerry Workspaces Server 1. Obtain the Public Key for your region by browsing to the following URL: Copy the key value within the double quotes and save it in a text file at the location C:\wdkey\wdkey.txt on your UCC machine. 3. The installer will read the key file and upload it to the UCC server. 12

13 Manual installation Install the Unified Content Connector SSL certificate This procedure is for hybrid installations in the public cloud. Follow these steps to install the Unified Content Connector SSL certificate on the BlackBerry Workspaces server. 1. Obtain a SSL certificate signed by a proper CA. 2. Remove the gems.jks keystore file under C:/Workspaces_UCC/gems-quickstart-2.1.0/etc/keystores. 3. Run the java keytool to import the certificate to the gems.jks keystore. %JAVA_HOME%\bin\keytool -import -trustcacerts -alias serverkey -file <your ssl cert filename> -keystore C:/ Workspaces_UCC/gems-quickstart-2.1.0/etc/keystores/gems.jks 4. Add your keystore passwords to the bottom of jetty.xml under <installation folder>/gems-quickstart-<version>/...: <Set name="keystorepassword">obf:new password</set> <Set name="keymanagerpassword">obf:new password</set> <Set name="truststorepassword">obf:new password</set> Note: If obfuscated, type OBF: as a prefix. After you finish: Configure the UCC. See Configuring the UCC. 13

14 Configuring the UCC Configuring the UCC 4 This section describes how to configure the UCC and create transient workspaces in BlackBerry Workspaces. Configure the Unified Content Connector in BlackBerry Workspaces administration console Before you begin: Make sure that you have performed all of the previous steps to set up and configure the Unified Content Connector. 1. Sign in to the BlackBerry Workspaces administration console. 2. In the left pane, click Content Connectors. 3. Click. 4. In the Connector display name box, enter a name for the connector. 5. In the Repository Type list, select the type of connector that you want to configure. 6. In the UCC credentials area: If your organization is working with Appliance-X, the BEMS credentials are auto-populated and need not be changed. If your organization is working with vapp or has a Cloud service (i.e. manual installation), for Alfresco, SharePoint and Windows File Share connectors, click Edit to enter the required BEMS URL, Username, and Password. Note: When configuring a standalone Unified Content Connector, enter the URL in the following format: <http or https>://<ucc server address>:ucc_port value (as described in the UCC Installer settings table ) E.G.: 7. In the Allowed path box, enter the root path of the repository. If you selected Alfresco, the allowed path should match the CMIS service URL. E.G.: ip or FQDN>:8080/alfresco/api/-default-/public/cmis/versions/1.1/atom/ You can add a relative path to the end of the service URL; however, do not use the Alfresco site or shared files location in the allowed path. Refer to the Alfresco documentation ( DOC-5527-cmis#w_cmisserviceurl), section 3.1, CMIS Service URL for more details. 14

15 Configuring the UCC Note: If the Alfresco connector URL changes when upgrading the Alfresco server, the connector and all associated workspaces will need to be recreated.alfresco server is supported only on on-premise configurations. If you selected OneDrive for Business, the allowed path should match the root FQDN of the OneDrive site. If you selected SharePoint or SharePoint Online, the allowed path can be either a site URL or a document library path. 8. If you selected SharePoint or Windows File Share and are working with KCD, select Enable KCD. 9. Click Apply changes. Create a transient workspace This procedure describes how to create a new transient workspace in BlackBerry Workspaces Web Application for repositories configured using the Unified Content Connector. This action is available for users with the Workspace owner role. 1. Sign in to the BlackBerry Workspaces Web Application. 2. Access the Unified Content Connector repository. 3. In the action bar, click or click and select New workspace. 4. In the Workspace name box, enter a name for the workspace. 5. In the Workspace description (optional) box, enter a description if desired. 6. In the Path box, enter the repository path. The path value determines the root level of the repository. It must begin with the same Allowed path as set by the Organization Administrator when the connector was configured. For example: Where the Organization Administrator set the allowed path to \\fileshare\, the following paths are valid: \\fileshare\ \\fileshare\foldera\folderb An example for systems with an Alfresco server: Where the Organization Administrator set the allowed path to <server ip or FQDN>:8080/alfresco/api/-default-/public/cmis/versions/1.1/atom/, the following paths are valid: ip or FQDN>:8080/alfresco/api/-default-/public/cmis/ versions/1.1/atom/-default- ip or FQDN>:8080/alfresco/api/-default-/public/cmis/ versions/1.1/atom/-default-/repositorya 7. In the User name and Password boxes, enter your access credentials for the external repository. 8. Click Add. 15

16 Migration to Unified Content Connector Migration to Unified Content Connector 5 This section provides instructions for customers that have an existing GEMS connector configured in BlackBerry Workspaces and want to migrate to the new UCC. Description Migrate the database Migrate the server Migrate the database GEMS uses an SQL Server. If the customer wishes to continue using SQL Server for UCC, no database migration is needed. If the customer wants to change to use MySql, do the following: To change to MySql, contact your BlackBerry Professional Services Reporesentative and ask for the customized scripts to migrate data from SQL Server to MySql. Follow the instructions provided by the representative. Migrate the server 1. Uninstall GEMS 2. Follow the same setup procedure as outlined in Manual installation. 3. If you want to keep the SQL Server database, make sure that the DB_SKIP parameter is set to true. 16

17 Appendix: Configuring KCD Appendix: Configuring KCD 6 Kerberos Constrained Delegation (KCD) is supported for Microsoft SharePoint and Windows File Share only. Step Configuration Find the application Pool Identity and Port. Apply a user in Active Directory for the apps and files. Add Kerberos constraints in Active Directory for each user and app. Add Kerberos constraints in Active Directory for each File Share server. Enable Kerberos constraints in UCC. Find the application Pool Identity and Port Find the application pool identity and port number for the web applications to be shared. 1. Create a list of web applications that are going to be shared through UCC-Docs 2. Open Windows Internet Information Services (IIS) Manager. Note: Be sure to jot down any additional unique port numbers assigned if a web application was extended to create alternate access mappings. 3. Find the Application Pool identity in the Application Pools list view or in Central Administration > Security > Configure service accounts. CAUTION: In most instances, for KCD to work properly, the application pool identity user must be the same for all application pools whose applications will be accessed by UCC-Docs. This means you cannot have different application pools running under different users. 4. Find the port for each of the web applications listed in the Web Application tab. You can also look in Alternate Access Mappings view as necessary. 17

18 Appendix: Configuring KCD 5. Navigate to Central Administration > Application Management, choose the web application and click Authentication Providers in the ribbon bar. 6. Make sure that the authentication type for each web application is set to Windows and that Negotiate (Kerberos) is enabled under IIS Authentication Settings. Tip: In certain scenarios, switching to Negotiate might also require enabling Kernel-mode authentication in IIS for the corresponding IIS site. For more information, see "Service Principal Name (SPN) checklist for Kerberos authentication with IIS 7.0/7.5" in MSDN. Apply a user in Active Directory for apps and files Apply the UCC service account user in Active Directory, and associate it with the web apps and files to be shared. Note: It is recommended that you use the UCC service account (goodadmin) as the Service Principal Name (SPN) for KCD. In the procedure below, the user is <domain>\goodadmin. 1. Make sure the service account user password is set to never expire. Also, do not require a password change for logging on. 2. Create a Service Principle Name (SPN) for each web application that needs to be shared as follows: setspn S HTTP/SPHOST:PORT domain\apppooluser setspn S HTTP/SPHOST.FQDN:PORT domain\apppooluser setspn S HTTP/SPHOST domain\apppooluser setspn S HTTP/SPHOST.FQDN domain\apppooluser Note: If the port is a default port (80 or 443), omit the first two lines above. Some of the lines need just a host name while others need a fully qualified host name. If you are using SSL, the SPN must refer to HTTP and not HTTPS. If the application pool identity is for a built-in user such as Network Service, then specify the host name as shown below (and not <domain>\apppooluser). setspn S HTTP/SPHOST:PORT domain\sphostsetspn S HTTP/SPHOST.FQDN:PORT domain\sphostsetspn S HTTP/SPHOST domain\sphostsetspn S HTTP/SPHOST.FQDN domain\sphost Add KCD in Active Directory for SharePoint Create constrained delegations for goodadmin in each of the SPNs indicated in the following procedure. 18

19 Appendix: Configuring KCD Note: It is recommended that you use the UCC service account (goodadmin) as the Service Principal Name (SPN) for KCD. In the procedure below, the user is <domain>\goodadmin. 1. Open the Active Directory Users and Computers manager, and look under Users to find goodadmin. 2. Right click goodadmin and select Properties. 3. In the Delegation tab, select Trust this user for delegation to specified services only and Use any authentication protocol and then click Add. 4. In the Add Services dialog box, select Users or Computers to open the Select users or Computers dialog box. 5. Enter the SharePoint Application Pool Identity user name and click OK. 6. Select all the services that correspond to the SharePoint web applications running under the username chosen above, except for the HTTP service, and click OK. The services to which UCC service account can provide delegated credentials are now listed in the DelegationUser Properties dialog box. 7. Click Add and repeat steps 2 through 6 above choosing the computer account for the SharePoint server. When you choose the services, select HOST and http, then click OK to add each computer account to list of services. The list of added services are then listed Delegation tab. 8. Repeat steps 3 4 for each application pool identity user and each identified web application, then click OK to save the delegation changes. Note: A limit of 1300 services can be delegated to one account. Add Kerberos constraints for each File Share server For File Share repositories, the delegation is made to the UCC computer account. 1. Go to Active Directory > Users and Computers > Computers. 2. Right-click the UCC computer entry, and click Properties. 3. In the Delegation tab, click Add > Users or Computers, and type in the name of the File Share server. 4. Click OK. 5. In the list of services, select cifs and click OK. 6. Repeat step 2-3 for each File Share server that you want to configure. 7. Reboot the machine to make sure that all delegation changes are received. 19

20 Appendix: Configuring KCD Enabling KCD on the UCC Host Enable Kerberos Constraints on the UCC host machine. 1. On the UCC host machine running the Docs service, access Local Security Policy > User Rights Assignment grant the Act as operating system privilege to the UCC Windows Server Account (i.e., <domain>/goodadmin). 2. Click OK. 3. Open the Good Technology Common Service from Windows Services. 4. In the Log On tab, change the Local System account to <domain>/goodadmin service account. 5. Click OK. 6. Restart the Good Technology Common Service. 20

21 Legal notice Legal notice BlackBerry Limited. Trademarks, including but not limited to BLACKBERRY, BBM, BES, EMBLEM Design, ATHOC, MOVIRTU and SECUSMART are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or affiliates, used under license, and the exclusive rights to such trademarks are expressly reserved. All other trademarks are the property of their respective owners. Adobeare either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Apple App Store, ipad, Mac OS, and Safari are trademarks of Apple Inc. Android, Google Chrome, and Google Play are trademarks of Google Inc. DocuSign is a trademark of DocuSign, Inc. in the United States and/or other countries. ios is a trademark of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. ios is used under license by Apple Inc. Microsoft Active Directory, Internet Explorer, Microsoft Excel, Microsoft Office, Microsoft Outlook, Microsoft PowerPoint, Microsoft SharePoint, Microsoft Windows, and Microsoft Word are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Mozilla Firefox is a trademark of Mozilla Foundation. "LibreOffice" is licensed under the Mozilla Public License v2.0 and is a registered trademark of its registered owners and is in actual use as a trademark in one or more countries. All other trademarks are the property of their respective owners. This documentation including all documentation incorporated by reference herein such as documentation provided or made available on the BlackBerry website provided or made accessible "AS IS" and "AS AVAILABLE" and without condition, endorsement, guarantee, representation, or warranty of any kind by BlackBerry Limited and its affiliated companies ("BlackBerry") and BlackBerry assumes no responsibility for any typographical, technical, or other inaccuracies, errors, or omissions in this documentation. In order to protect BlackBerry proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of BlackBerry technology in generalized terms. BlackBerry reserves the right to periodically change information that is contained in this documentation; however, BlackBerry makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party websites (collectively the "Third Party Products and Services"). BlackBerry does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by BlackBerry of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NON- INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY 21

22 Legal notice LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL BLACKBERRY BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON- PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH BLACKBERRY PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF BLACKBERRY PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF BLACKBERRY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, BLACKBERRY SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO BLACKBERRY AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED BLACKBERRY DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF BLACKBERRY OR ANY AFFILIATES OF BLACKBERRY HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Some airtime service providers might not offer Internet browsing functionality with a subscription to the BlackBerry Internet Service. Check with your service provider for availability, roaming arrangements, service plans and features. Installation or use of Third Party Products and Services with BlackBerry's products and services may require one or more patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with BlackBerry's products and services are provided as a convenience to you and are provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties of any kind by BlackBerry and BlackBerry assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with BlackBerry. 22

23 Legal notice The terms of use of any BlackBerry product or service are set out in a separate license or other agreement with BlackBerry applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY BLACKBERRY FOR PORTIONS OF ANY BLACKBERRY PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. BlackBerry Enterprise Software incorporates certain third-party software. The license and copyright information associated with this software is available at BlackBerry Limited 2200 University Avenue East Waterloo, Ontario Canada N2K 0A7 BlackBerry UK Limited 200 Bath Road Slough, Berkshire SL1 3XE United Kingdom Published in Canada 23