EveryonePrint MDM Integration Guide. AirWatch. EveryonePrint MDM Integration Guide AirWatch Page 1 of 22

Transcription

1 EveryonePrint MDM Integration Guide AirWatch EveryonePrint MDM Integration Guide AirWatch Page 1 of 22

2 1. Introduction Printing options enabled with AirWatch integration Solution Architecture Overview Communication from Mobile Apps to EveryonePrint Mobile Gateway Communication of MDM AirPrint to EveryonePrint Mobile Gateway or EveryonePrint server AirWatch App Printing Configuration Device compatibility EveryonePrint Requirements AirWatch Requirements MDM features supported Important known limitations with AirWatch and Apple ios App Important known limitations with AirWatch and Android App Configuring Apple ios AirWatch App Add the EveryonePrint for AirWatch ios App to AirWatch Set App configuration and single-sign-on Method 1: Using SDK Profile and Custom Config Method 2: Using App Configuration Configuring Android for AirWatch App Add the EveryonePrint for AirWatch Android App to AirWatch Set App configuration and single-sign-on Method 1: Using SDK Profile and Custom Config Configuring AirWatch MDM AirPrint Overview EveryonePrint Requirements Configuration Overview Enable port 443 in Mobile Gateway Gateway on main server and main server using port 443 already Add EveryonePrint printers to AirWatch profiles Troubleshooting tips Confirm connection from mobile device to server Confirm profiles are deployed to device EveryonePrint MDM Integration Guide AirWatch Page 2 of 22

3 1. Introduction With mobile devices and applications flooding the market, mobile device management (MDM) is growing more important. By optimizing the functionality of mobile devices while controlling and protecting the data and configuration settings for all mobile devices in a network, support costs and business security risks are lowered. Through partnership with AirWatch, EveryonePrint is extending MDM core security and management features to the EveryonePrint mobile printing solution. The EveryonePrint mobile apps are fully integrated with AirWatch, which enables organizations to secure and manage internal, public and purchased apps across devices in a central console. 1.1 Printing options enabled with AirWatch integration With EveryonePrint and AirWatch integrated, there are 2 ways to print from mobile devices: From Apple ios devices: 1. Using native AirPrint Users can click Print from within any Apple app that supports printing No requirement to have any EveryonePrint app installed 2. Using the EveryonePrint App Users can print by choosing Share via.. or Open in.. from most Apple apps Requires the EveryonePrint app to be installed From Android devices: 1. Using the EveryonePrint App Users can print by choosing Share via.. or Open in.. from most Apple apps Requires the EveryonePrint app to be installed EveryonePrint MDM Integration Guide AirWatch Page 3 of 22

4 2. Solution Architecture Overview The EveryonePrint server consist of 2 overall components as it relates to the functionality of Wide Area Mobile Print: 1. The EveryonePrint server application, which manages the overall configuration, authentication of users, conversion, rendering and delivery of print jobs 2. The EveryonePrint Mobile Gateway, which facilities the communication from mobile devices and the server component. The Mobile Gateway has intentionally been created as a separate component, to enable more strict separation between mobile devices in public/untrusted WiFi networks, and a customer s internal corporate infrastructure. The EveryonePrint Mobile Gateway can be installed either on the EveryonePrint server or on its own server. EveryonePrint Mobile Gateway installed on the EveryonePrint server EveryonePrint Mobile Gateway installed on its own server 2.1 Communication from Mobile Apps to EveryonePrint Mobile Gateway The EveryonePrint Mobile Apps, Apple ios, Android and Windows Phone, communicate with the EveryonePrint Mobile Gateway on TCP ports 7910 and All communication is SSL/TLS encrypted. EveryonePrint MDM Integration Guide AirWatch Page 4 of 22

5 2.2 Communication of MDM AirPrint to EveryonePrint Mobile Gateway or EveryonePrint server Native AirPrint from an Apple ios device using an MDM deployed EveryonePrint printer, is via TCP port 443. All communication is SSL/TLS encrypted. EveryonePrint MDM Integration Guide AirWatch Page 5 of 22

6 3. AirWatch App Printing Configuration 3.1 Device compatibility Minimum ios version is 7.0 Minimum Android version is EveryonePrint Requirements Minimum EveryonePrint version with a valid EveryonePrint evaluation or Enterprise license. 3.3 AirWatch Requirements Minimum AirWatch version MDM features supported - Install and removal of EveryonePrint Apps via AirWatch - App configuration / custom config - Single-sign-on (using App configuration/custom config) - MDM AirPrint support - Tunneling (be aware that the Print extension does not support tunneling or per App VPN) EveryonePrint MDM Integration Guide AirWatch Page 6 of 22

7 3.5 Important known limitations with AirWatch and Apple ios App When using the Apple ios App for printing with AirWatch and if using App specific VPN tunneling, AirWatch does not initialize and establish a VPN connection when printing via a Share or Action extension in Apple ios. Today AirWatch only establishes a VPN connection when printing is called with Copy to EveryonePrint which when clicked opens the full EveryonePrint App. 3.6 Important known limitations with AirWatch and Android App If using VPN tunneling, the Android App must be wrapped and distributed as an internal application as opposed to a Public App. EveryonePrint MDM Integration Guide AirWatch Page 7 of 22

8 3.7 Configuring Apple ios AirWatch App Add the EveryonePrint for AirWatch ios App to AirWatch To add the EveryonePrint app to AirWatch, go to Apps -> Applications -> List View -> Public and choose to Add Application. Search the App store for EveryonePrint and choose the EveryonePrint for AirWatch app. Under Deployment, configure settings as needed, and make sure to choose Yes to Application uses AirWatch SDK Set App configuration and single-sign-on There are 2 ways to set an Apps configuration and enable single-sign-on for Apple ios Method 1: Using SDK Profile and Custom Config In the AirWatch console go to Devices -> Devices Settings -> Apps -> Settings And Policies-> Profiles Create or edit an existing ios SDK profile. In the Custom Config section of the profile enter the following key/value pairs: - GwHostKey : to pre-configure the IP or host of the EveryonePrint Mobile Gateway - GwPortKey : to pre-configure the port of the EveryonePrint Mobile Gateway - GwUserKey : to pre-configure the user that should be logged on automatically (SSO) EveryonePrint MDM Integration Guide AirWatch Page 8 of 22

9 The keys such as GwHostKey are case-sensitive! If not entered correctly, the App cannot retrieve the data. The single-sign-on is configured using a AirWatch system variable for the GwUserKey key in the custom config. In the example we have chosen the {EnrollmentUser} variable. But you may use any variable that you seem fit in your environment that represents the logged in user and can be authenticated by EveryonePrint server. After you have created or modified the ios SDK profile you can apply the SDK profile to the app listing. Modify the App listing and under More tab choose the SDK. There select the relevant ios SDK profile. EveryonePrint MDM Integration Guide AirWatch Page 9 of 22

10 Then finish by saving the changes Method 2: Using App Configuration An App configuration can be applied as part of an Assignment. Assignments can be configured when adding a new app or editing an existing app. Open the Advanced area of the Assignment and configure the App configuration with the same keys as in custom config described above. EveryonePrint MDM Integration Guide AirWatch Page 10 of 22

11 The lookup values in app configuration are not exactly the same as are available in custom config. For example, the {EnrollmentUser} is not available. Choose value that can be authenticated by EveryonePrint server. 3.8 Configuring Android for AirWatch App Add the EveryonePrint for AirWatch Android App to AirWatch To add the EveryonePrint app to AirWatch, go to Apps -> Applications -> List View -> Public and choose to Add Application. Search the App store for EveryonePrint and choose the EveryonePrint for AirWatch app. EveryonePrint MDM Integration Guide AirWatch Page 11 of 22

12 Under Deployment, configure settings as needed, and make sure to choose Yes to Application uses AirWatch SDK Set App configuration and single-sign-on There is only one way to set an Apps configuration and enable single-sign-on for Android Method 1: Using SDK Profile and Custom Config In the AirWatch console go to Devices -> Devices Settings -> Apps -> Settings And Policies-> Profiles Create or edit an existing Android SDK profile. In the Custom Config section of the profile enter the following key/value pairs: - GwHostKey : to pre-configure the IP or host of the EveryonePrint Mobile Gateway - GwPortKey : to pre-configure the port of the EveryonePrint Mobile Gateway - GwUserKey : to pre-configure the user that should be logged on automatically (SSO) The keys such as GwHostKey are case-sensitive! If not entered correctly, the App cannot retrieve the data. The single-sign-on is configured using a AirWatch system variable for the GwUserKey key in the custom config. EveryonePrint MDM Integration Guide AirWatch Page 12 of 22

13 In the example we have chosen the {EnrollmentUser} variable. But you may use any variable that you seem fit in your environment that represents the logged in user and can be authenticated by EveryonePrint server. After you have created or modified the Android SDK profile you can apply the SDK profile to the app listing. Modify the App listing and under More tab choose the SDK. There select the relevant Android SDK profile. EveryonePrint MDM Integration Guide AirWatch Page 13 of 22

14 4. Configuring AirWatch MDM AirPrint 4.1 Overview With MDM AirPrint, EveryonePrint printers can be pushed to the Apple ios devices using the MDM solution. The MDM enrolled Apple device will show the AirPrint printers, and users simply click Print from within the App from which they want to print. Print job data is transferred via TCP port 443 SSL/TLS connection to Mobile Gateway. 4.2 EveryonePrint Requirements MDM AirPrint for AirWatch requires minimum EveryonePrint version 4.1 with a valid evaluation or Enterprise license. 4.3 Configuration Overview The configuration of EveryonePrint MDM AirPrint involves 2 overall steps: 1. EveryonePrint Mobile Gateway running on port Add EveryonePrint printers to AirWatch profiles The following assumes that the EveryonePrint server and mobile gateway have been configured successfully. 4.4 Enable port 443 in Mobile Gateway When an Apple ios device sends AirPrint via the MDM configuration, the communication is via SSL/TLS port 443. EveryonePrint MDM Integration Guide AirWatch Page 14 of 22

15 This port must be available for use, either by the EveryonePrint Mobile Gateway or the main EveryonePrint server, to enable MDM AirPrint. To verify if port 443 is in use or available on a server, netstat can be run with a filter for 443 such as: netstat -ano -p tcp findstr /i :443 In this example port 443 is already in use, which would cause a conflict: If no listing is returned, as below, port 443 is not in use and can be used for MDM AirPrint: To enable port 443 in the EveryonePrint Mobile Gateway: 1. Open the EveryonePrint Mobile Gateway Admin and go to Configuration Default URL is 2. Check the box to Enable support for MDM AirPrint EveryonePrint MDM Integration Guide AirWatch Page 15 of 22

16 3. Restart the EveryonePrint Mobile Gateway service Gateway on main server and main server using port 443 already In cases where the EveryonePrint Mobile Gateway is installed on the main EveryonePrint server, and the main EveryonePrint server already occupies port 443, the MDM AirPrint should not be enabled in the gateway itself, but MDM AirPrint should just communicate straight to the EveryonePrint server on port Add EveryonePrint printers to AirWatch profiles Printers configured in EveryonePrint is added via the AirWatch Console under a relevant Apple ios device configuration profile. 1. Under Devices -> Profiles -> List View, either add a profile or add printers to an existing profile. EveryonePrint MDM Integration Guide AirWatch Page 16 of 22

17 2. Go to AirPrint and click Configure 3. In the AirPrint printers view, add the printers to deploy. IP address is the IP address of the server hosting the EveryonePrint Mobile Gateway. Resource path is always ipp/m/{printerid} with {printerid} replaced by the Printer ID of the printer in Everyoneprint. For example, if the following printers are defined in EveryonePrint: And all printers should be available as AirPrint printers on the Apple devices, configure the following in AirWatch: EveryonePrint MDM Integration Guide AirWatch Page 17 of 22

18 With the above configuration and the configuration profile pushed to Apple ios devices, the printers will now appear on the device. EveryonePrint MDM Integration Guide AirWatch Page 18 of 22

19 4.6 Troubleshooting tips If printers do not appear on the Apple ios device, the most common cause is that there is no connection from the Apple ios device to the IP address provided during configuration, on port 443. When clicking Print from within an App on an ios device, the device will verify the communication with the printer before displaying the printer as an option in the App print view Confirm connection from mobile device to server Verify that the port 443 is accessible from the Apple ios device to the EveryonePrint server hosting the Mobile Gateway, using a tool such as inettools. In above we can confirm that port 443 is open to the server. EveryonePrint MDM Integration Guide AirWatch Page 19 of 22

20 4.6.2 Confirm profiles are deployed to device If the connection is open but no printers appear, confirm that the profile containing AirPrint printers has been deployed to the Apple device. 1. Go to Settings -> General -> Device Management 2. Choose the MDM profile EveryonePrint MDM Integration Guide AirWatch Page 20 of 22

21 3. Choose More Details to view details for the profile 4. If a profile containing AirPrint printers has been installed successfully on the device, an AIRPRINT CONFIGURATION will appear. Click this AirPrint to view details EveryonePrint MDM Integration Guide AirWatch Page 21 of 22

22 5. The printers installed on the device will appear. EveryonePrint MDM Integration Guide AirWatch Page 22 of 22