Distributing GO!Enterprise MDM for iOS as an Enterprise Appnotifymdm.notify.net/docbin/GOMDM Enterprise App.pdf · GO!Enterprise MDM Why Distribute GO!Enterprise MDM for iOS as an

GO!Enterprise MDM Why Distribute GO!Enterprise MDM for iOS as an Enterprise App? 1

Distributing GO!Enterprise MDM for iOS as an Enterprise App

This guide provides information on . . .

. . . Benefits of Distributing GO!Enterprise MDM for iOS as an Enterprise App

. . . Requirements for Distributing GO!Enterprise MDM for iOS as an Enterprise App

. . . Tips on Enrolling in the iOS Developer Enterprise Program

. . . Information for Organizations using an App Store version

. . . Renewing the Enterprise App Certificate


Table of Contents

Why Distribute GO!Enterprise MDM for iOS as an Enterprise App? 3

Requirements 4

Enrolling in the iOS Developer Enterprise Program 6

Preparing for your Enterprise App 7

Distributing your GO!Enterprise MDM Enterprise App 14

Renewing an Enterprise App Certificate 16

Appendix A: Upload SSL Certificate for Group Notifications 17


Why Distribute GO!Enterprise MDM for iOS as an Enterprise App?

The GO!Enterprise MDM for iOS device application is available in the Apple App Store. In accordance with Apple privacy regulations, however, App Store applications do not permit background processing to initiate a connection to a server for the purpose of tracking statistics. Thus, the GO!Enterprise MDM app obtained from the App Store requires iOS users to initiate synchronization of user/device statistics and location data by opening the application.

Since Enterprise (proprietary, in-house) Applications do not fall under the same privacy regulations as App Store applications, you can opt to distribute the GO!Enterprise MDM for iOS device app as an Enterprise App. Applications distributed in this manner can run on a device in the background without user interaction. Synchronization of user/device statistics and location data occurs automatically at a frequency determined by the device connection schedule.

Distributing the application as an Enterprise App requires that your organization maintain an annual Apple iOS Developer Enterprise Program (iDEP) membership. Globo Mobile Technologies will work with organizations who want to pursue this solution. Please contact Globo Mobile Technologies support team for more information at, [email protected].

Note: GO!Enterprise MDM server (v3.8.0 or greater) sends an APN on the synchronization schedule to trigger the device app to sync to the server in the background. This is functional only on devices running iOS 7.0+. and eliminates the need for an enterprise app.

Distribution Options

You can host the GO!Enterprise MDM for iOS Enterprise App at your own site or the app can be hosted at the Globo Data Center. Globo Mobile Technologies will issue your organization a URL from which users can obtain the application. Updates to an Enterprise App hosted at Globo Mobile Technologies follow the same update schedule as the standard application available on the Apple App Store. See Distributing Your Enterprise App.

Tips for Using the Application Hosted in the App Store

If you choose not to distribute the GO!Enterprise MDM for iOS app as an Enterprise App, you should do the following to ensure the most effective use of the App Store application:

Instruct users to initiate the synchronization of user/device statistics and location data by opening the GO!Enterprise MDM app daily and allowing it to complete a synchronization cycle.

mailto:[email protected]

GO!Enterprise MDM Requirements 4

If you use the Compliance Manager to restrict devices that do not make GO!Enterprise MDM connections or update location data, you may want to set the parameters for certain restrictions more liberally for the iOS device platform. This will prevent iOS users from being easily restricted due to infrequent GO!Enterprise MDM connections or location data updates. Configure the following Device Platform Restrictions for iOS devices accordingly:

o Restrict user GO!Enterprise MDM connections

o Restrict if location not updated

o Restrict if policy out of date

Requirements

The following prerequisites must be in place before you can distribute the GO!Enterprise MDM for iOS application as an Enterprise App:

An account with the iOS Developer Enterprise Program (iDEP) (Note: This is not the Apple Developer Program) Apply for an account at: http://developer.apple.com/programs/ios/enterprise/

See the section, Enrolling in the iOS Developer Enterprise Program, in this document for additional information.

GO!Enterprise MDM Server

Base GO!Enterprise MDM for iOS device application

Organizations that distribute GO!Enterprise MDM for iOS as an Enterprise application will need to obtain an Apple Push Notification service SSL Certificate in order to support the Group Notification feature. See Appendix A. For information on Group Notifications consult the guide, Managing Users & Resources.

http://developer.apple.com/programs/ios/enterprise/

GO!Enterprise MDM Requirements 5

Preparing to distribute the GO!Enterprise MDM for iOS device application as an Enterprise App

If you have decided to distribute the GO!Enterprise MDM for iOS application as an Enterprise App, determine whether you will host the Enterprise App in your own environment or have the app hosted at the Globo Data Center. Then follow this process:

1. Enroll and maintain an annual membership in the Apple iOS Developer Enterprise Program (iDEP). Customer enrollment process for iDEP can take up to eight weeks. http://developer.apple.com/programs/ios/enterprise/

2. Contact Globo Mobile Technologies Technical Support at [email protected] to request an Enterprise App build of the GO!Enterprise MDM for iOS application.

3. Globo Mobile Technologies will send you a Certificate Signing Request (CSR) for the application and the sub-contractor agreement authorizing Globo Mobile Technologies to build your GO!Enterprise MDM Enterprise App. You can expect this within one business day after you make your request.

4. Using the CSR, go to the Apple developer portal and create a Production Certificate, an App ID, and an “In House” Distribution Provisioning Profile for the GO!Enterprise MDM for iOS device application. https://developer.apple.com/devcenter/ios/index.action

5. Send your signed sub-contractor agreement, the Production Certificate, and the Provisioning Profile, to Globo Mobile Technologies.

6. Globo Mobile Technologies will build the app and deliver it to your host site or host it at the Globo Data Center. The new Enterprise App should be available within one business day after Globo Mobile Technologies receives your certificate, profile, and signed agreement.

Updates to your GO!Enterprise MDM for iOS Enterprise App

If you choose to have your GO!Enterprise MDM Enterprise App hosted at the Globo Data Center, updates to the application software will follow the same update schedule as the standard application available on the Apple App Store. Organization administrators will receive notification and descriptions of software updates well in advance.

When you host your own Enterprise App, it is your responsibility to make the updated version available to users.


mailto:[email protected]

https://developer.apple.com/devcenter/ios/index.action

GO!Enterprise MDM Enrolling in the iOS Developer Enterprise Program 6

Enrolling in the iOS Developer Enterprise Program

Distributing the GO!Enterprise MDM for iOS device application as an Enterprise App requires that you enroll in the iOS Developer Enterprise Program. The application process involves creating an Enterprise Developer account and paying the enrollment fee. Apple’s verification process can take up to eight weeks, so it is advisable to begin the enrollment process as soon as possible.

Apple requires the following:

You must have a DUNS number (Data Universal Numbering System from Dun & Bradstreet). You will be required to provide your DUNS number during the enrollment process. If you do not have one, you can obtain one at: https://iupdate.dnb.com/iUpdate/companylookup.htm

You must have authority to bind your company to the legal agreements. You will need to provide the legal contact who can verify that you have the authority to bind your company to the iOS Developer Program Enterprise License Agreement.

Each organization must have its own iOS Developer Enterprise Program membership.

Apply for the Apple Enterprise Developer account at: http://developer.apple.com/programs/ios/enterprise/.

The Apple Developer site steps you through enrolling and creating the account. The steps include:

Enter Account Info - Create an Apple ID, enter personal profile information and answer survey questions. Apple sends a verification email. Verify by signing in with your Apple ID. Enter company information, including legal entity name and DUNS number.

Review and Submit

Company Verification

Agree to License

Purchase Program

Activate Program

https://iupdate.dnb.com/iUpdate/companylookup.htm


GO!Enterprise MDM Preparing for your Enterprise App 7

Preparing for your Enterprise App

After you have obtained an iOS Developer Enterprise Program membership, there are several steps to complete before you can distribute GO!Enterprise MDM for iOS as an Enterprise App.

Determine whether you want to have the App hosted at the Globo Data Center or host it yourself.

Globo Mobile Technologies will send you a Certificate Signing Request (CSR) for a Production Certificate. (Since Globo Mobile Technologies will build and be considered the sub-contractor for the app, the CSR must be issued from Globo Mobile Technologies.)

Sign your sub-contractor agreement with Globo Mobile Technologies authorizing Globo to build your GO!Enterprise MDM Enterprise App.

Through the iOS Development Center, use the CSR to create a Production Certificate and unique App ID, and an “In House” Distribution Provisioning Profile. Send them to Globo Mobile Technologies along with your signed subcontractor agreement.

Globo Mobile Technologies will use the certificate and profile to build the Enterprise App.

1. When you receive the Certificate Signing Request (CSR) from Globo Mobile Technologies, browse to https://developer.apple.com/devcenter/ios/index.action

2. Login to the iOS Development Center using your Apple ID and password.

3. Enter the Certificates, Identifiers, & Profiles page.



Create the Production Certificate and APP Identifier 4. Choose Certificates, then click the + icon in the top right corner of the page to create the

production certificate.

5. Under the Production section, mark the radio button next to App Store and Ad Hoc and click Continue.

6. On the Add iOS Certificate page, select Choose File and locate the CSR file provided by Globo Mobile Technologies. Click Generate.


7. Download and save the Production Certificate. You will send it and the Distribution Provisioning Profile, which you will create next, to Globo Mobile Technologies Technical Support, along with your signed sub-contractor agreement.

8. Once the certificate is created, select App

IDs from the Identifiers section of the left panel and click the + icon in the top right corner of the page to create the App ID.

9. On the Register iOS App ID page, enter an App ID Description for the GO!Enterprise MDM app. This can be any text you want to use to describe the App ID.


10. Again, on the Register iOS App ID page, select an Apple ID Prefix. The default value can be used.

11. Under App ID Suffix, mark the radio button for Explicit App ID and enter a Bundle ID for the App ID. This is a unique ID to identify the app, commonly in the form of com.yourcompanyname.appname.

12. You will see the App ID you just created appear in the iOS App IDs page.


Create an “In House” Distribution Provisioning Profile 13. Once the app identifier is created, select All from the Provisioning Profiles section of the left

panel and click the + icon in the top right corner of the page to create a profile.

14. Set Distribution to In House and click Continue.


15. Select the App ID from the dropdown.

16. Select the production certificate created earlier and click Continue.


17. Give the profile a name by which you can identify it. Click Generate.

18. You will see the newly created Provisioning Profile. Download and save the Provisioning Profile. Send it and the Production Certificate to Globo Mobile Technologies Technical Support, along with your signed sub-contractor agreement.

GO!Enterprise MDM Distributing your GO!Enterprise MDM Enterprise App 14

Distributing your GO!Enterprise MDM Enterprise App

Uploading the Enterprise App to the GO!Enterprise MDM Server (v3.8.0 or greater)

With GO!Enterprise MDM server version 3.8.0 or greater, administrators have the ability, through the GO!Enterprise MDM dashboard, to upload the enterprise app or provide a URL from which users can obtain the application. If they upload the app, they can then elect to push the app to iOS devices by marking the checkbox next to Push GO!Enterprise MDM to iOS Devices.

Administrators can also upload the Apple Push Notification service SSL Certificate necessary to support the Group Notification feature. (See Appendix A for instructions on obtaining this certificate from Apple.)

1. From the GO!Enterprise MDM dashboard, select System Management > Organization.

2. On the Organization Settings page scroll down to the iOS Management section and select Enterprise App from the MDM App Type field.

3. Click the Upload (Edit) button next to the Enterprise App field.

4. From the Manifest File field, select Upload File and browse to select the file or select Provide URL and enter the link from which the app can be downloaded.

GO!Enterprise MDM Distributing your GO!Enterprise MDM Enterprise App 15

5. From the App File, if you uploaded the manifest file, select Upload File and browse to select the app file or select Read from Manifest to pull app file information from the manifest.

6. Enter the Version number of the enterprise app.

7. (Optional) Browse to select the Certificate for Application Notifications (see Appendix A for instructions on obtaining this certificate from Apple), then enter the Certificate Password.

You can make updated versions of the app available to users in the same way.

Distributing the Enterprise App with server versions less than 3.8.0

GO!Enterprise MDM for iOS Enterprise App Hosted at the Globo Data Center

If your GO!Enterprise MDM for iOS app will be hosted at the Globo Data Center, Globo Mobile Technologies will use the certificate and profile you send to build the app and will then issue your organization a URL from which users can obtain the application.

Updates to a GO!Enterprise MDM Enterprise App hosted at the Globo Data Center follow the same update schedule as the standard application available on the Apple App Store. Organization administrators will receive notification and descriptions of software updates well in advance.

GO!Enterprise MDM for iOS Enterprise App Hosted at Your Site

If you are hosting your GO!Enterprise MDM Enterprise App at your own site, you may want to do one of the following:

If your company has developed other Enterprise Apps, you may want to distribute the GO!Enterprise MDM Enterprise App in the manner that you distribute the other apps.

Place the app on a secure Web site. URLs pointing to Enterprise Apps, including manifest files, must be https.

Add the app to the /Sync directory on the server where the GO!Enterprise MDM Web/HTTP component is housed.

The app build comes to you in two files, an .ipa file and a .plist file.

The .ipa file is the app and needs to be hosted on your server.

The .plist is a text file that contains information that an iOS device will need to install the app. The .plist can be located, but is not required to be, in the same place as the .ipa file.

Edit the .plist file so the URL value is the address where you host the .ipa file.

Create a simple Web page that contains a link to the .plist. Users will use it to download the app.

The link to the .plist must be in a format that contains the following specific details, so that devices recognize it as a means to install the app.

Where you see SERVER_ADDRESS_FOR_PLIST, insert the address of the server where your .plist file

is located:

<html><body>

<a href="itms-services://?action=download-

manifest&url=https://SERVER_ADDRESS_FOR_PLIST/GO!EnterpriseMDM.plist">

Install GO!EnterpriseMDM</a>

</body></html>

You can make updated versions of the app available to users in the same way.

GO!Enterprise MDM Renewing an Enterprise App Certificate 16

Renewing an Enterprise App Certificate

IDEP Membership Renewal Organizations distributing GO!Enterprise MDM for iOS as an Enterprise App are required to maintain an annual membership in the Apple iOS Developer Enterprise Program (iDEP).

Enterprise App Certificate and Profile Renewal In addition, the Enterprise App provisioning profile must be renewed annually and the production certificate must be renewed every three years. Organizations should keep track of the certificate’s expiration date, because there is no automatic renewal notification as the date approaches.

An expired provisioning profile will prevent your organization from receiving updates to the GO!Enterprise MDM App.

An expired certificate will disable all apps in use.

1. Before your production certificate or provisioning profile expires, log in to the Apple iOS Dev Center and select Certificates, Identifiers & Profiles from the right panel. Follow the same procedure used to initially create your production certificate and provisioning profile.

Annually you will generate a new provisioning profile. See Create an “In House” Distribution Provisioning Profile

Every three years you will generate a new production certificate in addition to the provisioning profile. See Create the Production Certificate and APP Identifier

2. Download the renewed production certificate and/or provisioning profile and send them to Globo Mobile Technologies.


GO!Enterprise MDM Appendix A: Upload SSL Certificate for Group Notifications 17

Appendix A: Upload SSL Certificate for Group Notifications

Apple Push Notification service SSL Certificate

When is an APNs SSL Certificate required? Organizations that distribute GO!Enterprise MDM for iOS as an Enterprise application will need to obtain an Apple Push Notification service SSL Certificate in order to support the Group Notification feature. The certificate establishes a trusted provider identity for the GO!Enterprise MDM server and is presented when the GO!Enterprise MDM server makes a connection to the Apple Push Notification servers.

The Production SSL Certificate must be obtained from Apple and renewed annually. Once the certificate has been obtained, it must be uploaded to the GO!Enterprise MDM server. It will replace the certificate for the App Store version of GO!Enterprise MDM for iOS that is hard-coded in the GO!Enterprise MDM server.

There are two methods for uploading the certificate:

Globo Mobile Technologies Technical Support team can provide a tool that enables you to upload your certificate and replace the hard-coded certificate.

If you are using GO!Enterprise MDM server version 3.8.0 or greater, you can upload the certificate from the dashboard. See Uploading the Enterprise App.

Obtain the Production SSL Certificate from Apple 1. Obtain a Certificate Signing Request (CSR) from the Globo Mobile Technologies Technical Support

team.

After completing the CSR, the APN cert needs to be exported. This will give you a .p12 file which has the private key. You will be asked to create a password. Record the password, as you will need it when you upload the .p12 file to the GO!Enterprise MDM server.


2. Log in to the Apple developer portal at: https://developer.apple.com/devcenter/ios/imndex.action and go to the Certificates, Identifiers and Profiles section.

3. Select App IDs under the Identifiers section.

4. Select the App ID for GO!Enterprise MDM and click edit.

5. Enable Push Notifications.

https://developer.apple.com/devcenter/ios/imndex.action


6. Once push notifications are enabled, click the Create Certificate button under Production SSL Certificate.

7. You will then be prompted for a Certificate Signing Request (CSR). Use the new CSR provided by Globo Mobile Technologies Technical Support team.

8. Select Done when you see that the cert has been created and is displayed in the Certificates list.

9. Examining the App ID again shows that push notifications are enabled and that the newly created cert has been applied.

10. Click the Download button, then save the .cert file so that it can be installed on the GO!Enterprise MDM server.


Install the tool that allows you to upload your certificate Note: If you are uploading the enterprise app to the GO!Enterprise MDM server via the GO!Enterprise MDM dashboard (v3.8.0 or greater), you can upload the notifications certificate via the dashboard as well. This eliminates the remainder of the steps in this appendix. See Uploading the Enterprise App.

A push notification certificate for the App Store version of GO!Enterprise MDM for iOS is hard-coded in the GO!Enterprise MDM server. Those with an Enterprise app must replace this certificate by uploading the SSL certificate they obtain from Apple. This is done by installing a .php file on the GO!Enterprise MDM server. The file provides a tool that allows you to upload your SSL certificate.

For security reasons, you must remove this file after you have finished uploading the certificate.

1. Obtain the apnscert.php file from Globo Mobile Technologies Technical Support team.

2. Add the .php file to the GO!Enterprise MDM directory.


3. You will also need to know the OrganizationSAKey to upload the certificate.

From the Microsoft SQL Server Management Studio, run the following query to obtain the key:

SELECT OrganizationSAKey,

DisplayName

FROM Organizations

The OrganizationSAKey will display in the bottom pane. Note the key, as it will be used during the certificate upload.


Upload the SSL certificate to the GO!Enterprise MDM server Now upload the SSL certificate you obtained from Apple.

1. From a browser, enter this address to upload the certificate: https://<yourserveraddress>/dashboard/apnscert.php

2. Enter your OrganizationSAKey.

3. Browse to the location where you stored the certificate file. Select it and click Open.

4. Enter the Certificate Password that you used when exporting the certificate file.

5. Click Submit.

The uploaded certificate replaces the certificate that is hard-coded for App Store apps


Remove the .php file 1. You will see a confirmation that the APNs Certificate has uploaded successfully.

2. For security reasons, you must remove the apnscert.php file from the GO!Enterprise MDM directory after you have finished uploading the certificate.

Locate it, then right click on it and select Delete.

Documents

Distributing GO!Enterprise MDM for iOS as an Enterprise Appnotifymdm.notify.net/docbin/GOMDM Enterprise App.pdf · GO!Enterprise MDM Why Distribute GO!Enterprise MDM for iOS as an