Help at Work Start Here 12

Help@Work for iOS: Start Here

Version 1.2April 14, 2015Proprietary and Confidential Do Not Distribute


©2015 MobileIron, Inc. All Rights Reserved. Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication.

For some phone images, a third-party database and image library, © 2007-2009 Aeleeta's Art and Design Studio, is used. This database and image library cannot be distributed separate from the MobileIron product.

MobileIron, Connected Cloud, and MyPhone@Work are registered trademarks of MobileIron, Inc. BlackBerry is a registered trademark of RIM. Windows is a registered trademark of Microsoft, Inc. iPhone is a trademark of Apple, Inc. Android is a trademark of Google Inc. Cisco AnyConnect is a registered trademark of Cisco Technology, Inc. Edge Client is a registered trademark of F5 Networks, Inc. HTC One is a registered trademark of HTC Corporation. Junos Pulse is a registered trademark of Juniper Networks, Inc. KeyVPN is a registered trademark of Mocana Corporation. OpenVPN is a registered trademark of OpenVPN Solutions, LLC. Samsung Galaxy is a registered trademark of Samsung Electronics Co., Ltd. Samsung KNOX is a trademark of Samsung Electronics Co., Ltd. This document may contain additional trade names, trademarks and service marks of others, which are the property of their respective owners. We do not intend our use or display of other companies trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

Bonjour, the Bonjour logo, and the Bonjour symbol are trademarks of Apple Computer, Inc.

Company Confidential2


Overview

What is Help@Work?Help@Work is a custom, in-house iOS app and MobileIron Core integration that uses the iOS Air-Play feature to provide screen sharing over a WAN. With Help@Work installed, device users can more easily ask for help, and administrators can see the device screen remotely for troubleshoot-ing. You can use the Help@Work SDK to create your own fully-customized edition of Help@Work to better direct your end-users to your help-desk personnel.

The following diagrams illustrate a basic Help@Work deployment for devices in the network and outside the network.

For devices inside the network:

1. The administrator makes a request for remote display.2. MobileIron Core connects to the device and prompts the user to install [email protected]. Once Help@Work is installed, it uses AirPlay to interact with the AirPlay receiver.



4. The Admin Portal interacts with the AirPlay receiver to mirror the device display.

For devices outside the network:

1. The administrator makes a request for remote display.2. MobileIron Core connects to the device and prompts the user to install [email protected]. Once Help@Work is installed, it uses AirPlay via VPN to interact with the AirPlay receiver.4. The Admin Portal interacts with the AirPlay receiver to mirror the device display.

Where to get Help@WorkThe MobileIron Reporting Database ISO is available on:

https://support.mobileiron.com/support/CDL.html


https://support.mobileiron.com/support/CDL.html


Prerequisites• For signing the app:

• Mac OS X 10.8.4 (You cannot use a Windows system to build an iOS app.)

• iOS Developer Enterprise Program account with a Team Agent or Team Admin role

• Help@Work SDK package

• Xcode 5 or Xcode 6

• Xcode command line tools

• Assets for customization

• For using the app:

• MobileIron VSP 6.0 through MobileIron Core 7.1

• iOS 7 through iOS 8.2 with AirPlay support

• Apple TV second or third generation on the same subnet as the Admin Portal (Third-party AirPlay receivers such as Reflector, X-Mirage, and AirServer, can also be used.)

Installing Xcode command line toolsDownload and install the Xcode command line tools from developer.apple.com/downloads. Be sure to select the version that corresponds to your OSX installation.

RecommendationsNote the following recommendations for implementing and using Help@Work:

• Use the Safari web browser to interact with the Apple Developer Portal.

• Use VPN for internal AirPlay receivers. AirPlay uses multiple streams on dynamic port numbers, so it's difficult to set up firewall rules for it. VPN is the best option for traversing firewalls with Help@Work.

• Use the Firefox extension or Internet Explorer extension provided with the Help@Work package to simplify AirPlay receiver discovery. The extensions require Bonjour (Apple’s zero-configuration networking implementation). Bonjour is available by default on OS X; it must be installed on Windows.

LimitationsNote the following limitations for Help@Work:

• Due to AirPlay limitations, iPhone device users cannot share the screen while using the phone.

• Per-App VPN blocks UDP traffic, making it incompatible with Help@Work.

• The device user must bring the Help@Work app to the foreground to enable screen sharing.



Release notes

New features• Resolved an issue in which a Help@Work session would terminate while establishing a session

or during a session on iOS 8.1 through iOS 8.2, as a result of mobile device management activity happening in the background of the device.

• Resolved an issue in the Internet Explorer browser extension where the Bonjour display discovery sometimes failed if a JavaScript console had not been established.

• Added considerable debug logging to the console output.

Resolved issues• CE-5548: Resolves an issue on iOS 8.1.3 and 8.2 that caused active sockets to close when

background MDM activity occurred.

• HAW-109: When using the IE browser extension, if no JavaScript console has been created, Core produces an error when rendering the Remote Display dialog.

• HAW-82: Help@Work was not compatible with some apps, including the native Photos and Videos apps. This has been resolved.

• HAW-101: Previously, Help@Work would occasionally fail to display AirPlay mirroring requests. This has been resolved.

Known issues• HAW-121: Currently, password-protected displays do not work.

Usage notes• HAW-70: Occasionally, the preferred AirPlay receiver is not detected due to Bonjour limitations.

Workaround: Restart the receiver.

• HAW-69: Firefox occasionally does not detect the presence of the HelpWork extension. Workaround: Flush the cache and reload the page. Also check your browser's add-on panel and make sure that the extension is enabled.

• HAW-43: The findDisplays.py script is not compatible with Python v3.x.



Preparing and distributing the Help@Work appThe process described in this section requires an enterprise identity certificate issued by Apple. There is generally one person authorized to request this certificate, and only two are permitted at one time. Therefore, the necessary steps will vary.

If you are not the agent for your Apple Enterprise account, contact the agent to have that person create or give you access to your production enterprise identity certificate, and skip ahead to “Cre-ating a distribution provisioning profile” on page 9.

If you are the agent and need to create a production enterprise identity certificate, start at “Creat-ing a distribution certificate” on page 7.

The figure below outlines the process of preparing and distributing a Help@Work app.

Creating a distribution certificateThe distribution certificate validates that the app comes from a source that is trusted by Apple.

To create a distribution certificate:

1. Log in to Apple’s iOS Dev Center.2. Under Developer Program Resources, select “Certificates, Identifiers, and Profiles”.3. Click Certificates.4. Under Certificates, select Production.5. Click + to add a certificate.6. In the Production section, select “In House and Ad Hoc“.



Note: If this option does not appear, then you probably are not using an Enterprise Program account. This is a requirement for completing this section. If this option is grayed out, your organization has probably reached Apple’s limit for number of distribution certificates. Ask the person who created a distribution certificate to export the certificate along with its private key to a .CER or .P12 file. Save this file to your Downloads folder and skip to “Adding the distribu-tion certificate to your Login Keychain” on page 8.

7. Click Continue.8. Complete the process for generating a Certificate Signing Request (CSR).9. Save the CSR file to your desktop.10. Click Browse.11. Select the CSR file.12. Click Submit.

This step sends the CSR to Apple for approval. When the certificate request is approved, a Download button displays in the Actions column. If the Download button does not display, try refreshing the page.

13. Click Download.14. Click Save File.

This step saves the file in your Downloads folder.15. See “Adding the distribution certificate to your Login Keychain.”

Adding the distribution certificate to your Login KeychainTo add the distribution certificate to your Login Keychain:

1. Double-click the certificate in your Downloads folder.This step opens Keychain Access and adds the certificate to your Keychain. Note that no confir-mation message is displayed.

2. In Keychain Access, confirm that the distribution certificate is listed in the Login Keychain. The certificate should have the following name: “iPhone Distribution: <Company Name>”.

3. If the certificate is not in the Login Keychain, check the other keychains.4. If the certificate is in another keychain, move it to the Login Keychain.

Creating a unique app IDThe app ID grants your app access to the distribution certificate you added to your Login Key-chain.

To create an app ID:

1. Log in to Apple’s iOS Dev Center.2. Under Developer Program Resources, select “Certificates, Identifiers & Profiles”.3. Click Identifiers.4. For App ID Prefix, select the team ID from the drop-down.5. Click App IDs.6. Click + to add an ID.7. In the Description field, enter a brief description of the app.

Device users do not see this text.



8. Select Explicit App ID.9. In the Bundle Identifier field, enter a unique identifier for the app bundle.

We recommend using the following format:com.yourcompany.helpatwork

10. For App Services, select Data Protection. 11. Select the Complete Protection option.12. Click Continue.

The new app ID displays in the App IDs page.13. Click Submit.

Creating a distribution provisioning profileThe distribution provisioning profile associates the distribution certificate with your app and autho-rizes devices to use the app.

To create a distribution provisioning profile:

1. Log in to Apple’s iOS Dev Center.2. Under Developer Program Resources, select “Certificates, Identifiers & Profiles”.3. Click Provisioning Profiles.4. Select Distribution.5. Click +.6. Under Distribution, select In House.7. Click Continue.8. Select App ID.9. Click Continue.10. Select the distribution certificate you created.11. Click Continue.12. The following prompt displays:

Do you need additional entitlements?13. Click Continue to dismiss this prompt.14. Enter a name for the profile.

Enter a name that distinguishes the profile from others, such as “HelpAtWork In House Profile.”15. Click Generate.16. Click Download.

The file will have a .mobileprovision extension.17. See ““Collecting rebranding assets” on page 9.”

Collecting rebranding assetsThe Help@Work package requires customizing the home screen. You also have the option of cus-tomizing the icons.



Home screen customizationsThe Help@Work home screen is web view. Therefore, you need to create a folder with an index.html. Include any resources on which the HTML file relies.

IconsIf you are customizing the icons, complete the following steps:

1. Create an icons subfolder in the folder you created for the home screen customizations.2. Place the following icons in the icons folder:

Signing and rebranding your custom Help@Work appThe script included in the package you downloaded from the MobileIron support site completes the following tasks:

• customizes the app’s home screen

• customizes icons

• signs the app

Signing requirementsAssemble the following items before running the customization script:

• provisioning profile (created in “Creating a distribution provisioning profile” on page 9)

• name of the distribution certificate (created in “Creating a distribution certificate” on page 7)

Running the scriptWhen you have assembled the required items, complete the following steps to run the customiza-tion script:

1. Make sure you have installed Xcode command line tools. See “Installing Xcode command line tools” on page 4.

2. Unzip the Help@Work SDK package you downloaded from the MobileIron support site. 3. Open Terminal.4. In the folder containing the unzipped contents, run the script with the following command:

./brandAndSign.py --provisioningProfile <path_to_ProvisioningProfile.mobileprovision> --signingIdentity "<distribution certificate common name>" --appTitle "<app title>" --branding-Directory <directory> --appBundleVersion <build version> --appDisplayVersion <release ver-sion>

IconPreferred Image Size Description

[email protected] 120x120 Home screen icon for high-resolution iOS 7 iPhone and iPod Touch.

AppIcon76x76~ipad.png 76x76 Home screen icon for iOS 7 iPad.

AppIcon76x76@2x~ipad.png 152x152 Home screen icon for high-resolution iOS 7 iPad.

AppIcon40x40~ipad.png 40x40 Spotlight search results icon for standard resolution devices.

[email protected] 80x80 Spotlight search results icon for high-resolution devices.



Note that the first two parameters are required.Example:./brandAndSign.py --provisioningProfile ./ProvisioningProfile.mobileprovision --signingIdentity "iPhone Distribution: Acme, Inc." --appTitle "My App" --brandingDirectory ./resources/ --appBundleVersion 2.1.3.57 --appDisplayVersion 2.1.3

Note: The version options should be used only if you intend to manage the versions to track things like updated branding for an app that has already been deployed. The appBundleVersion parameter assigns a custom bundle version, which is for internal version tracking. The appDis-playVersion parameter assigns a custom version to the app for display to app users.

Distributing the appThe steps for distributing the signed app resemble those of distributing an in-house app.

1. Make sure you have access to the AppIcon76x76@2x~ipad icon.

• If you are rebranding the icons, this icon is in the icon directory you created when signing the app.

• If you are not rebranding the icons, extract the AppIcon76x76@2x~ipad icon from the Help@Work bundle. (Open the Payload folder, right-click Help@Work, and click Show Package Contents.)

2. Log in to the Core Admin Portal.3. Select Apps > App Distribution Library.4. Select iOS from the Select Platform list.5. Click Add App to display the App Wizard.6. Click Next.7. Click Browse.8. Select the signed app.9. Click Open.10. Select “Send installation request on device registration or sign-in”.

This step ensures that newly-registered devices receive a prompt to install this app. 11. Click Next.12. Make sure the display version matches the one you specified when you signed the app.13. Click Browse under App Icon.14. Select your app icon file.15. Click Next.16. Click Finish.17. Assign the app to an appropriate label for the target devices.18. Distribute the app to devices that are already registered using one of the following methods:

• Use the Message button in the App Distribution Library page to push an install request.

• Ask the device user to install the app from the Apps@Work enterprise app storefront.



Installing Bonjour (for Windows systems only)To discover AirPlay displays from a Windows system, you must have Apple Bonjour installed. This installs automatically with iTunes from Apple, or with the Help@Work AirPlay Finder add-on for Internet Explorer. To use it with either the Help@Work AirPlay Finder for Firefox or with the included command-line utility, run either the 32-bit or 64-bit installer found in the "bonjour" direc-tory of the Help@Work download bundle.



Installing the Firefox extensionMobileIron includes a Firefox extension to make it easier for administrators to select an AirPlay server. The extension requires Bonjour (Apple’s zero-configuration networking implementation). Bonjour is available by default on OS X; it must be installed on Windows. See “Installing Bonjour (for Windows systems only)” on page 12.

To install the add-on for a Mac, drag the mi-dnssd.xpi file from the folder in which you unzipped the Help@Work SDK package to the Firefox browser.

To install the add-on for Windows:

1. Display the Add-ons Manager in Firefox.2. Display the Extensions tab.3. Click the Settings icon.4. Select “Install Add-on From File”.5. Navigate to the folder in which you unzipped the Help@Work SDK package.6. Open the mi-dnssd.xpi file.7. Click Install Now.

When the installation is complete, the MobileIron DNSSD for Firefox 1.0.0 extension should be displayed as “Help@Work remote display finder 1.0.0” and enabled in the Add-ons Manager.



Installing the Internet Explorer extensionMobileIron includes an Internet Explorer extension to make it easier for administrators to select an AirPlay server on a Windows system. The extension requires Bonjour (Apple’s zero-configuration networking implementation). Bonjour must be installed on Windows. See “Installing Bonjour (for Windows systems only)” on page 12.

To install the extension:

1. Navigate to the folder in which you unzipped the Help@Work SDK package.2. Open the ieairplayer.exe.3. Complete the installation wizard.

Supported browser versionsThe Internet Explorer extension is supported for Internet Explorer 9.



Acquiring necessary AirPlay receiver informationIf you are not able to use one of the extensions provided for AirPlay receiver discovery, you can use one of the following methods to acquire the necessary information:

• findDisplays.py script supplied with the Help@Work SDK

• dns-sd command line

Using the findDisplays.py scriptThe findDisplays.py script requires Python 2.x to be installed. After extracting the contents of the Help@Work package, execute the findDisplays.py script to display a list of AirPlay receivers.

Using the dns-sd command lineTo use the dns-sd command line on your desktop (Windows or Mac) the information necessary to access a receiver (requires Bonjour to be installed):

1. Enter the following command:$ dns-sd -B _raop._tcp

Browsing for _raop._tcp

DATE: ---Wed 18 Dec 2013---

22:10:30.597 ...STARTING...

Timestamp A/R Flags if Domain Service Type Instance Name

22:10:30.598 Add 2 5 local. _raop._tcp. 12a34567b89c@BS’s MacBook Pro

2. Record the instance name.3. Press Control-C.4. Enter the following command:

$ dns-sd -L "<instance name>" _raop._tcp local

Lookup 12a34567b89c@BS’s MacBook Pro._raop._tcp.local

DATE: ---Wed 18 Dec 2013---

22:18:35.853 ...STARTING...

22:18:36.125 12a34567b89c@BSmith’s\032MacBook\032Pro._raop._tcp.local. can be reached at JSs-



MacBook-Pro.local.:47000 (interface 5)

et=0,3,5 ss=16 da=true am=AppleTV3,1 tp=UDP pw=true sf=0x4 txtvers=1 md=0,1,2 vn=65537 vs=150.33

sv=false ch=2 rmodel=MacBookPro9,1 sr=44100 cn=0,1,2,3

5. Record the hostname and port number.6. Press Control-C.7. Enter a command such as the following:

$ ping BSmiths-MacBook-Pro.local

PING bsmiths-macbook-pro.local (203.0.113.0): 56 data bytes

64 bytes from 203.0.113.0: icmp_seq=0 ttl=64 time=0.042 ms

8. Record the IP address.



Using Help@WorkUploading the Help@Work app to the VSP causes the Remote Display option to be added to the Actions menu in the Devices page of the Admin Portal. Use this command to establish screen shar-ing with iOS 7 devices. If a device has not yet installed the Help@Work app, you can install it as part of the remote display process.

To start remote display:

1. Make sure the AirPlay receiver (e.g., Reflector) is running and available.2. In the Admin Portal, go to Users > Devices.3. Select the device you want to work worth.4. Select Actions > iOS Only > Remote Display.5. Use the following guidelines to complete the displayed form:

6. If the device user has not already installed the Help@Work app, click Install Help@Work. This will push an installation request to the target device. Note that the device user must be in at least one label applied to Help@Work in the App Distribution Library.

7. Before clicking Request Display, instruct the device user to launch the Help@Work app.8. Click Request Display.

The device user will be prompted to accept your request.

To end the sessionThe AirPlay session can be ended from iOS (Control Center) on the device or from the receiver. There is no option in Help@Work for ending the session.

Item Description

Display Appears in the browser if you have enabled the included extension. Select your AirPlay receiver from the drop-down list.

IP Address Enter the IP address of the AirPlay receiver to use. If you selected a server from the Display list, then this field will already be filled in.

Port Enter the port number of the AirPlay receiver to use. If you selected a server from the Display list, then this field will already be filled in.

Password If the AirPlay receiver is password-protected, enter the password for accessing the AirPlay receiver.


Documents

Help at Work Start Here 12