Restricting access by device category

An administrator can restrict access to devices that do not support device security using HCL Traveler or devices by their device type or user agent values.

Device Security

The setting Prohibit devices incapable of security enablement can be enacted by device category to prevent devices that do not support security enablement from syncing with HCL Traveler. Security enablement includes the ability of HCL Traveler to remotely wipe a device, as well as the ability to enforce usage of a device password. This setting is defined in both the Default device preference and security setting values and the Domino HCL Traveler policy settings document (described in Creating an HCL Traveler policy settings document).

The meaning of 'Prohibit devices....' differs by device category:

• Android: Enabling Prohibit devices incapable of security enablement prevents Android devices meeting the following criteria from syncing with the HCL Traveler server:
  • Devices with Android OS level less than 2.2
  • Devices where the user has not enabled the Device Administrator when prompted

When a device is unable to sync with the server due to Prohibit device incapable of security enablement, a status of "403 (Forbidden)" is returned to the device. Also, the value "Prohibit" appears in the administration application device security view and device document Access field.

HTTP User-Agent

The simplest way to restrict device access is using the NTS_USER_AGENT_ALLOWED notes.ini settings for each device type. There is a notes.ini for each known device type, NTS_USER_AGENT_ALLOWED_OTHER for all devices that don't fall into one of the known device types, and NTS_USER_AGENT_ALLOWED_REGEX as an additional check for additional granularity if needed (default is check that allows everything).

Here are some examples:

• NTS_USER_AGENT_ALLOWED_ANDROID=true, NTS_USER_AGENT_ALLOWED_IBM_APPLE=true, NTS_USER_AGENT_ALLOWED_REGEX=.* (all the default values) and all other NTS_USER_AGENT_ALLOWED_ notes.ini's changed to false, allows only the HCL Domino Workspace Mail clients.

However, if you need more granular control, you may use the NTS_USER_AGENT_ALLOWED_REGEX to control access based on the HTTP User-Agent header of the requests.

• The following tables list user agents for supported clients. The HCL Domino Workspace Mail for Apple user agent changes based on the client build. The Apple Mail client user agent is based on the hardware plus the OS level.

  Note: Some examples of known Apple user agents are presented in these tables, but this is not a comprehensive list. One method to determine the exact user agent that a device is using for synchronization is to review the HCL Traveler usage log file after a new device synchronizes with the server. The file can be found here: <Domino Data Directory>\IBM_TECHNICAL_SUPPORT\traveler\logs\NTSUsage_DATE_TIME.log

  Note: Some of the build numbers in the following tables are examples and may change over time as software versions on the device are updated.

Parent topic:Controlling access to HCL Traveler