Managing Verse for iOS using AppConfig

Managing Verse for iOS on managed devices

The first step in managing the Verse for iOS app is to define your EMM device policies that are important for your organization. A device policy is required to manage any native iOS app. When a user provisions their device with the device policy, any applications that are installed using the EMM enterprise app catalog or that are even listed in the EMM enterprise app catalog will be installed as managed apps. Managed apps get access to resources such as per app custom configuration and per app VPN tunnels that can be accessed only by your enterprise apps.

There are many device policies and customizable restrictions available for an Apple iOS device. The most common include:

• Device passcode
• Restricting access to managed files
• Per App VPN for app tunneling
• Disable screen capture
• WiFi provisioning
• Prevent app data backup

The steps for defining and assigning a device policy to an Apple iOS device will vary per EMM provider. See your EMM provider’s documentation to determine exactly how to create and assign a device policy. For IBM’s MaaS360 EMM, policy creation starts on the Security view, using the Add Policy action. Select a Type of iOS MDM for the Policy Type.

Once the policy is created in MaaS360, you can define device and advanced settings. Passcode, Restrictions, Application Compliance, VPN and many others.

Once your options are defined, save and publish the policy to users or devices.

Distributing Verse for iOS to devices

Verse for iOS must be placed into your EMM provider’s enterprise app catalog for it to be properly managed on an Apple device. Once the app is available in the app catalog, users can easily install it from your EMM provider’s app catalog on the device. Or, if you have enabled a setting to enforce management of all apps listed in the app catalog, then even if a user were to install Verse for iOS directly from Apple iTunes (or even Apple TestFlight), then the app will still become a managed app and behave like a managed app. The steps will vary from one EMM to another on how the app is loaded into the enterprise app catalog, so consult your EMM provider’s documentation.

Creating a custom app configuration profile

Verse for iOS supports custom managed configuration which allows the EMM administrator to preconfigure many Verse for iOS settings. Any setting defined using the EMM takes precedence over a similar setting or policy defined at the Traveler server. Setting custom app configuration will vary by EMM. All EMM providers support the concept of Apple managed configuration using custom keys and values. However, some EMM providers now support definition of these parameters using an app’s AppConfig XML definition file as defined by the AppConfig Community. Verse for iOS provides the file Verse_AppConfig.xml which defines the supported configuration settings for this app. If your EMM supports an AppConfig.xml file, it is recommended to use this file over manually entering in managed configuration keys and values. Not all EMM providers support AppConfig.xml, and if your provider does not support this format yet, you can still enter in configuration keys and values separately. See the Verse iOS App Configuration Reference section for a list of keys and values supported by Verse for iOS.

If your EMM is not listed in this table, it may still support AppConfig.xml files and will support Managed Configuration Keys assuming it also supports Apple iOS device management.

Custom App Configuration using Citrix XenMobile

The following steps are based on Citrix XenMobile documentation for defining an App Configuration Device Policy for an iOS app. It is recommended that you consult the XenMobile documentation for your specific version of XenMobile to ensure that these steps have not changed. Note that while Citrix XenMobile does not support the AppConfig XML file format, it does support managed app configuration using key/value pairs defined as dictionary content as described below. These steps are performed by your Citrix XenMobile administrator.

1. In the XenMobile console, click Configure > Device Policies. The Device Policies page appears.
2. Click Add. The Add a New Policy page appears.
3. Expand More, and then under Apps, click App Configuration. The App Configuration Policy information page appears.
4. In the Policy Information pane, enter the following information:
   • Policy Name: Type a descriptive name for the policy.
   • Description: Optionally, type a description of the policy.
5. In the Platforms list, uncheck all platforms other than iOS.
6. Click Next. The iOS Platform information page appears.
7. Configure the app identifier. In the list, click the app you want to configure or click Add new to add a new app to the list. The first time the Verse app is configured, you must click Add new. The app identifier to use is com.ibm.lotus.traveler.
8. Add the Dictionary content. Copy the text below to your clipboard and paste into the input field.

   <dict>
    <key>appConfigOnly</key>
      <true/>
    <key>serverType</key>
      <string>choice</string>
    <key>serverURL</key>
      <string></string>  
    <key>user</key>  
      <string></string>  
    <key>password</key>  
      <string></string>  
    <key>restrictClipboard</key>  
      <false/>
    <key>disableShareMenu</key>  
      <false/>
    <key>disableRemoteImages</key>  
      <false/>
    <key>mamKey</key>
      <string></string>
    <key>mamKeyMismatchTimeout</key>
      <integer>24</integer>
    <key>disableAttachmentExport</key>  
      <false/>
    <key>mailFilterDays</key>
      <integer>3</integer>
     <key>mailFilterDays.lock</key>  
      <false/>
    <key>previewLines</key>  
      <integer>2</integer>
    <key>previewLines.lock</key>  
      <false/>
    <key>confirmDelete</key>  
      <false/>
    <key>confirmDelete.lock</key>  
      <false/>
    <key>attachmentFilter</key>  
      <integer>100</integer>
    <key>attachmentFilter.lock</key>  
      <false/>
    <key>mailThreads</key>  
      <false/>
    <key>mailThreads.lock</key>  
      <false/>
    <key>useMailSignature</key>  
      <false/>
    <key>useMailSignature.lock</key>  
      <false/>
    <key>mailSignature</key>  
      <string></string>
    <key>mailSignature.lock</key>  
      <false/>
    <key>bccMyself</key>  
      <false/>
    <key>bccMyself.lock</key>  
      <false/>
    <key>calendarPastFilterDays</key>  
      <integer>14</integer>
    <key>calendarPastFilterDays.lock</key>  
      <false/>
    <key>calendarAlarms</key>  
      <true/>
    <key>calendarAlarms.lock</key>  
      <false/>
    <key>calendarAudioAlarms</key>  
      <true/>
    <key>calendarAudioAlarms.lock</key>  
      <false/>
    <key>weekStartDay</key>  
      <integer>0</integer>
    <key>weekStartDay.lock </key>  
      <false/>
    <key>exportContacts</key>  
      <false/>
    <key>exportContacts.lock</key>  
      <false/>
    <key>searchCorpDirectory</key>  
      <true/>
    <key>searchCorpDirectory.lock</key>  
      <false/>
    <key>contactSortOrder</key>  
      <string>lastfirst</string>
    <key>contactSortOrder.lock</key>  
      <false/>
    <key>contactDisplayOrder</key>  
      <string>firstlast</string>
    <key>contactDisplayOrder.lock</key>  
      <false/>
    <key>displayContactPhotos</key>
      <false/>
    <key>allowCustomKeyboards</key>
      <false/>
    <key>appPassword</key>
      <false/>
    <key>appPasswordType</key>
      <string>numeric</string>
    <key>appPasswordMinLetters</key>
      <integer>0</integer>
    <key>appPasswordMinNumeric</key>
      <integer>0</integer>
    <key>appPasswordMinNonLetters</key>
      <integer>0</integer>
    <key>appPasswordMinUppercase</key>
      <integer>0</integer>
    <key>appPasswordMinLowercase</key>
      <integer>0</integer>
    <key>appPasswordMinSymbols</key>
      <integer>0</integer>
    <key>appPasswordMinLength</key>
      <integer>4</integer>
    <key>appPasswordAutolock</key>
      <integer>30</integer>
    <key>appPasswordExpiration</key>
      <integer>0</integer>
    <key>appPasswordHistory</key>
      <integer>0</integer>
    <key>appPasswordWipeFailures</key>
      <integer>0</integer>
    <key>appPasswordProhibitSequences</key>
      <false/>
    <key>appPasswordProhibitTouchID</key>
      <false/>
   </dict>

9. Edit the dictionary content to customize it for your organization. For details on each setting, see the section Verse iOS App Configuration Reference.
   Note: If you are deploying this profile to multiple users, then use Citrix XenMobile Macros to specify the value for the user parameter. For example, ${user.username} populates the user name value in the text field of any policy.
10. Click the Check Dictionary button to ensure that the XML is valid. If there are no errors, you see Valid XML below the content box. If any syntax errors appear below the content box, you must correct them before you can continue.
11. Click Next. The App Configuration Policy assignment page appears.
12. Next to Choose delivery groups, type to find a delivery group or select a group or groups in the list to which you want to assign the policy. The groups you select appear in the Delivery groups to receive app assignment list.
13. Click Save.

How do I restrict files from Verse for iOS from be shared with unmanaged apps?

This behavior can be configured by setting up a Restrictions Device Policy using your EMM administration portal. The exact label wording may vary from one EMM to another, but typically there will be two specific settings for restricting if files can be shared between managed apps and unmanaged apps. One setting will prohibit sharing of files from managed apps to unmanaged apps. This is the most common setting and is recommended if you are looking to prevent file data from being shared from the Verse for iOS app to other, unmanaged apps that are on the same device. The other setting will prohibit sharing of files from unmanaged apps to managed apps. This is more uncommon to set, but if you have a use case where you want to prevent files originating from an unmanaged apps from being emailed using Verse for iOS, then prohibit this file sharing.

For IBM’S MaaS360, these settings are in the Device Settings tab of the iOS MDM Policy, with the Restrictions section of the policy. They are named Allow Open from Managed to Unmanaged Apps and Allow Open from Unmanaged to Managed Apps.

How can I connect to my On-Premises Traveler server?

Verse for iOS communicates with its Traveler server over a secured TLS channel using the HTTPS protocol. Depending on your network topology and the placement of your Traveler server, the server may or may not be directly accessible from the mobile application without deploying a network tunnel. SeePlanning your network topology that describes three possible options.

• Reverse Proxy
• Virtual Private Network
• Direct connection

If using a Reverse Proxy or a Direct Connection, then to set up Verse for iOS, just provide the Server URL to the Proxy or the Traveler server using custom configuration. However, if these topologies do not match your needs, you can also use a Per App Virtual Private Network (Per App VPN). A Per App VPN can be defined as a device policy and access to the tunnel can be restricted to only managed apps on the device, or even to just a subset of those managed apps. The tunnel is activated on demand and will close when no longer required.

Using the AirWatch Secure Email Gateway:

Verse for iOS supports connecting through the AirWatch Secure Email Gateway when connecting to the Traveler server. When using this configuration, make sure to set the deviceId AppConfig configuration parameter set to value {EASDeviceIdentifier}. This value is an AirWatch macro which will expand to a unique identifier for each device used, and it will cause the Verse iOS device to use this identifier when syncing with the Traveler server. The AirWatch Secure Email Gateway uses this value to determine if a device is managed or not so that it can enforce that only managed devices are allowed to connect to the Traveler server.

Note that when using the deviceId key, ensure that the Traveler server is running version 9.0.1.19 or later.

How can the Verse app and data be removed or wiped from the device?

Since Verse for iOS is deployed as a managed app, removing the device profile will remove Verse and all Verse data from the device (this is true for all managed apps). A user could do this themselves if the policy allows for this, or the profile could be removed remotely by the EMM administrator.

Most EMM providers also allow the administrator to configure Automated Actions which can monitor various compliance scenarios. If one of the monitors is triggered, various actions can be automatically executed, ranging from wiping the enterprise apps and data from the device to notifying the user via an email. See your EMM documentation for more information.

Verse iOS App Configuration Reference