Manage corporate iOS devices with OS X Server, as well as distribute applications within the company

Sooner or later, in a good part of large companies, the question arises of developing an internal corporate mobile application. In this regard, IT specialists are faced with the task of working out two scenarios: when you need to install applications on personal devices of employees and when you need to distribute devices that are the property of the company for employees to perform specific tasks. This article discusses working with iOS devices through OS X Server.

Introduction

Today, if you wish, you can easily find information on configuring OS X Server, MDM solutions, etc. in English, and in general, the configuration does not present any complexity. This article is addressed to people in the Russian-speaking segment who first encountered this problem and want to understand what awaits them and how complicated and scary everything is.
The material presented was compiled as a brief guide to action and went straight to the Trash as unnecessary, but before I clicked on “Empty Trash,” I thought that it might be useful to someone else who is not familiar with this topic.

Formulation of the problem

So, let's determine the tasks that the company (or the customer) has set for us.

We have two independent development vectors of the mobile direction:

• Corporate mobile application for company employees, which they install on personal devices, in our case, on iOS devices. For example, the main functionality is reading news and a calendar of events;
• A highly specialized mobile application for certain categories of employees, for example, sociologists who do polls, say, on the street. They are given iOS devices specifically for these tasks, and management, of course, hoping for the consciousness of these people, nevertheless, wants to exclude the very possibility of misuse of both working time and devices. Simply put, you need to prohibit doing everything: listen to music, use the Internet, install games from the application store, etc., leave only the ability to use the application for social events. polls

Educational program

Despite the fact that these two areas are different, they have something in common, namely, the distribution of applications within the company, i.e. under the Apple Developer Enterprise Program . For an untrained developer, it may seem that this is simply registering the developer company as a legal entity, with some Enterprise gadgets. Unfortunately, the essence of the program literally is “The Apple AppStore: no place to distribute enterprise apps”, i.e. entering this program you gain the ability to distribute iOS applications bypassing the AppStore, but lose the ability to publish to the official AppStore.

Let’s now take a look at the issue of the spread of corporate mobile applications somewhat wider and not only through the eyes of Apple. There are three major players on the market today - these are Google, Apple and Microsoft.
So, as each of these technology companies sees application distribution bypassing the store.

Google
It's simple. Android is an open operating system. Build the application package (* .apk) and then do whatever you want with it. All you need to do is pay a one-time fee to the Google Play Developer Program.

Microsoft
Two programs. For publication in the official store - a small one-time fee. To publish bypassing the store, you have to buy a special certificate once a year - Enterprise Mobile Code Signing, with which your applications are signed. Roughly speaking, it’s like a pass for an application to the smartphone’s application garage - “I’m VIP, I can be installed from the back door”.

Apple
Cupertinos, in turn, see the approach to developing mobile applications as follows.
For publication in the official AppStore store there is an Apple Developer Program in which both individuals and legal entities can participate, the price is the same. If you have a need to publish applications within the company, i.e. not for everyone, then Apple provides the Apple Developer Enterprise Program, though in it you will no longer be able to publish applications in the AppStore.
But what if you need to publish applications in both scenarios? Or while there is no way to register a legal entity, you just started making a prototype and you can register an individual, i.e. one developer.
In this case, the classic Apple Developer Program provides the ability to upload applications directly to 100 devices of various types (iPhone, iPad) registered in the developer's console. Scientifically, this is called AdHoc, i.e. distribution for testing purposes.
Oddly enough, this thing often solves a whole layer of problems in the initial stages and we will talk about it in the framework of this article.

Well, we have a prototype mobile application, we have a developer account in the Apple Developer Program and a great desire to solve the problem.

Now let's move on to the iOS device management model. If you used an iPhone or iPad before, then you probably heard about such a thing as a Profile. No, not that user profile from SharePoint, but a profile that describes device permissions. For example, access to beta versions of iOS. Namely, on this thing everything revolves in the Apple world: installing applications, limiting device capabilities, configuring devices, etc. And as you probably already understood, we will steer these profiles. With someone voluntarily, with someone forcibly.

Apple Configurator 2

To distribute iOS applications in a corporate environment, two tools are needed (from the AppStore):

• Apple Configurator 2 Application ( Free );
• OS X Server application ( 1.490 rubles );

Both tools can manage profiles, but only profiles set by Apple Configurator 2 cannot be deleted by the user.

OS X Server, or rather Profile Manager, which is part of it, is necessary for remote configuration of profiles, because Apple Configurator 2 only works "on a cord."

So that you clearly understand the scheme: through profiles (essentially a configuration file that flies here and there), remote installation of applications and configuration of devices are carried out. Apple Configurator 2 ensures that the profile installed with it is not deleted by the user, and Profile Manager in OS X Server allows you to configure installed profiles remotely. In a first approximation, the picture is this.

Now that you have collected your thoughts in a bunch, it remains to add a couple more missing elements to the puzzle. In addition to profiles, there is another link in the mechanism called Supervising, which is provided by Apple Configurator 2. It consists in resetting the device to factory settings, hard configuration for using your Profile Manager, and the ban on the hard reset of the device. It also supports the function of taking images of memory, in other words, backups.

And the last, I think you already thought, but how then can ordinary employees get corporate applications without all these terrible dumps and configuration? For them, Profile Manager provides a website, by default called “MyDevices,” from which they can download a profile that sets upautomatically installing the necessary applications on their smartphone. Yes, this is how simple it is with ordinary employees.

Ok, back to Apple Configurator 2.

Once again, we list its main features:

• Reset iOS device to factory settings;
• Create device profiles;
• Create Blueprint images;
• Installing an iOS device in the Supervised mode, which allows you to control the device (reset, etc.) only from this computer;
• Creating backups of iOS devices;

A new word, Blueprint, has appeared in this list, and we still have not understood which restrictions we can set through Profiles. Let's talk about it.

Profiles in Apple Configurator 2

Profiles are used to install the required parameters and restrictions on the device.

For example, you can set in one profile:

• Settings for connecting to WiFi;
• Restrictions on the use of multimedia capabilities of the device;
• Ban on installing applications from the AppStore;
• Filter on available websites, or prohibit the use of the Safari browser;

Multiple profiles can be installed on one device.

Blueprints in Apple Configurator 2

Blueprints are quick “images” of the desired settings and applications that can be applied to the connected device in one click.


Well, I hope you got a general idea of ​​the basic configuration tools for iOS devices. It's time to move on to more advanced, and accordingly, paid tools.

Apple OS X Server

OS X Server is an application pre-installed on top-end versions of Apple Mac mini computers until 2014. Currently distributed as a standalone application through the AppStore and is available for installation on any Apple computer.
It is a set of services for servicing the Apple fleet of devices, as well as remote management of iOS and OSX devices.

Key features:

• User administration within the framework of Open Directory (integration with Active Directory is possible);
• Sync calendars
• Contact Sync
• File Sharing;
• Mail server;
• Group user chats;
• Profile Manager for remote management of iOS and OSX devices;
• TimeMachine Server (backups);
• VPN
• Website hosting in PHP and Python;
• CMS Wiki
• Xcode server for continuous integration;
• DHCP server;
• DNS server;
• FTP server;

Sync OS X Server with Active Directory

Of course, I could not get past Active Directory, since we work in the corporate segment, and at least a few words I have to say on this subject. Like Microsoft, Apple works with its directory service - Open Directory, which is conceptually no different from Active Directory.
For integration with Active Directory, the Binding mechanism is used. It is configured quite simply, however, it does not differ in iron stability (different combinations of versions of Windows Server and OS X Server have different results, that is, you may lose connection).


Great, now you are aware of all the basic terms and principles. We can begin to configure the mechanisms for distributing applications within the company and configuring iOS devices.

Algorithm for configuring the infrastructure for configuring iOS devices and distributing applications

1. Install Apple Configurator 2 from the AppStore.

2. Install Apple OS X Server from the AppStore.

3. We create a profile with WiFi settings for the iOS device via Apple Configurator 2 if employees must use a certain closed corporate network to which we do not want to give them a password.

4. Let's move on to setting up OS X Server. Set the host name, network availability and remote access settings. This is the initial configuration of our server.

5. Configure Open Directory in OS X Server to further store users in it.

6. Create users in OS X Server, or synchronize the server with Active Directory. We need one more administrator and a simple user (he is also an employee).

7. Create user groups (by team / department / department) and distribute users to these groups in OS X Server. We will need this to configure device groups.

8. Enable Apple Push Notifications in OS X Server.

9. Set up contact synchronization in OS X Server. This is optional if you do not plan to maintain a common list of contacts between employees.

10. Now for the fun part. Set up a profile manager in OS X Server.

11. Through Profile Manager in OS X Server, enable the ability to bind iOS devices configured in Apple Configurator 2.

12. Through Profile Manager in OS X Server, we will set the user (preferably a group of users) restrictions on his iOS device.

13. The time has come to work with the physical device. We transfer the iOS device to Supervised mode through Apple Configurator 2 with the acceptance of the settings from the remote MDM server (Mobile Device Management), which is OS X Server.

14. Add all iOS devices to the Apple developer account.

15. Prepare the enterprise application in Xcode for distribution within the company in Xcode (Archive).

16. Download the * .ipa package of the application in Profile Manager in OS X Server.

17. In Profile Manager in OS X Server, we indicate for the desired user (preferably a group of users) which corporate applications to install on his device. Let's make Push applications (start the remote installation).

The infrastructure setup is now complete.

Distributing apps to employees with personal iOS devices

Послесловие

The conceptual description of OS X Server in Russian, although a little outdated, I advise you to read here .

You can watch the latest videos on configuring individual OS X Server components here .

Note
The distribution method described in the article is applicable to any applications created for iOS, i.e. It is identical for applications written in Xamarin, Cordova, or native. All you need to do is create a * .ipa application package and upload it to Profile Manager.

I hope the article seems useful to beginners, or not so, iOS developers. Good luck!