Manage enterprise iOS devices using OS X Server, as well as distributing applications within the company

Sooner or later, in a good part of large companies, the question arises of developing an internal corporate mobile application. In this regard, IT specialists face the challenge of working out two scenarios: when to install applications on employees' personal devices and when they need to distribute devices that are company property for employees to perform specific tasks. This article discusses working with iOS devices through OS X Server.

Introduction

')
Today, if you wish, you can easily find information on setting up OS X Server, MDM solutions, etc. in English, and in general, the configuration does not present any complexity. This article is addressed to people in the Russian-speaking segment who first encountered this task and who want to understand what awaits them and how difficult and frightening everything is.
The presented material was compiled as a brief guide to action and, as unnecessary, was sent straight to the Basket, but before I clicked “Empty Cart”, I thought that perhaps it would be useful to someone else who is not familiar with this topic.

Formulation of the problem

So, let's define the tasks that the company (or the customer) has set for us.

We have two independent vectors of mobile development:

• Corporate mobile application for employees of the company, which they install on personal devices, in our case, on iOS devices. For example, the main functionality is reading news and a calendar of events;
• A highly specialized mobile application for certain categories of employees, for example, sociologists who do surveys, say, on the street. They are given iOS-devices specifically for these tasks, and the management, of course, hoping for the consciousness of these people, nevertheless, wants to exclude the very possibility of inappropriate use of both work time and devices. Simply put, you need to forbid doing everything: listen to music, use the Internet, install games from the app store, etc., leave only the opportunity to use the application for social. polls;

Likbez

Despite the fact that these two areas are different, they have something in common, namely the distribution of applications within the company, i.e. on the Apple Developer Enterprise Program . For an unprepared developer, it may seem that this is simply the registration of the company-developer as a legal entity, with some Enterprise gadgets. Unfortunately, literally the essence of the program is “The Apple AppStore: no joining this program you get the opportunity to distribute iOS-applications bypassing the AppStore, but lose the opportunity to publish to the official AppStore.

Let's now take a look at the question of the proliferation of corporate mobile applications a little wider, and not only through the eyes of Apple. There are three major players on the market today - Google, Apple and Microsoft.
So, as each application of these technology companies sees the distribution of applications bypassing the store.

Google
It's simple. Android open operating system. Build an application package (* .apk) and then do whatever you want with it. All you need is to pay a one-time fee to the Google Play Developer Program.

Microsoft
Two programs. For publication in the official store - a small one-time fee. To publish to bypass the store, you must once a year buy a special certificate - Enterprise Mobile Code Signing, which your applications subscribe to. Roughly speaking, it is like a pass for an application to the garage of a smartphone application - “I am VIP, I can be installed from the back door”.

Apple
Cupertino, in turn, see the approach to the development of mobile applications as follows.
For publication in the official AppStore, there is an Apple Developer Program in which both individuals and legal entities can participate, the price is the same. If you have a need to publish applications within the company, i.e. Not for everyone, Apple provides the Apple Developer Enterprise Program, although in it you will not be able to publish applications in the AppStore.
But what if you need to publish apps for both scenarios? Or until it is possible to register a legal entity, you just started to make a prototype and you can register an individual, i.e. one developer.
In this case, the classic Apple Developer Program provides the ability to upload applications directly to 100 devices of various types (iPhone, iPad) registered in the developer console. Scientifically, this is called AdHoc, i.e. distribution for testing purposes.
Strangely enough, this thing often solves a whole layer of problems at the initial stages, and we'll talk about it in the framework of this article.

Great, we have a prototype of a mobile application, a developer account in the Apple Developer Program and a great desire to solve the problem.

We now turn to the model of managing iOS devices. If you used to use an iPhone or iPad, you probably heard about such a thing as Profile. No, not that user profile from SharePoint, but a profile that describes device permissions. For example, access to beta versions of iOS. It is on this thing that everything is spinning in the Apple world: installing applications, limiting device capabilities, configuring devices, etc. And as you probably already understood, we will steer these profiles. With someone voluntarily, with someone forcibly.

Apple Configurator 2

In order to distribute iOS applications in a corporate environment, two tools are needed (from the AppStore):

• Apple Configurator 2 App ( Free );
• Application OS X Server ( 1.490 rubles );

Both tools can manage profiles, but only the profiles installed by Apple Configurator 2 cannot be deleted by the user.

OS X Server, or rather the Profile Manager, which is part of it, is required for remote configuration of profiles, since Apple Configurator 2 works only "on the cord".

So that you clearly understand the scheme: through profiles (in fact, the configuration file that flies back and forth), you can install applications remotely and configure devices. Apple Configurator 2 allows you to ensure that the profile set with it will not be deleted by the user, and the Profile Manager in OS X Server allows you to configure installed profiles remotely. In the first approximation, the picture is as follows.

Now that you have collected your thoughts in a handful, it remains to add a couple of missing elements to the puzzle. In addition to profiles, there is another link of the mechanism called Supervising, which Apple Configurator 2 provides. It consists in resetting the device to factory settings, tightly configuring to use your Profile Manager, and banning the device from hard reset. It also supports the function of removing images of memory, in other words, backups.

And the last thing, I think you have already thought, how can ordinary employees get corporate applications without all these terrible discharges and configurations? For them, the Profile Manager provides a website, called MyDevices by default, from which they can download a profile that automatically installs the necessary applications on their smartphone. Yes, that's how simple it is with ordinary employees.

Ok, back to Apple Configurator 2.

We list its main features again:

• Resetting iOS devices to factory defaults;
• Create device profiles;
• Create Blueprint images;
• Installing an iOS device in the Supervised mode, which allows you to control the device (reset, etc.) only from this computer;
• Creating backups of iOS devices;

A new word, Blueprint, has appeared in this list, and we still have not understood exactly what restrictions we can set through Profiles. Let's talk about it.

Profiles in Apple Configurator 2

Profiles are used to set the required parameters and restrictions on the device.

For example, you can install in one profile:

• Settings for connecting to WiFi;
• Restrictions on the use of multimedia capabilities of the device;
• Prevent the installation of applications from the AppStore;
• Filter on available websites, or prohibit the use of the Safari browser;

Multiple profiles can be installed on one device.

Blueprints in Apple Configurator 2

Blueprints are quick “images” of desired settings and applications that can be applied to a connected device in one click.


Well, I hope you got a general idea of ​​the basic configuration tools for iOS devices. It's time to move on to more advanced and, accordingly, paid instruments.

Apple OS X Server

OS X Server is an application, pre-2014 pre-installed on top versions of Apple Mac mini computers. Currently distributed as a separate application through the AppStore and is available for installation on any Apple computers.
It is a set of services for maintaining the fleet of Apple devices, as well as the remote control of iOS and OSX devices.

Key features:

• User administration within the Open Directory (integration with Active Directory is possible);
• Sync calendars;
• Contact synchronization;
• File Sharing;
• Mail server;
• User group chats;
• Profile Manager for remote control of iOS and OSX devices;
• TimeMachine server (backups);
• VPN;
• PHP and Python website hosting;
• CMS Wiki;
• Xcode server for continuous integration;
• DHCP server;
• DNS server;
• FTP server;

Synchronize OS X Server with Active Directory

Of course, I could not pass by Active Directory, as we work in the corporate segment, and, at least, a few words I must say on this topic. Like Microsoft, Apple works with its directory service, the Open Directory, which is not conceptually different from Active Directory.
For integration with Active Directory, a “binding” mechanism is used. It is configured quite simply, however, it does not differ in iron stability (on different combinations of versions of Windows Server and OS X Server there is a different result, that is, you can lose touch).


Great, now you are aware of all the basic terms and principles. We can start setting up mechanisms for distributing applications within the company and configuring iOS devices.

Algorithm of actions for setting up the infrastructure for configuring iOS devices and distributing applications

1. Install Apple Configurator 2 from the AppStore.

2. Install Apple OS X Server from the AppStore.

3. Create a profile with WiFi settings for an iOS device through Apple Configurator 2, if employees need to use a certain private corporate network to which we do not want to give them a password.

4. Let's go to configure OS X Server. Set the host name, accessibility from networks and remote access settings. This is the initial configuration of our server.

5. Configure the Open Directory in OS X Server to further store users in it.

6. Create users in OS X Server, or synchronize the server with Active Directory. We will need another administrator and a simple user (he is also an employee).

7. Create user groups (by teams / departments / divisions) and distribute users to these groups in OS X Server. We will need this to configure device groups.

8. Enable Apple Push Notifications in OS X Server.

9. Set up contact synchronization in OS X Server. This is optional if you do not plan to maintain a general list of contacts between employees.

10. Now the most interesting. Configure the profile manager in OS X Server.

11. Through the Profile Manager in OS X Server, enable the ability to bind iOS devices configured in Apple Configurator 2.

12. Through the Profile Manager in OS X Server, we will set the user (better the user group) restrictions on his iOS device.

13. It's time to work with a physical device. We will translate an iOS device into Supervised mode via Apple Configurator 2 with accepting settings from a remote Mobile Device Management (MDM) server, which is OS X Server.

14. Add all iOS devices to the Apple developer account.

15. Prepare a corporate application in Xcode for distribution within the company in Xcode (Archive).

16. Download the * .ipa package of the application in the Profile Manager in OS X Server.

17. In the Profile Manager in OS X Server, we indicate for the desired user (better than the user group) which corporate applications to install on his device. Let's push applications (we will begin remote installation).

Infrastructure setup is complete.

Distributing apps to employees with personal iOS devices

Afterword

A conceptual description of OS X Server in Russian, although a bit outdated, I advise you to read here .

Current videos on setting up individual components of OS X Server can be viewed here .

Note
The distribution method described in the article is applicable to any applications created for iOS, i.e. It is identical for applications written in Xamarin, Cordova or Native. All you need is to create an * .ipa application package and load it into Profile Manager.

I hope the article will seem useful to beginners, or not so, iOS developers. Successes!