Enroll an Android device with WSO2 EMM

If you need to quickly setup and have a look at the capabilities of WSO2 EMM; easiest to configure and enroll is an Android device. First of all, download, WSO2 EMM from here. 
Documentation provides all the information required for downloading the product. 
IMPORTANT: Following only shows the out of the box experience of WSO2 EMM and it not a production ready setup.

  1. Prior to running the server, make sure you have,
    a. Installed Oracle Java SE(JDK/JRE) version 7 or 8
    b. Both the server machine and the Android device you are enrolling are on the same WiFi   network.
  2. Once you download the server, extract the zip file to a desired location. Now from command prompt, go to the location of the extracted folder; lets call this EMM_HOME folder. 
     3. From command prompt, go to bin directory inside EMM_HOME and start the server by issuing following command,
  • On windows - wso2server.bat
  • On Linux/Mac - sh wso2server.sh
     Once the server start up complete, in the terminal, you will see the links to EMM console as bellow,

[2015-12-20 18:48:08,822]  INFO {org.wso2.carbon.device.mgt.mobile.url.printer.URLPrinterStartupHandler} -  EMM Console URL : https://10.10.10.203:9443/emm
[2015-12-20 18:48:08,850]  INFO {org.wso2.carbon.core.internal.StartupFinalizerServiceComponent} -  Server           :  WSO2 Mobile Device Manager-2.0.0-SNAPSHOT
[2015-12-20 18:48:08,851]  INFO {org.wso2.carbon.core.internal.StartupFinalizerServiceComponent} -  WSO2 Carbon started in 38 sec
[2015-12-20 18:48:08,998]  INFO {org.wso2.carbon.ui.internal.CarbonUIServiceComponent} -  Mgt Console URL  : https://10.10.10.203:9443/carbon/


4. To enroll a device for testing purposes, we first need to download the agent application and install it on an Android device, their are two options, 
     Option 1. Enter the following url in a web browser of the Android device. https://[SERVER_IP]:9443/emm-web-agent/enrollments/android/download-agent
       Replace [SERVER_IP] with the IP address/hostname of server.
     Option 2.  Go to the following address, from a web browser, https://[SERVER_IP]:9443/emm.
Replace [SERVER_IP] with the IP address/hostname of server. Add an security exception to your browser since SSL is not configured. When you get to the login screen, enter "admin" for both username and password. In the dashboard, click on add button under device section, which will present you with a QR code. Scan the QR code from your Android device(with a QR code reading app) and follow the URL.



 5. The purpose of 4th step is to somehow visit the URL https://[SERVER_IP]:9443/emm-web-agent/enrollments/android/download-agent from the Android device. In a real scenario, the user will get an email with this address with an invitation to enroll to EMM. Whatever the method followed, it will bring up the following page on the mobile device,



6. Now click on Download Agent. Since the agent app is not from the Google play store, it is necessary to enable installing entrusted applications, by going to menu -> setting -> security on the Android device and enable, unknown sources.



7. Now once the download is complete, tap on the downloaded file and install the app by selecting "Package Installer". Follow the instruction until installation completes and open the app.

8. From their onward, follow the instruction given in the documentation.

9. Once it is complete visit the EMM console(https://[SERVER_IP]:9443/emm), and it will list one device and where you can view the device and apply operation on it.






Comments

Post a Comment

Popular posts from this blog

MDM vendor singing and MDM APNS certificate generation for WSO2 Iot server

Image
When we look at how Apple has created the device management protocol for iOS devices, one thing that we notice is they have tried to make the process as secure as possible. In this article, we will look at what is the MDM APNS certificate and how we can generate and use them. When managing iOS devices, the device management commands are typically executed by a native client available in the iOS operating system itself. When a device management server needs to send a command to this client, the command has to be sent though Apple APNS server. However, since these commands are executed by the operating system it self, using a general APNS certificate, does not make sense. Therefore Apple has made it mandatory that the device management servers use a special MDM APNS certificate when sending commands to a device. These certificates expire annually and the admins have to renew then annually. MDM APNS certificate generation is bit of a complex process and to make things simpler, I ha
Read more

Android device owner concepts

Image
With Android 5.0, Google has introduced Device owner and device profile concepts to make android enterprise ready. Device owner app is an application with special privileges to perform task such as monitor and manage settings and other privileged tasks. This means in a literal sense,the devices ownership is given to the organization managing it making the device owner concept ideal for COPE scenario. Once the device ownership is assigned to an app, in order to remove it, the device needs to be factory reseted, for example in a situation where the device needs to be given to a different user.  When the device ownership is given to a specific app, the app gets access to a set of Android APIs that are only available to device owner app. These APIs are not available to regular Android apps. At a given time there can only be one device owner app in a device, which prevents another device owner app overriding the policies enforced by the first device owner app.  The service app prov
Read more

[APIM] Send emails to users upon self-sign up aproval

When using the self sign up of WSO2 API manager, the user needs to wait for the admin to approve their signup request. However when the admin approves/rejects the request, users may like to receive an email with the status of the approval. This can be achieved by the extension points provided by APIM. In this article we will consider how this can be achieved, First step is to set up the user sign up work flow as described in the documentation[1]. After following the documentation, you should be able to self sign up and attach a workflow to the to the self sign up process. After self signup, you can login to the admin portal of APIM and approve or reject a request to sign up. This portal can be address through https://HOSTNAME :PORT /admin for example https://10.100.9.174:9443/admin Next we need to extend from UserSignUpWSWorkflowExecutor of APIM and write your own logic to send out an email. In this case, we have overriden the complete method of UserSignUpWSWorkflowExecutor. In the
Read more