Deploying iPhone Configs

Question

Deploying iPhone Configs

Has anyone took a stab at deploying iPhone configs via OS X Server's web services (Apache) yet? Or via email perhaps?

My company is doing preliminary iPhone testing. Id like to experiment with deployment strategies. I don't foresee having more than 100 iPhones, but I could be wrong.

I see a lot of potential "chicken and the egg" scenarios with both of Apple's web and email deployment strategies. For example, how can the web deployment work if you haven't already configured the iPhone's network settings in the first place (after all, you need to surf to a URL for the config file, so TCP/IP, Wi-Fi & DNS need to be working already) Same with email config deployments: How can one receive the config via email unless the user's email account has already been configured in the first place? Seems like it might be easier to push out configs manually via iTunes (unless you are deploying hundreds or thousands of iPhones en mass of course).

Thoughts?

Xserve, Mac OS X (10.5.3)

Posted on Jul 29, 2008 6:55 AM

Reply

Answer 1

Jul 29, 2008 10:14 AM in response to LenH

Hi LenH

But in order to get on the network to get the config, dont they end up manually configuring the iPhone's network settings for your LAN/WLAN? Or do you have the iPhone configs on a public Web server that the user can get to using AT&Ts network and DNS??

Reply

Answer 2

LenH

Level 2

395 points

Jul 30, 2008 10:41 AM in response to Daniel Stranathan

Yes, by external website, I mean a public site that is Internet facing and accessible to the AT&T wireless network without any configuration on the part of the user. They still have to type in a short URL in Safari, but that's about it.

Reply

Answer 3

Jul 30, 2008 10:59 AM in response to Daniel Stranathan

Once they get to the site which hosts the config, I assume they click on the config link and start the install process- right?

Question: Once they click the link, do they get a confirmation dialog box "Are you sure you want to install?" or does it START INSTALLING without any confirmation? The reason I ask is because I have a internal test web server built with a simple test iPhone config file, but I only have 1 iPhone to test right now (my personal phone by the way) and I dont want to wipe it or install my config on it yet! I just want to verify the config file can be deployed for now, and that the server is working. Then, once I get a 2nd iPhone for production testing (purchased by my employer) then I will start phase 2 of my testing: the actual install process. Then phase 3 will be the day-to-day usage & QA of my config files settings (making sure wi-fi, VPN and mail all work as expected, polices are in place, etc) and finally phase 4 will be administrative things such as remote-wipe etc.

Reply

Answer 4

LenH

Level 2

395 points

Jul 30, 2008 2:56 PM in response to Daniel Stranathan

When they hit the URL (link), the profile downloads and the user must click on the INSTALL button to confirm the installation.

If another profile is already installed (one with a different unique name), you have to remove it first from the iPhone to install the new one.

Sounds like your plan will work well.

Reply

Answer 5

LenH

Level 2

395 points

Jul 30, 2008 2:59 PM in response to LenH

TIP: If you want the lock timeout to last longer than 5 minutes (the default of the configuration utility), it appears that you have to edit the configuration file with a text editor before you publish it.

I change the maxInactivity line in the config file from 5 to 30:

<key>maxInactivity</key>
<integer>30</integer>
<key>minLength</key>
<real>4</real>

Reply

Answer 6

TonyM

Level 1

145 points

Jul 30, 2008 7:36 PM in response to Daniel Stranathan

When you go to install the new profile it asks if you want to replace the existing one. There is no need to manually remove it first.

I've had a couple of issues:

1. When I try to add a partial config (without username, password and email address) the iphone tries to setup as IMAP even though I clearly configured it to be POP. I hadn't tried looking at the config file in a text editor to see if it had been written wrong -- this has been sort-of a side project.

2. Even though I install custom root certificates, some do not work once they are on the iphone (though they work on my mac).

I couldn't find a way to wipe the existing config completely and replace with the new. Is this possible? When I add an email account I don't want the user to be able setup others and if they had others setup before applying the profile I want them removed when they install the profile. Thoughts?

Reply

Answer 7

Jul 31, 2008 2:03 PM in response to LenH

So, on iPhones that have never been configured with Apple's Enterprise configuration tools will not have an existing config right? Example: my personal iPhone (which is not configured with Apple's tools) doesnt have a Profile in Settings -> General. I assume it doesn't show up unless it has been configured previously?

Also, can ANYONE remove the config from Settings -> General, or do you need a password?

(I have some test configs built and a Apache web server built to push out the configs, but Im waiting on my IT Dept to purchase some iPhone devices for testing. I do have a personal iPhone (and so does my wife), but I dont feel like wiping them, if you know what I mean. I appreciate your input and comments.

Message was edited by: Daniel Stranathan

Reply

Answer 8

LenH

Level 2

395 points

Jul 31, 2008 2:18 PM in response to Daniel Stranathan

Daniel Stranathan wrote:
So, on iPhones that have never been configured with Apple's Enterprise configuration tools will not have an existing config right?

Right.

Daniel Stranathan wrote:
Also, can ANYONE remove the config from Settings -> General, or do you need a password?

Right. No password needed. (Presuming that they know the device lock password anyway.)

The carrot we have is that if a person wants VPN access, they get a profile that has an Exchange config, password config and VPN config. Otherwise, they have to config Exchange themselves (which is trivial, of course). Getting a proper VPN config isn't so trivial, we hope.

Reply

Answer 9

TonyM

Level 1

145 points

Aug 6, 2008 8:39 AM in response to five0.4tluv

You need to have the proper MIME type. You'll need to modify the webserver so that it sends a custom MIME type for this type of file. I think for Apache it is :

AddType application/x-apple-aspen-config mobileconfig

Reply

Answer 10

Aug 6, 2008 9:28 AM in response to TonyM

OS X Server's apache server should be aware of the .mobileconfig MIME type if you have OS XSserver version 10.5.3 or higher.

Yes, "AddType application/x-apple-aspen-config mobileconfig" is the correct syntax, according to the Apple Enterprise Deployment Guide PDF, page 26.

Reply

Answer 11

LenH

Level 2

395 points

Jul 29, 2008 9:12 AM in response to Daniel Stranathan

Hi. I push the configs to an external website and let the users access their personal settings via Safari on the device itself.

Reply

Answer 12

Jul 30, 2008 7:17 PM in response to LenH

How do you delete an existing profile/config? Where are they located at? Do you do it from the Settings app on the iPhone? I dont see a Configuration pane on the iPhone from which to manage them.

Reply

Answer 13

LenH

Level 2

395 points

Jul 30, 2008 8:40 PM in response to Daniel Stranathan

Settings->General->Profile and then tap Remove

That will uninstall a profile.

Reply

Answer 14

Aug 6, 2008 8:12 AM in response to LenH

I exported a config and put on an external site to download from my phone. All it does is open it. What am I missing?

Reply