Application Whitelist and Blacklist Feature in WSO2 EMM

It can be white listed and black listed applications in WSO2 EMM 2.1.0 onwards.

What is Application White List?
White listed applications are the only applications that allowed run on device. Any other application which does not appear on the list will not be allowed to run on the device.
What is Application Black List?
Black listed applications are the applications that are not allowed to run on the device.

Application black lists and white lists can be deployed on devices as device policies. Follow the below steps to create black list.

1. Enroll a device on EMM.
2. Create an app restriction policy
  i) Go to the EMM main window by issuing below url to the browser address bar
      https://localhost:9443/emm/
  ii) Click policy add button as shown in below

iii) Choose the platform. ex : I choose android platform.

iv) Click Applications Restrictions profile and click Off toggle button to On the profile

v) Choose black list from select box and add applications as below. Note that to add a description about the application in App Name/Description column and to add the package name of the application in Package Name column. Click continue button.

vi) Select device owner type, user or role and policy action level from current wizard

vii) Type a policy name and description about policy and click publish to Device button from current wizard

viii) Now click the policy view button and you will redirect to below page.

ix) Now click the APPLY CHANGES TO DEVICES button to change take effect as below.

You can follow the same steps as above to create a white list as well.

WSO2 APP Manager(APPM) and WSO2 Enterprise Mobility Manager (EMM) integration

There are two separate cases for APPM and EMM integration

1. APPM and EMM on a single JVM. ex : EMM standalone pack.
2. APPM and EMM on separate JVMs. ex : clustered scenario

For the first case, EMM standalone vanilla pack should work without changing any configuration.

For the second case, There are some configurations which should be done. Follow the below steps to configure APPM and EMM on separate JVMs.

1. If you run APPM and EMM on same machine change the port offset of one pack. Let's change the port offset of APPM pack.

i) Change the port offset of carbon.xml to 10 which is in <APPM_HOME>/repository/conf directory.
ii) Since APPM default authentication mechanism is SAML SSO change the port of IdentityProviderUrl also in app-manager.xml

 ex : Change the port as shown in light green

<SSOConfiguration>

        <!-- URL of the IDP use for SSO -->
        <IdentityProviderUrl>https://localhost:9453/samlsso</IdentityProviderUrl>

        <Configurators>
            <Configurator>
                <name>wso2is</name>
                <version>5.0.0</version>
                <providerClass>org.wso2.carbon.appmgt.impl.idp.sso.configurator.IS500SAMLSSOConfigurator</providerClass>
                <parameters>
                    <providerURL>https://localhost:9453</providerURL>
                    <username>admin</username>
                    <password>admin</password>
                </parameters>
            </Configurator>
        </Configurators>

    </SSOConfiguration>

iii) Change the port offset to 9453 for all the ports found in sso-idp-config.xml which is located in <APP_HOME>/repository/conf/identity directory.

Now setting port offset is done.

2. Now create a mobile app by going to App Manager publisher. publish it and it will be available in APPM store.
3. Create an OAuth application in EMM by following article How to map existing oauth apps in wso2.
4. Open the app-manager.xml in APPM and find for a configuration called MobileAppsConfiguration. change ActiveMDM property to WSO2MDM.

ex: <Config name="ActiveMDM">WSO2MDM</Config>

Change the MDM properties named as WSO2MDM as follows. Change the port to EMM port of ServerURL and TokenApiURL. Here client key and client secret is which returned from EMM when OAuth application is created.

<MDM name="WSO2MDM" bundle="org.wso2.carbon.appmgt.mdm.restconnector">
                <Property name="ImageURL">/store/extensions/assets/mobileapp/resources/models/%s.png</Property>
                <Property name="ServerURL">https://localhost:9453/mdm-admin</Property>
                <Property name="TokenApiURL">https://localhost:9453/oauth2/token</Property>
                <Property name="ClientKey">veQtMV1aH1iX0AFWQckJLiooTxUa</Property>
                <Property name="ClientSecret">cFGPUbV11yf9WgsL18d1Oga6JR0a</Property>
                <Property name="AuthUser">admin</Property>
                <Property name="AuthPass">admin</Property>
            </MDM>

5. Enrol your device in MDM.
6. Now you can install apps using app manager store to devices enrolled in EMM.